SUSE-SU-2026:4283-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure bsc1271504. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. - CVE-2026-59946:...

ALSA-2026:70191 Important: runc security update

The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes: net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 For more details about the security issues,...

Logic flaw in Brocade SANnav Java cache key handling object comparison handling

A logic flaw in Brocade SANnav Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and...

CVE-2026-87080

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

CVE-2026-93709: Improper Resolution of Path Equivalence

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...

VulnCheck KEV: CVE-2026-87902

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local .php file outside the active theme directories, leading to remote code execution...

@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509

The SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an internal address passes the guard, so the server issues requests to loopback and cloud...

CVE-2026-61612

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an...

CVE-2026-61612 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an...

CVE-2026-61612

The @aborruso/ckan-mcp-server (npm) component is vulnerable to Server-Side Request Forgery (SSRF) prior to version 0.4.108 . The root cause is a flaw in the validateServerUrl function within src/utils/http.ts, which validates only the hostname string without performing DNS resolution. This allows...

CVE-2026-61612 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an...

SUSE CVE-2026-72799

SiYuan before v3.7.4 affected =v3.7.2 fails to enforce publish-access filters on five filetree path-resolution endpoints getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. In publish mode, when Publish.Auth.Enable is false, an unauthenticated anonymous reader - or any...

EUVD-2026-84007

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLEDRAWIOPROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in Utils.sanitizeUrl using one DN...

CVE-2026-94393 MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event...

CVE-2026-94393 MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event...

CVE-2026-94393 MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event...

CVE-2026-94185 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias

nvm resolves a requested version or alias by treating it as a filename under $NVMDIR/alias. Before 0.40.8, nvmalias concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default...

CVE-2026-94185 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias

nvm resolves a requested version or alias by treating it as a filename under $NVMDIR/alias. Before 0.40.8, nvmalias concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default...

CVE-2026-63334: Server-Side Request Forgery (SSRF)

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLEDRAWIOPROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in Utils.sanitizeUrl using one DN...

CVE-2026-61612: Server-Side Request Forgery (SSRF)

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an...