SUSE-SU-2026:24275-1 Security update for rpcbind

This update for rpcbind fixes the following issue: - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service bsc1282326...

EUVD-2026-104166

A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch...

CVE-2026-112098

A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released t...

CVE-2026-112100

A code injection vulnerability exists in DeepPavlov up to version 1.7.0 . The flaw is located in the MultiTaskPipelinePreprocessor.__init__ function within the file deeppavlov/models/preprocessors/multitask_preprocessor.py. An attacker can perform a remote attack by manipulating the preprocessor ...

CVE-2026-112100

A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.init of the file deeppavlov/models/preprocessors/multitaskpreprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be carried o...

CVE-2026-112098 DeepPavlov Config Reference Resolver params.py resolve code injection

A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released t...

CVE-2026-112098

A security flaw exists in DeepPavlov up to version 1.7.0 within the Config Reference Resolver component. Specifically, the resolve function in the file deeppavlov/core/common/params.py is vulnerable to code injection due to improper input handling. This vulnerability can be exploited remotely , a...

CVE-2026-112098 DeepPavlov Config Reference Resolver params.py resolve code injection

A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released t...

CVE-2026-112098

A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released t...

CVE-2026-112097 SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting

A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactionshandler.php?action=savesale of the component Sales Management Handler. The manipulation of the argument HsnCode results in cross site scripting. It is possible...

CVE-2026-112097 SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting

A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactionshandler.php?action=savesale of the component Sales Management Handler. The manipulation of the argument HsnCode results in cross site scripting. It is possible...

CVE-2026-112097

The SourceCodester Inventory System 1.0 contains a cross-site scripting (XSS) vulnerability within the Sales Management Handler component. The flaw exists in the processing of the file /api/transactions_handler.php?action=save_sale, where manipulating the Hsn_Code argument allows for the executio...

CVE-2026-112096 SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting

A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactionshandler.php?action=savepurchase of the component Purchase Records Handler. The manipulation of the argument ProductName/ProductCode/VendorName leads to cross...

CVE-2026-112096

The SourceCodester Inventory System 1.0 contains a Cross-Site Scripting (XSS) vulnerability within the Purchase Records Handler component. Specifically, the file /api/transactions_handler.php?action=save_purchase fails to properly neutralize input in the Product_Name , Product_Code , and Vendor_N...

CVE-2026-112096 SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting

A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactionshandler.php?action=savepurchase of the component Purchase Records Handler. The manipulation of the argument ProductName/ProductCode/VendorName leads to cross...

wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash

A flaw was found in Wireshark. An unauthenticated remote attacker could exploit a vulnerability in the C12.22 protocol dissector by sending specially crafted network traffic. This could lead to a crash of the application, resulting in a Denial of Service DoS...

CVE-2026-112161

MobaXterm Personal Edition (Portable) 26.4 GA is vulnerable to a local code execution flaw due to a lack of integrity checks when extracting the CygUtils64.plugin file. An attacker with local write permissions can replace the bin/cygwin1.dll library within that plugin with a malicious version. Wh...

CVE-2026-112161 Lack of integrity checks in Mobatek’s MobaXterm

MobaXterm Personal Edition Portable 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell...

EUVD-2026-104122

MobaXterm Personal Edition Portable 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell...

CVE-2026-112161 Lack of integrity checks in Mobatek’s MobaXterm

MobaXterm Personal Edition Portable 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell...