SUSE CVE-2026-48933

A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt is a multiple of 2GiB. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...

SUSE CVE-2026-54278

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be...

CVE-2026-9697 vulnerabilities

Vulnerabilities for packages: renovate, code-server, vitess, langfuse...

CVE-2026-3196

An integer overflow vulnerability was found in the virtio-snd device via PCMINFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition...

GHSA-8JVR-397X-XQH9 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-54285 vulnerabilities

Vulnerabilities for packages: renovate, pulumi, opensearch-dashboards, langfuse...

SUSE CVE-2026-49860

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially...

SUSE CVE-2026-50019

yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. At the file downloa...

SUSE CVE-2026-53540

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parseform did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded...

SUSE CVE-2026-54282

Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating scheme://hostpath and re-parsing the result, a path that does not begin with / for example...

CVE-2026-12322 vulnerabilities

Vulnerabilities for packages: firefox...

GHSA-XP8H-82PC-F6JM vulnerabilities

Vulnerabilities for packages: firefox...

GHSA-VMF3-W455-68VH vulnerabilities

Vulnerabilities for packages: pnpm-stage0, py3-captum, kibana, py3-jupyterlab, graalvm, wazuh-dashboard-fips, npm, tensorflow-cpu-jupyter, gitlab-rails-ce-fips, pulumi, renovate, prism, tileserver-gl-fips, jupyter-base-notebook, homepage, tileserver-gl, sqlpad, lerna, gitlab-rails-ce,...

GHSA-4X5R-PXFX-6JF8 vulnerabilities

Vulnerabilities for packages: airflow, kubeflow-katib, ts-patch, langfuse, vitess...

GHSA-R7G4-QG5F-QQM2 vulnerabilities

Vulnerabilities for packages: langfuse...

CVE-2026-12321 vulnerabilities

Vulnerabilities for packages: firefox...

CVE-2026-7210 vulnerabilities

Vulnerabilities for packages: python...

GHSA-993G-76C3-P5M4 vulnerabilities

Vulnerabilities for packages: ggshield, superset, datadog-agent, kserve...

SUSE CVE-2026-50133

Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html" had their body emitted verbatim...

SUSE CVE-2026-50269

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing...