10213 matches found
SUSE CVE-2026-49852
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign...
CVE-2026-49852 vulnerabilities
Vulnerabilities for packages: airflow...
GHSA-574F-3G2M-X479 vulnerabilities
Vulnerabilities for packages: kayenta, hadoop-fips, kayenta-fips, opensearch, camunda-zeebe, sonarqube, logstash-fips, logstash...
GHSA-52V5-JR5W-GJXR vulnerabilities
Vulnerabilities for packages: graalvm, pulumi...
GHSA-RF99-F9J2-GV3F vulnerabilities
Vulnerabilities for packages: wildfly...
CVE-2026-40914 vulnerabilities
Vulnerabilities for packages: wildfly...
CVE-2026-8927
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed...
CVE-2026-10536
A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS or CURLOPTSTREAMDEPENDSE, subsequently invokes curleasyreset, and finally terminates the handle with curleasycleanup. During this final cleanup phase, libcurl...
SUSE CVE-2026-13769
Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has not been configured to restrict file permissions the default on most systems may allow other local users on the same host to read credentials written by certain CLI subcommands...
SUSE CVE-2026-48758
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature...
SUSE CVE-2026-48978
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as...
SUSE CVE-2026-49835
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an...
CVE-2026-12932
A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote attackers to cause a denial of service memory exhaustion via a flood of crafted packets...
CVE-2025-66001 vulnerabilities
Vulnerabilities for packages: neuvector-scanner-fips...
CVE-2025-0312 vulnerabilities
Vulnerabilities for packages: mods...
GHSA-7RP8-R62P-Q6WC vulnerabilities
Vulnerabilities for packages: wolfictl...
CVE-2026-29049 vulnerabilities
Vulnerabilities for packages: wolfictl...
CVE-2024-23332 vulnerabilities
Vulnerabilities for packages: xeol...