CVE-2026-49214 vulnerabilities

Vulnerabilities for packages: nextcloud-server...

GHSA-34XG-WGJX-8XPH vulnerabilities

Vulnerabilities for packages: nextcloud-server...

CVE-2026-12151 vulnerabilities

Vulnerabilities for packages: node-gyp, renovate, saf, prism, vitess, npm, code-server...

CVE-2026-6733 vulnerabilities

Vulnerabilities for packages: node-gyp, renovate, saf, prism, vitess, npm, code-server...

CVE-2026-9679 vulnerabilities

Vulnerabilities for packages: node-gyp, renovate, saf, prism, vitess, npm, code-server...

GHSA-VXPW-J846-P89Q vulnerabilities

Vulnerabilities for packages: node-gyp, renovate, saf, prism, vitess, npm, code-server...

CVE-2026-54604

Unknown description...

CVE-2026-56410

xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId...

CVE-2026-56409

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used...

GHSA-5V8H-3H3Q-446P vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.4-rails, logstash, kube-logging-operator...

CVE-2026-54904 vulnerabilities

Vulnerabilities for packages: ruby3.2-fluentd-kubernetes-daemonset, ruby3.4-fluentd-kubernetes-daemonset, kube-fluentd-operator, kube-logging-operator, ruby4.0-fluentd-kubernetes-daemonset, ruby3.4-rails, ruby3.3-fluentd-kubernetes-daemonset, ruby3.2-rails...

SUSE CVE-2026-48930

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...

SUSE CVE-2026-48933

A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt is a multiple of 2GiB. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...

SUSE CVE-2026-54278

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be...

CVE-2026-9697 vulnerabilities

Vulnerabilities for packages: code-server, langfuse, vitess, renovate...

CVE-2026-3196

An integer overflow vulnerability was found in the virtio-snd device via PCMINFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition...

GHSA-8JVR-397X-XQH9 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-54285 vulnerabilities

Vulnerabilities for packages: renovate, langfuse, opensearch-dashboards, pulumi...

SUSE CVE-2026-49860

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially...

SUSE CVE-2026-50019

yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. At the file downloa...