Security update for lux (important)

openSUSE security update: security update for lux ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21367-1 Rating: important References: bsc1235304 bsc1241766 bsc1251460 bsc1251627 bsc1267110 Cross-References: CVE-2024-45338 CVE-2025-22872...

CVE-2026-53727 css_parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`

cssparser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parserreadremotefile in lib/cssparser/parser.rb, and therefore loaduri! and the @import-following branch of addblock!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering...

CVE-2026-48015 Shopware: Stored XSS via SVG file upload — no SVG sanitization

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowedextensions whitelist in src/Core/Framework/Resources/config/packages/shopware.yaml and can be uploaded via the media manager without SVG content sanitization in the upload pipeline from...

ROOT-APP-PYPI-CVE-2026-54276 CVE-2026-54276 in rootio-aiohttp - Patched by Root

Root has patched CVE-2026-54276 in the rootio-aiohttp package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-49978 CVE-2026-49978 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-49978 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM x86 shadow paging mechanism. This vulnerability occurs when a host page directory entry PDE mapping is changed from within the guest, leading to an unexpected role mismatch in shadow paging. This mismatch can cause a...

ROOT-APP-MAVEN-CVE-2025-14813 CVE-2025-14813 in io.root.org.bouncycastle:bcprov-jdk18on - Patched by Root

Root has patched CVE-2025-14813 in the io.root.org.bouncycastle:bcprov-jdk18on package for Root:Maven. Multiple fixed versions available...

CVE-2026-33434 Wazuh: Rate Limit Bypass via /events Endpoint

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and above, prior to 4.14.5, a logic error in CheckRateLimitsMiddleware.dispatch causes the /events endpoint rate check to unconditionally overwrite the general rate limit result. When t...

CVE-2026-44019

Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit. In applications that acce...

CVE-2026-54526

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...

ROOT-OS-DEBIAN-11-CVE-2026-34982 CVE-2026-34982 in rootio-vim - Patched by Root

Root has patched CVE-2026-34982 in the rootio-vim package for Root:Debian:11. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48526 CVE-2026-48526 in rootio-pyjwt - Patched by Root

Root has patched CVE-2026-48526 in the rootio-pyjwt package for Root:PyPI. Multiple fixed versions available...

Security update for the Linux Kernel (Live Patch 15 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.55 fixes various security issues The following security issues were fixed: CVE-2026-43501: ipv6: rpl: reserve maclen headroom when recompressed SRH grows bsc1266015. CVE-2026-45970: bonding: alb: fix UAF in rlbarprecv during bond...

ROOT-APP-NPM-CVE-2021-23337 CVE-2021-23337 in @rootio/lodash.template - Patched by Root

Root has patched CVE-2021-23337 in the @rootio/lodash.template package for Root:npm. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-23362 CVE-2026-23362 in rootio-linux - Patched by Root

Root has patched CVE-2026-23362 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-68223 CVE-2025-68223 in rootio-linux - Patched by Root

Root has patched CVE-2025-68223 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-68192 CVE-2025-68192 in rootio-linux - Patched by Root

Root has patched CVE-2025-68192 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-38530 CVE-2025-38530 in rootio-linux - Patched by Root

Root has patched CVE-2025-38530 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-40147 CVE-2025-40147 in rootio-linux - Patched by Root

Root has patched CVE-2025-40147 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-23070 CVE-2026-23070 in rootio-linux - Patched by Root

Root has patched CVE-2026-23070 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...