37640 matches found
libraw-devel-0.22.1-1.1 on GA media (moderate)
libraw-devel-0.22.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:10565-1 Rating: moderate Cross-References: CVE-2026-20884 CVE-2026-20889 CVE-2026-20911 CVE-2026-21413 CVE-2026-24450 CVE-2026-24660 CVE-2026-5342 CVSS scores: CVE-2026-20884 SUSE : 8.1...
zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing
Summary endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls makestring, count with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger...
GHSA-CPF9-PH2J-CCR9 zrok: Unauthenticated DoS via unbounded memory allocation in striped session cookie parsing
Summary endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls makestring, count with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger...
CVE-2026-40959
A flaw was found in Luanti, specifically when using LuaJIT. A local attacker can exploit this vulnerability by providing a crafted mod. This can lead to a Lua sandbox escape, allowing the attacker to bypass security restrictions and potentially gain confidentiality, integrity, and availability...
EUVD-2023-44280
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability...
CVE-2023-3634
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability...
CVE-2023-3634
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability...
CVE-2023-3634 Festo: MSE6-C2M/D2M/E2M Incomplete User Documentation of Remote Accessible Functions
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality, integrity and availability...
OPENSUSE-SU-2026:10561-1 firecracker-1.15.1-1.1 on GA media
These are all security issues fixed in the firecracker-1.15.1-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2026:10559-1 ImageMagick-7.1.2.19-1.1 on GA media
These are all security issues fixed in the ImageMagick-7.1.2.19-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2026:10566-1 liblog4cxx-devel-1.7.0-2.1 on GA media
These are all security issues fixed in the liblog4cxx-devel-1.7.0-2.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2026:10565-1 libraw-devel-0.22.1-1.1 on GA media
These are all security issues fixed in the libraw-devel-0.22.1-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2026:10567-1 python311-Django-5.2.13-1.1 on GA media
These are all security issues fixed in the python311-Django-5.2.13-1.1 package on the GA media of openSUSE Tumbleweed...
Security Bulletin: Multiple vulnerabilities in Python affect AIX
Summary Vulnerabilities in Python could allow a null pointer dereference CVE-2026-32776, CVE-2026-32778, an infinite loop CVE-2026-32777, or impact availability CVE-2025-12084. Python is used by AIX as part of Ansible node management automation. Vulnerability Details CVEID:CVE-2026-32776...
Multiple vulnerabilities in Python affect AIX
IBM SECURITY ADVISORY First Issued: Wed Apr 15 15:19:52 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/pythonadvisory19.asc Security Bulletin: Multiple vulnerabilities in Python affect AIX...
CVE-2025-40899
A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter. An authenticated user with custom fields privileges can define a malicious custom field containing a JavaScript payload. When the victim views the...
CVE-2025-40897
The CVE-2025-40897 entry concerns Guardian/CMC Threat Intelligence prior to version 26.0.0, where an access control flaw allows users with view-only privileges to perform administrative actions, potentially altering rules configuration and affecting availability. The vulnerability stems from impr...
CVE-2025-40897 Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0
An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges. An authenticated user with view-only privileges for the Threat Intelligence functionality can perform...
The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, relates to the absence of authentication mechanisms. This allows attackers to manipulate the integrity, accessibility, and confidentiality of information.
The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, lies in the lack of authentication. Exploiting this vulnerability allows a malicious actor to manipulate the integrity, accessibility, and confidentiality of information...