CVE-2026-78409

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to opentree with ATSYMLINKNOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with...

SUSE CVE-2026-72371

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFSVOLUMERMTREE is set on Fix afsinsertvolumeintocell to set AFSVOLUMERMTREE on the volume replaced, not the new volume, as it's now removed from the cell's volume tree. This will cause the old volume to be...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

PT-2026-84765

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 6.15 and later Description An issue exists where the X-mount.subdir option utilizes a detached-tree fast path and passes the configured subdirectory to the open tree function using the AT SYMLINK NOFOLLOW flag. This flag...

CVE-2026-84309

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/datastructures.py TreeObject.insertchild to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop...

CVE-2026-84309 pypdf: Possible infinite loop for TreeObject.insert_child

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/datastructures.py TreeObject.insertchild to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop...

CVE-2026-84309

pypdf versions prior to 6.16.0 are vulnerable to an infinite loop in TreeObject.insert_child (pypdf/generic/_data_structures.py). An attacker can craft a PDF with a cyclic tree structure that causes the method to follow /Next links indefinitely when a writing code path inserts a child, resulting ...

CVE-2026-84309 pypdf: Possible infinite loop for TreeObject.insert_child

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/datastructures.py TreeObject.insertchild to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop...

EUVD-2026-69477

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/datastructures.py TreeObject.insertchild to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop...

CVE-2026-84309 pypdf: Possible infinite loop for TreeObject.insert_child

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/datastructures.py TreeObject.insertchild to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop...

CVE-2026-84309

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/datastructures.py TreeObject.insertchild to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop...

CVE-2026-46603

A flaw was found in golang.org/x/image/vp8l. A remote attacker can cause a denial of service by providing a specially crafted VP8L image. This image, containing many unused Huffman tree groups, leads to excessive memory allocation during VP8L decoding, resulting in memory exhaustion. Mitigation...

SUSE CVE-2026-72293

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: Add missing radixtreepreload in gaccessshadowfault Add missing radixtreepreload in gaccessshadowfault to guarantee forward progress. The core of gaccessshadowfault has been split into gaccessshadowfault in order ...

CVE-2026-80638

A flaw was found in the ocfs2 component of the Linux kernel. When a user unlinks a refcounted file whose refcount tree has leaf blocks, an out-of-bounds write occurs within the ocfs2removerefcountextent function. This happens because a memset operation writes past the intended memory boundary due...

VPID: An Integrated Framework for Vulnerability Prioritization and Intrusion Detection in Enterprise Networks

Small enterprises face increasingly serious threats to their internal networks but often lack the financial resources, computing capacity, and specialist staff required to deploy resource intensive security platforms. This paper designs and implements VPID, a lightweight framework for vulnerabili...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

CVE-2026-80723

A flaw was found in the of: reservedmem component of the Linux kernel. When the device tree defines more dynamic regions than the MAXRESERVEDREGIONS array can hold, the fdtscanreservedmem function performs an out-of-bounds write. This vulnerability can lead to memory corruption, potentially...

Linux Distros Unpatched Vulnerability : CVE-2026-80723

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - of: reservedmem: prevent OOB when too many dynamic regions are defined On boot, fdtscanreservedmem saves each dynamically-placed /reserved-memory subnode into a...

Linux Distros Unpatched Vulnerability : CVE-2026-80638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2removerefcountextent BUG Unlinking a refcounted file...

Security update for git-lfs (important)

openSUSE Security Update: Security update for git-lfs Announcement ID: openSUSE-SU-2026:0305-1 Rating: important References: 1239322 1252259 Cross-References: CVE-2025-22869 CVE-2025-26625 CVSS scores: CVE-2025-22869 SUSE: 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...