SUSE SLES16 Security Update : go1.25-openssl (SUSE-SU-2026:22638-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22638-1 advisory. This update for go1.25-openssl fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2025-61732: cmd/cgo:...

GHSA-X8MG-6R4P-87PF

creationtimestamp| type| source ---|---|--- 2026-07-16 23:48:09+00:00| seen| https://gist.github.com/alon710/52a35a35f7ac3d2e03985e364db77b59 2026-07-17 00:00:25+00:00| seen| https://gist.github.com/alon710/52a35a35f7ac3d2e03985e364db77b59...

CVE-2026-55629

creationtimestamp| type| source ---|---|--- 2026-07-16 22:51:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsd5djqhg2m 2026-08-25 20:35:15+00:00| published-proof-of-concept| https://github.com/avwo/whistle/security/advisories/GHSA-3vfr-4gwf-qxfp...

EUVD-2026-45009

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...

EUVD-2026-45010

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked...

EUVD-2026-45008

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SH...

CVE-2026-53536

creationtimestamp| type| source ---|---|--- 2026-07-16 20:35:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqs3lbupgq2i...

GHSA-JPW9-PFVF-9F58

creationtimestamp| type| source ---|---|--- 2026-07-16 20:31:08+00:00| seen| https://gist.github.com/alon710/1d517629bc176ae6cad3ee2369704fcb...

CVE-2025-25250

creationtimestamp| type| source ---|---|--- 2026-07-16 20:05:48+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mqrzvmjy3k2m...

CVE-2026-53535

creationtimestamp| type| source ---|---|--- 2026-07-16 20:05:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrzv24erz22...

CVE-2026-15685

creationtimestamp| type| source ---|---|--- 2026-07-16 19:51:10+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mqrz3jfppp2y...

CVE-2026-46404

creationtimestamp| type| source ---|---|--- 2026-07-16 19:39:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqryhhqubq2s...

CVE-2026-63088

creationtimestamp| type| source ---|---|--- 2026-07-16 19:20:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrxeesimu22...

CVE-2026-47086

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...

DEBIAN-CVE-2026-47087

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked...

CVE-2026-47087

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked...

DEBIAN-CVE-2026-47086

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...

CVE-2026-46353

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some...

CVE-2026-47086

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token via the GENURLAUTH command for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes...

CVE-2026-47085

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SH...