OPENSUSE-SU-2026:11037-1 quickjs-20260604-1.1 on GA media

These are all security issues fixed in the quickjs-20260604-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-49582

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.1 Angular versions prior to 21.2.17 Angular versions prior to 20.3.25 Description Angular's HttpTransferCache caches HTTP requests during Server-Side Rendering SSR to be reused during client-side hydration,...

PT-2026-49262

Name of the Vulnerable Software and Affected Versions LibreOffice affected versions not specified Description A heap buffer overflow occurs during the import of drawings in DXF format used by CAD software. The issue arises when importing a DXF polyline because the point count is truncated to a...

OPENSUSE-SU-2026:11036-1 python311-zeroconf-0.149.16-1.1 on GA media

These are all security issues fixed in the python311-zeroconf-0.149.16-1.1 package on the GA media of openSUSE Tumbleweed...

openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:20942-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20942-1 advisory. Changes in apptainer: - Update apptainer to version v1.5.1 Security fix bsc1267982: Fix for CVE-2026-48785 / GHSA-cr2j-534f-mf3g. Incorrect path matchin...

ROOT-APP-NPM-CVE-2024-34448 CVE-2024-34448 in @rootio/tryghost__members-csv - Patched by Root

Root has patched CVE-2024-34448 in the @rootio/tryghostmembers-csv package for Root:npm. Multiple fixed versions available...

CVE-2026-11769 Operator - Namespaced User Path Traversal

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating...

samba security update

An update is available for samba. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Samba is an open-source implementation of the Server Message Block SMB protocol...

OPENSUSE-SU-2026:11020-1 freeipmi-1.6.18-1.1 on GA media

These are all security issues fixed in the freeipmi-1.6.18-1.1 package on the GA media of openSUSE Tumbleweed...

ffmpeg-7-7.1.4-3.1 on GA media (moderate)

ffmpeg-7-7.1.4-3.1 on GA media Announcement ID: openSUSE-SU-2026:11009-1 Rating: moderate Cross-References: CVE-2026-30997 CVSS scores: CVE-2026-30997 SUSE : 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CVE-2026-30997 SUSE : 7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N...

tmux-3.6b-2.1 on GA media (moderate)

tmux-3.6b-2.1 on GA media Announcement ID: openSUSE-SU-2026:11006-1 Rating: moderate Cross-References: CVE-2026-11623 CVSS scores: CVE-2026-11623 SUSE : 5.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H CVE-2026-11623 SUSE : 5.8 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N...

EUVD-2026-36588

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.10, an authenticated Nezha dashboard user can create or update a DDNS profile with provider webhook and configure an arbitrary webhookurl, HTTP method, request...

CVE-2026-44784

Discourse has a vulnerability where non-staff group owners can access a group’s outgoing SMTP credentials in plaintext via the group history log (/groups/:name/logs.json). Affected fields include email_password, email_username, smtp_server, smtp_port, and smtp_ssl_mode, with SMTP password being t...

CVE-2026-54361 MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records

MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegations, and shadow attributes. Several controller actions accepted user-supplied fields that should have remained server-controlled, including record identifiers and ownership-relat...

EUVD-2026-36548

Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints are affected by a path traversal vulnerability. Version 26.5.0 fixes the issue...

CVE-2026-53726 Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation query using the $relatedTo operator could read the membership of a Relation field even when that field was hidden from the requesting clie...

CVE-2026-53724 Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.79 and 9.9.1-alpha.4, the default file upload extension blocklist can be bypassed by appending a trailing dot to a filename whose extension would otherwise be blocked e.g...

CVE-2026-12143

The CVE-2026-12143 entry concerns the form-data library where, in versions up to 4.0.5, the field argument to FormData#append and the filename option are concatenated into the Content-Disposition header without escaping CR, LF, or "." This enables CRLF injection when attacker-controlled data is u...

CVE-2026-47135

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combined with the bridge's set/defineProperty/deleteProperty traps having no isDangerousCrossRealmSymbol key check, sandbox...

UBUNTU-CVE-2026-47244

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAXVALUE, and Http2Settings never inserts...