CVE-2026-82562 vulnerabilities

Vulnerabilities for packages: argo-workflows, langfuse, tileserver-gl, code-server, opensearch-dashboards, prism, renovate, kubeflow-centraldashboard, sqlpad, json-server...

CVE-2026-33630

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple poin...

CVE-2026-85396

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

CVE-2026-33630

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple poin...

SUSE CVE-2026-13608

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle MITM attack can inject a premature or shortcut response that bypasses complete peer...

SUSE CVE-2026-80229

When performing transfers via libcurl's multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership...

SUSE CVE-2026-80230

When CURLOPTPINNEDPUBLICKEY is configured alongside options that disable standard peer verification CURLOPTSSLVERIFYPEER = 0 and CURLOPTSSLVERIFYHOST = 0, libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check und...

CVE-2026-84962

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

memcached: memcached: Username enumeration via timing side channel

A flaw was found in memcached. A remote attacker can exploit a timing side channel during Simple Authentication and Security Layer SASL password database authentication. This vulnerability allows an attacker to observe subtle timing differences, which could be used to enumerate valid usernames...

memcached: memcached: Denial of Service due to out-of-bounds read

A flaw was found in memcached. A remote attacker could exploit an out-of-bounds read vulnerability in the tryreadcommandasciiauth function. This could lead to a Denial of Service DoS condition, making the service unavailable to legitimate users...

CVE-2026-84971

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to contro...

CVE-2026-75899 vulnerabilities

Vulnerabilities for packages: unleash-fips, kibana, unleash-proxy, vitess, keep-fips, yaml-language-server, wazuh-dashboard-fips, keep, wazuh-dashboard, nextcloud-server, opensearch-dashboards-fips, langfuse-fips, tensorflow-gpu-jupyter, opensearch-dashboards, tileserver-gl-fips,...

CVE-2026-75931 vulnerabilities

Vulnerabilities for packages: langfuse, unleash-fips, kibana, unleash-proxy, vitess, keep-fips, yaml-language-server, wazuh-dashboard-fips, keep, nextcloud-server, opensearch-dashboards-fips, langfuse-fips, opensearch-dashboards, tileserver-gl-fips, gitlab-rails-ce-fips, tileserver-gl, prism,...

CVE-2026-82417 vulnerabilities

Vulnerabilities for packages: azurite, sqlpad, unleash-fips, kibana, renovate, unleash-proxy, wazuh-dashboard-fips, kubescape-grype-offline-db, wazuh-dashboard, dotstatsuite-supercore, opensearch-dashboards-fips, code-server, langfuse-fips, pelias-api, tensorflow-gpu-jupyter, json-server,...

CVE-2026-82562 vulnerabilities

Vulnerabilities for packages: azurite, sqlpad, unleash-fips, kibana, renovate, unleash-proxy, wazuh-dashboard-fips, kubescape-grype-offline-db, wazuh-dashboard, dotstatsuite-supercore, opensearch-dashboards-fips, code-server, langfuse-fips, pelias-api, json-server, gitlab-rails-ce,...

CVE-2026-75975 vulnerabilities

Vulnerabilities for packages: unleash-fips, kibana, unleash-proxy, vitess, keep-fips, yaml-language-server, wazuh-dashboard-fips, keep, wazuh-dashboard, nextcloud-server, opensearch-dashboards-fips, langfuse-fips, tensorflow-gpu-jupyter, opensearch-dashboards, gitlab-rails-ce, tileserver-gl-fips,...

CVE-2026-76172 vulnerabilities

Vulnerabilities for packages: unleash-fips, kibana, unleash-proxy, vitess, keep-fips, yaml-language-server, wazuh-dashboard-fips, keep, wazuh-dashboard, nextcloud-server, opensearch-dashboards-fips, langfuse-fips, tensorflow-gpu-jupyter, opensearch-dashboards, gitlab-rails-ce, tileserver-gl-fips,...

CVE-2026-71224

A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images...

CVE-2026-71222

A heap out-of-bounds read vulnerability was found in gfs2-utils. The eanumptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem...

CVE-2026-71221

A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images...