SUSE CVE-2026-16361

Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbi...

SUSE CVE-2026-42617

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfsirtoib in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file...

SUSE CVE-2026-42618

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfsdecompress in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file...

SUSE CVE-2026-56136

In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfsirnill in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name...

CVE-2026-45382

libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.19, decodercontext::decodesliceunittiles libde265/decctx.cc:920 reads pps.CtbAddrRStoTSctbAddrRS at line 966 where ctbAddrRS = ctbY ctbsWidth + ctbX is computed from PPS-supplied colBd/rowBd arrays without...

GHSA-V422-HMWV-36X6 vulnerabilities

Vulnerabilities for packages: tileserver-gl, argo-workflows, kubeflow-pipelines, jupyter-base-notebook, kubeflow-centraldashboard, code-server, langfuse, json-server, sqlpad...

CVE-2026-52870 vulnerabilities

Vulnerabilities for packages: litellm, kserve-huggingfaceserver-cuda-13.3, semgrep...

CVE-2026-59869 vulnerabilities

Vulnerabilities for packages: langfuse-fips, argo-workflows, eslint, sqlpad, wazuh-dashboard, gitlab-rails-ce, authentik-fips, prism, opensearch-dashboards, homepage, opensearch-dashboards-fips, gitlab-rails-ce-fips, kubeflow-centraldashboard, mongod, foxx-cli, unleash, unleash-fips, kibana,...

CVE-2026-54490 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, arangodb, gitlab-rails-ce, argo-workflows...

CVE-2026-50271 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, datadog-agent, litellm, opal...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: npm, jupyter-base-notebook, kubeflow-centraldashboard, code-server, lerna, prism, saf, pulumi, sqlpad...

GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: npm, jupyter-base-notebook, kubeflow-centraldashboard, code-server, lerna, prism, saf, pulumi, sqlpad...

GHSA-W8WR-V893-VJVP vulnerabilities

Vulnerabilities for packages: npm, jupyter-base-notebook, kubeflow-centraldashboard, code-server, lerna, prism, saf, pulumi, sqlpad...

CVE-2026-59844

A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests...

CVE-2026-55645

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote...

CVE-2026-44978

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to...

CVE-2026-26199

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Igetname is invoked in a way...

CVE-2026-64021

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix execqueue leak on width check in stream open In xeoastreamopenioctl, when param.execq-width 1 the function returns -EOPNOTSUPP directly, skipping the existing errexecq cleanup path. The execqueue reference obtained...

CVE-2026-63861

In the Linux kernel, the following vulnerability has been resolved: spi: mtk-snfi: unregister ECC engine on probe failure and remove callback mtksnandprobe registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action aft...

CVE-2026-63972

In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-detached port When manaperportqueueresetworkhandler runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc-txqp and apc-rxqs already...