12893 matches found
SUSE CVE-2026-55075
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link...
SUSE CVE-2026-55435
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, AI Bridge proxy endpoints authenticate via Server.IsAuthorized in coderd/aibridgedserver, which validates key format, expiry, secret...
Security update for apptainer
This update for apptainer fixes the following issues: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266656. CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid...
SUSE-SU-2026:3417-1 Security update for apptainer
This update for apptainer fixes the following issues: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266656. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invali...
OPENSUSE-SU-2026:21473-1 Security update for apptainer
This update for apptainer fixes the following issues: Changes in apptainer: - Update to version 1.5.3: If the ptrace system call does not work while building an image as an unprivileged user, skip using PRoot to preserve file ownership and print an INFO message. Bind getopt from the host when usi...
EEF-CVE-2026-42792 epmd permanent DoS via EMFILE on accept(2) in erts
Summary Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts epmd allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon epmd via connection slot exhaustion. The do\accept function in erts/epmd/src/epmd\srv.c calls epmd\cleanup\exi...
CVE-2026-64369 s390: Revert support for DCACHE_WORD_ACCESS
In the Linux kernel, the following vulnerability has been resolved: s390: Revert support for DCACHEWORDACCESS loadunalignedzeropad reads eight bytes from unaligned addresses and may cross page boundaries. It handles exceptions which may happen if reading from the second page results in an...
Not Failing Securely ('Failing Open')
Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' in the auth process. An attacker can gain unauthorized access to protected resources by triggering a server-side configuration error that causes the auth...
PYSEC-2026-3478 LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint. A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In...
Next.js: Cache confusion of response bodies for requests with bodies
Impact A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to...
GHSA-Q8WF-6R8G-63CH Next.js: Denial of Service in the Image Optimization API using SVGs
Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If those images contain malicious content, they can cause CPU exhaustion in /next/image endpoints. - If you are using...
GHSA-GQ66-9CW5-J5JM n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction
Impact The GraphQL node did not enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials such as Header Auth, Basic Auth, Query Auth, and OAuth, unlike the HTTP Request node. An authenticated user able to create or edit workflows could therefore point the node's endpoint a...
Integer Overflow
Overview Affected versions of this package are vulnerable to Integer Overflow leading to a heap buffer overflow in the bundled libvips VIPS loader VipsForeignLoadVips, which can miscompute image dimensions. An attacker can corrupt heap memory and crash the process, with a possibility of code...
EUVD-2026-40093
fast-uri vulnerable to host confusion via failed IDN canonicalization...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS in the ProxyCommand process. An attacker can disrupt local system availability by triggering an unchecked fork failure, which causes signals to be sent across the process tree. This is only exploitable if the...
Out-of-bounds Read
Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the GSSAPIKeyExchange process when a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation. An attacker can access small portions of server memory by...
EulerOS Virtualization 2.12.0 : python-requests (EulerOS-SA-2026-2800)
According to the versions of the python-requests package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a...
Prototype Pollution
Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the Node HTTP adapter lib/adapters/http.js, which reads config.proxy through the prototype chain after a request interceptor returns a plain-object...
Allocation of Resources Without Limits or Throttling
Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the getBodyLength and resolveBodyLength functions of lib/adapters/fetch.js, which lack a branch fo...