SUSE-SU-2026:22717-1 Security update for the Linux Kernel RT (Live Patch 22 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-45.1 fixes various security issues The following security issues were fixed: - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094....

SUSE-SU-2026:22693-1 Security update for the Linux Kernel RT (Live Patch 20 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-42.1 fixes various security issues The following security issues were fixed: - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094....

SUSE-SU-2026:22719-1 Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-34.1 fixes various security issues The following security issues were fixed: - CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. -...

CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

EUVD-2026-44613

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a small amount of memory is not released...

USN-8546-1 linux-raspi vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - Block layer subsystem; - Cryptographic API; - DMA engine subsystem; - InfiniBand drivers; -...

PT-2026-60376

Name of the Vulnerable Software and Affected Versions safeurl versions prior to 0.2.4 Description The privateNetworks blocklist fails to include several newly added IPv6 CIDR ranges, specifically 64:ff9b:1::/48 NAT64 local-use prefix, 5f00::/16 Segment Routing SIDs, 3fff::/20 documentation prefix...

The vulnerability of the Linux operating system’s kernel, which stems from the inability to release resources after their useful lifespan has ended, allows attackers to trigger service failures.

The vulnerability of the Linux operating system’s kernel is related to the failure to release resources after their useful lifespan has ended. Exploiting this vulnerability allows a remote attacker to cause service interruptions through specially created IPv6 traffic...

CVE-2026-48736 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATESUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowi...

CVE-2026-48736

Summary: CVE-2026-48736 affects Symfony's NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS, where IPv6 transition prefixes (6to4, NAT64, Teredo, IPv4‑mapped IPv6) could bypass private‑IP checks and enable SSRF-like behavior when processing attacker‑supplied URLs. What’s affected: Symfony f...

PYSEC-2026-3457

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float...

SUSE-SU-2026:2974-1 Security update for dnsmasq

This update for dnsmasq fixes the following issues - CVE-2026-12725: heap buffer overflow in logquery when logging unsupported DS/DNSKEY replies bsc1268764. - CVE-2026-12969: out-of-bounds read in findsoa due to missing extrabytes validation bsc1268882. Changes for dnsmasq: - Update to 2.93: Fix ...

Zoom Workplace VDI Client < 6.5.17 Vulnerability (ZSB-26012)

The version of Zoom Workplace VDI Client installed on the remote host is prior to 6.5.17. It is, therefore, affected by a vulnerability as referenced in the ZSB-26012 advisory. - A time-of-check to time-of-use TOCTOU race condition in the installation and uninstallation process of certain Zoom...

SUSE SLES15 Security Update : kernel (Live Patch 12 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:2887-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2887-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.40 fixes various security issues The following security issues were fixed: -...

PYSEC-2026-3010 pypdf: Inefficient decoding of FlateDecode PNG predictor streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. Patches This has been fixed in pypdf==6.12.2. Workarounds If you cannot upgrade yet, consider applying the changes...

PYSEC-2026-3022 pypdf: Possible infinite loop when processing outlines/bookmarks in writer

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. Patches This has been fixed in pypdf==6.13.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 3830...

PYSEC-2026-3004 pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W 0 0 0 values and large /Size values. Patches This has been fixed in pypdf==6.12.0. Workarounds If developers are unable to upgrade their apps immediately, the...

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W 0 0 0 values and large /Size values. PatchesThis has been fixed in pypdf==6.12.0. WorkaroundsIf developers are unable to upgrade their apps immediately, they...

pypdf has long runtimes for wrong size values in cross-reference and object streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large /Size values or object streams with wrong large /N values. PatchesThis has been fixed in pypdf==6.10.1. WorkaroundsIf you cannot upgrade yet, consider...

pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. PatchesThis has been fixed in pypdf==6.10.0. WorkaroundsIf you cannot upgrade yet, consider applying the changes from PR 3724...