Security update for kubevirt

This update for kubevirt fixes the following issues: Security update correcting a CVE over-claim from the previous update, verified by auditing the fix code actually present in the vendored tree: CVE-2026-39821 bsc1266575: the previous entry claimed this fixed by the golang.org/x/net v0.55.0...

SUSE-SU-2026:23052-1 Security update for helm

This update for helm fixes the following issues Update to version 3.21.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266598. - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth:...

SUSE-SU-2026:23051-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of inpu...

CVE-2026-18604 textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The...

CVE-2026-69083

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...

EUVD-2026-52276

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...

openSUSE 16: warewulf4 / warewulf4-dracut / warewulf4-man / warewulf4-overlay / etc (openSUSE-SU-2026:21509-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21509-1 advisory. Changes in warewulf4: - updated golang.org/x/text to v0.40.0 to fix CVE-2026-56852 bsc1272014 Tenable has extracted the preceding description block...

Malicious code in wacve-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b2e59800b6fa0d3429fb7bccd34b4ae292dc2668919fba704a7b16ddff71071 On import wacveutils, the package's init.py unconditionally invokes checkforupdates, which HTTP-fetches a hardcoded GitHub Gist under the user...

CVE-2026-15206

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

CVE-2025-15675

The CVE-2025-15675 affects the Charitable WordPress plugin prior to version 1.8.5.3. The issue is a failure to sanitize/escape a campaign image text field before output in an HTML attribute, enabling Stored XSS on the front-end campaign page when exploited by a user with high-privilege campaign-m...

CVE-2025-15675 Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text

The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end...

CVE-2025-15675

The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end...

CVE-2026-15206 SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

EUVD-2026-51933

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

Security update for warewulf4 (moderate)

openSUSE security update: security update for warewulf4 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21509-1 Rating: moderate References: bsc1272014 Cross-References: CVE-2026-56852 CVSS scores: CVE-2026-56852 SUSE : 5.9...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

CVE-2026-54707

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disablefiles setting in cli/onionsharecli/web/receivemode.py, where...

CVE-2026-54707

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disablefiles setting in cli/onionsharecli/web/receivemode.py, where...

GHSA-V833-3823-CMHP OnionShare Receive mode writes uploaded files even when file uploads are disabled

Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disablefiles setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint --disable-files / "Disable uploading files", a remote sender who can reach the OnionShare service can still sen...