SUSE CVE-2026-16361

Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbi...

SUSE CVE-2026-42617

unknown...

SUSE CVE-2026-42618

unknown...

SUSE CVE-2026-56136

unknown...

CVE-2026-45382

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, decodercontext::decodesliceunittiles libde265/decctx.cc:920 reads pps.CtbAddrRStoTSctbAddrRS at line 966 where ctbAddrRS = ctbY ctbsWidth + ctbX is computed from PPS-supplied colBd/rowBd arrays without...

GHSA-V422-HMWV-36X6 vulnerabilities

Vulnerabilities for packages: langfuse, json-server, kubeflow-pipelines, sqlpad, tileserver-gl, argo-workflows, code-server, kubeflow-centraldashboard...

CVE-2026-52870 vulnerabilities

Vulnerabilities for packages: litellm, semgrep...

CVE-2026-59869 vulnerabilities

Vulnerabilities for packages: code-server, lerna, authentik, vitess, kibana, redisinsight, eslint, sqlpad, kubeflow-centraldashboard, unleash-fips, authentik-fips, opensearch-dashboards, percona-server-mongodb, mongod, prism, arangodb, awx, homepage, pulumi, langfuse-fips, wazuh-dashboard,...

CVE-2026-54490 vulnerabilities

Vulnerabilities for packages: arangodb, gitlab-rails-ce-fips, gitlab-rails-ce...

CVE-2026-50271 vulnerabilities

Vulnerabilities for packages: datadog-agent, datadog-agent-fips, litellm...

GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: prism, sqlpad, npm, pulumi, saf, lerna, code-server, kubeflow-centraldashboard...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: prism, sqlpad, npm, pulumi, saf, lerna, code-server, kubeflow-centraldashboard...

GHSA-W8WR-V893-VJVP vulnerabilities

Vulnerabilities for packages: prism, sqlpad, npm, pulumi, saf, lerna, code-server, kubeflow-centraldashboard...

CVE-2026-59844

A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests...

CVE-2026-55645

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote...

CVE-2026-44978

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to...

CVE-2026-26199

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Igetname is invoked in a way...

CVE-2026-63888

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsithandletextcmd Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c "iscsi-target: Add iSCSI fabric suppor...

CVE-2026-64056

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmacrx is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device ...

CVE-2026-63948

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2capchantimeout on !conn setchantimer takes a l2capchan reference via l2capchanhold before scheduling the delayed work. The normal path in l2capchantimeout drops this reference with...