30962 matches found
Security update for clamav (moderate)
openSUSE security update: security update for clamav ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20479-1 Rating: moderate References: bsc1221954 bsc1258072 bsc1259207 Cross-References: CVE-2026-20031 CVSS scores: CVE-2026-20031 SUSE : 5.3...
PT-2026-35731
Name of the Vulnerable Software and Affected Versions nginx-ui versions prior to 2.3.8 Description An authentication bypass exists in the backup restore functionality. During the first 10 minutes after a fresh installation or any process restart, the 'POST /api/restore' endpoint is completely...
CVE-2026-32613
Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL Spring Expression Language to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT...
Security update for python
This update for python fixes the following issue: CVE-2026-3446: Base64 decoding stops at first padded quad by default bsc1261970. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...
ROOT-OS-DEBIAN-12-CVE-2025-1179 CVE-2025-1179 in rootio-binutils - Patched by Root
Root has patched CVE-2025-1179 in the rootio-binutils package for Root:Debian:12. Multiple fixed versions available...
SKYSEA Client View and SKYMEC IT Manager improper file access permission settings
Overview SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. are Enterprise IT Asset Management Tools. SKYSEA Client View and SKYMEC IT Manager contain the following vulnerability. Incorrect default permissions in the installation folder CWE-276 - CVE-2026-39454 Takashi Matsumoto of...
PT-2026-33843
Name of the Vulnerable Software and Affected Versions Spinnaker versions prior to 2026.1.0 Spinnaker versions prior to 2026.0.1 Spinnaker versions prior to 2025.4.2 Spinnaker versions prior to 2025.3.2 Description Echo uses SPeL Spring Expression Language, a powerful expression language for the...
PT-2026-33656
Name of the Vulnerable Software and Affected Versions vibrantlabsai RAGAS versions prior to 0.4.4 Description A server-side request forgery exists in the Collections Module. A remote attacker can initiate this by manipulating the retrieved contexts argument within the try process local file and t...
pretalx vulnerable to stored cross-site scripting in organizer search typeahead
The organiser search in the pretalx backend rendered submission titles, speaker display names, and user names/emails into the result dropdown using innerHTML string interpolation. Any user who controls one of those fields which includes any registered user whose display name is looked up by an...
PT-2026-33587
Name of the Vulnerable Software and Affected Versions SAIL versions prior to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302 Description SAIL is a cross-platform library used for loading and saving images, supporting animation, metadata, and ICC profiles. The TGA codec's RLE decoder in tga.c...
GHSA-3XC5-WRHM-F963 go-git: Credential leak via cross-host redirect in smart HTTP transport
Impact go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. If a remote repository responds to the initial /info/refs request with a redirect to a different host, go-git updates the session endpoint to the redirected location and...
OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets
Summary CDP /json/version WebSocket URL could pivot to untrusted second-hop targets. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.5 Impact A browser profile could trust a CDP /json/version response whose webSocketDebuggerUrl pointed at a differen...
OpenClaw: Discord event cover images bypassed sandbox media normalization
Summary Discord event cover images bypassed sandbox media normalization. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.7 = 2026.4.10 Impact Discord event cover image parameters could bypass the sandbox media normalization path used for outbound...
GHSA-J6C7-3H5X-99G9 OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms
Summary Shell-wrapper detection missed env-argv assignment injection forms. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.2.22 = 2026.4.12 Impact Exec preflight handling missed shell-wrapper and argv-level environment assignment forms that could...
GHSA-X3CV-R3G3-FPG9 Neo4j Labs MCP Servers: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures
Summary The readonly mode in mcp-neo4j-cypher versions prior to 0.6.0 can be bypassed using CALL procedures. Details Impact The enforcing of readonly mode in vulnerable versions could be bypassed by certain APOC procedures. Patches v0.6.0 release hardened the checks around the mode. The only way ...
CVE-2026-40299 next-intl has an open redirect vulnerability
next-intl provides internationalization for Next.js. Applications using the next-intl middleware prior to version 4.9.1with localePrefix: 'as-needed' could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host e.g. scheme-relative // or...
OESA-2026-1925 python-jwcrypto security update
Implements JWK, JWS, JWE specifications with python-cryptography Security Fixes: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing...
ROOT-OS-DEBIAN-13-CVE-2025-6069 CVE-2025-6069 in rootio-python3.13 - Patched by Root
Root has patched CVE-2025-6069 in the rootio-python3.13 package for Root:Debian:13. Multiple fixed versions available...