ROS-20260623-73-0024

Vulnerability in Python 3.9 related to the failure to address CRWL sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-49214 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

GHSA-34XG-WGJX-8XPH vulnerabilities

Vulnerabilities for packages: nextcloud-server...

CVE-2026-12151 vulnerabilities

Vulnerabilities for packages: prism, renovate, saf, node-gyp, npm, vitess, code-server...

CVE-2026-6733 vulnerabilities

Vulnerabilities for packages: prism, renovate, saf, node-gyp, npm, vitess, code-server...

GHSA-VXPW-J846-P89Q vulnerabilities

Vulnerabilities for packages: prism, renovate, saf, node-gyp, npm, vitess, code-server...

CVE-2026-9679 vulnerabilities

Vulnerabilities for packages: prism, renovate, saf, node-gyp, npm, vitess, code-server...

CVE-2026-54604

Unknown description...

CVE-2026-56410

xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId...

CVE-2026-56409

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used...

CVE-2026-54904 vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby4.0-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, ruby3.2-fluentd-kubernetes-daemonset, ruby3.2-rails, kube-fluentd-operator, kube-logging-operator...

GHSA-5V8H-3H3Q-446P vulnerabilities

Vulnerabilities for packages: ruby3.4-rails, logstash, ruby3.2-rails, kube-logging-operator...

SUSE CVE-2026-48930

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...

SUSE CVE-2026-48933

A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt is a multiple of 2GiB. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...

SUSE CVE-2026-54278

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be...

CVE-2026-9697 vulnerabilities

Vulnerabilities for packages: renovate, code-server, langfuse, vitess...

CVE-2026-3196

An integer overflow vulnerability was found in the virtio-snd device via PCMINFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition...

GHSA-8JVR-397X-XQH9 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-54285 vulnerabilities

Vulnerabilities for packages: renovate, pulumi, langfuse...

SUSE CVE-2026-49860

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially...