helm3-3.21.3-3.1 on GA media (moderate)

helm3-3.21.3-3.1 on GA media Announcement ID: openSUSE-SU-2026:11334-1 Rating: moderate Cross-References: CVE-2026-56852 CVSS scores: CVE-2026-56852 SUSE : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-56852 SUSE : 6 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...

PT-2026-64259

GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w --check-chars option is used. The find field function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input,...

PT-2026-64260

GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop -t values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted...

OPENSUSE-SU-2026:11359-1 MozillaThunderbird-140.13.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-140.13.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-48013

CVE-2026-48013 (Shopware) is an SSRF in the media external-link flow. Authenticated admins can cause server-side HEAD requests from the endpoint /api/_action/media/external-link to arbitrary internal IPs, bypassing the existing depth of IP checks used by the parallel uploadFromURL flow. The vulne...

CVE-2026-64785

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2...

CVE-2026-47743

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...

CVE-2026-47743

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...

CVE-2026-47743 Shopper: Multiple data integrity and disclosure issues in admin Livewire components

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...

UBUNTU-CVE-2026-15037

Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...

CVE-2026-15037

Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...

PYSEC-2026-3538 Prompty: Arbitrary file read via file reference expansion

Summary Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to t...

ROOT-OS-DEBIAN-11-CVE-2026-63848 CVE-2026-63848 in rootio-linux - Patched by Root

Root has patched CVE-2026-63848 in the rootio-linux package for Root:Debian:11. Multiple fixed versions available...

OPENSUSE-SU-2026:11345-1 amazon-ecs-init-1.105.0-2.1 on GA media

These are all security issues fixed in the amazon-ecs-init-1.105.0-2.1 package on the GA media of openSUSE Tumbleweed...

SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3166-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3166-1 advisory. The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issu...

Important: libpq security update

The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fixes: postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory CVE-2026-6477 For more details about the security issues,...

n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

Impact The GraphQL node did not enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials such as Header Auth, Basic Auth, Query Auth, and OAuth, unlike the HTTP Request node. An authenticated user able to create or edit workflows could therefore point the node's endpoint a...

EUVD-2026-42609

n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector...

EUVD-2026-47579

Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling...

Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libarchive: bsdcat-3.8.8-3.1.hum1 aarch64, x8664 bsdcpio-3.8.8-3.1.hum1 aarch64, x8664 bsdtar-3.8.8-3.1.hum1 aarch64, x8664 bsdunzip-3.8.8-3.1.hum1 aarch64, x8664 libarchive-3.8.8-3.1.hum1 aarch6...