SUSE CVE-2026-98150

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPFFCPU validation for sparse CPU IDs BPFFCPU stores the target CPU ID in the upper 32 bits of the map operation flags. bpfmapcheckopflags currently compares that ID with numpossiblecpus, which is the number of possible...

CVE-2026-103398 OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

CVE-2026-103398 OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

CVE-2026-103398

The software OpenSave through 2.4.0 is vulnerable to an arbitrary file read and write flaw. The issue originates in the manifest request handler , which fails to properly validate save paths provided by paired peers. This allows an attacker to specify arbitrary directories outside of the configur...

CVE-2026-103398 OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

EUVD-2026-89993

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

GHSA-9C5C-9QCX-Q35Q @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

| Field | Value | | --- | --- | | Ecosystem | npm | | Package | @nestjs/platform-fastify | | Affected versions | = 12.0.0, 12.0.2 and 11.2.4 | | Patched versions | 12.0.2 and 11.2.4 upgrade to 12.0.3 / 11.2.5 | Summary On the Fastify adapter, an HTTP request that uses an absolute-form request...

Interpretation Conflict

Overview @nestjs/platform-fastify is a Nest - modern, fast, powerful node.js web framework @platform-fastify Affected versions of this package are vulnerable to Interpretation Conflict via absolute-form request targets in the Fastify adapter's middleware registration. When a request is made using...

netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing

A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.16 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. References 4. Learn More Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570 , an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notificatio...

CVE-2026-76504

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

CVE-2026-76504 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...

Security update for python-tornado

This update for python-tornado fixes the following issues: CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. CVE-2024-58384: CRLF injection in CurlAsyncHTTPClien...

SUSE-SU-2026:4404-1 Security update for python-tornado

This update for python-tornado fixes the following issues: - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. - CVE-2024-58384: CRLF injection in...

Security update for python-tornado6

This update for python-tornado6 fixes the following issues: CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. CVE-2024-58384: CRLF injection in CurlAsyncHTTPClie...

SUSE-SU-2026:4403-1 Security update for python-tornado6

This update for python-tornado6 fixes the following issues: - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. - CVE-2024-58384: CRLF injection in...

CVE-2026-102588

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery CSRF token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This...