SUSE-SU-2026:3098-1 Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue: - CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service bsc1249394...

Rockwell Automation CompactLogix Buffer Overflow DoS

The vulnerability of the microprogrammed software in Rockwell Automation’s CompactLogix, ControlLogix, Compact GuardLogix, and GuardLogix controllers lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability can allow a remote attacker to trigger a...

Rockwell Automation CompactLogix Buffer Overflow DoS

The vulnerability of the microprogrammed software in Rockwell Automation’s CompactLogix, ControlLogix, Compact GuardLogix, and GuardLogix controllers lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability can allow a remote attacker to trigger a...

Rockwell Automation CompactLogix Buffer Overflow DoS

The vulnerability of the microprogrammed software in Rockwell Automation’s CompactLogix, ControlLogix, Compact GuardLogix, and GuardLogix controllers lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability can allow a remote attacker to trigger a...

PT-2026-60903

Name of the Vulnerable Software and Affected Versions CloudTAK versions prior to 13.10.0 Description CloudTAK contains a Server-Side Request Forgery SSRF issue that allows any authenticated user to force the server to make arbitrary outbound GET or POST requests to internal addresses. This occurs...

Oracle Linux 10 : mod_md (ELSA-2026-30845)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-30845 advisory. - Resolves: RHEL-175647 - modmd: OCSP response limits CVE-2026-29168 - Resolves: RHEL-134484 - httpd: Apache HTTP Server: modmd ACME, unintended retry interva...

CVE-2026-49284: Insufficient Verification of Data Authenticity

SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login when unsigned Response/InResponseTo is combined with a signed assertion lacking...

CVE-2026-49216: Improper Neutralization of Input During Web Page Generation

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus controller in symfony/ux-autocomplete renders AJAX response items in createAutocompleteWithRemoteData by interpolating the text field into HTML template literals $itemlabelField rather than text,...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the ResponseReverter. An attacker can cause the application to panic and degrade availability or crash the process by sending a specially crafted DNS query that triggers a nil pointer dereference when a...

CVE-2026-62299

CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRuleT in plugin/rewrite/edns0.go, call res.IsEdns0 and immediately dereference the...

CVE-2026-62299

CoreDNS (rewrite plugin, edns0.go) prior to version 1.14.5 could panic when a downstream plugin returns a response with no OPT record. The code path in edns0.go dereferenced a DNS OPT without a nil check, triggered by a query matching a rewrite edns0 rule (local/nsid/subnet with set/append/replac...

CVE-2026-62299 CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT record

CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRuleT in plugin/rewrite/edns0.go, call res.IsEdns0 and immediately dereference the...

CVE-2026-62299 CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT record

CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRuleT in plugin/rewrite/edns0.go, call res.IsEdns0 and immediately dereference the...

EUVD-2026-45020

CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRuleT in plugin/rewrite/edns0.go, call res.IsEdns0 and immediately dereference the...

CVE-2026-56453

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to...

CVE-2026-56453 HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability.

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to...

CVE-2026-56453 HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability.

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to...

CVE-2026-56453

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to...

EUVD-2026-44921

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to...

CVE-2026-56453

Affected software: HCL DFXAnalytics. Vulnerability: Account Takeover via Response Manipulation, where a remote attacker can intercept and alter server HTTP responses before they reach the client, enabling manipulation of authentication/authorization logic. Impact (as described): Potential unautho...