SUSE-SU-2026:22372-1 Security update for python-python-multipart

This update for python-python-multipart fixes the following issues - CVE-2026-53537: multipart/form-data with extended parameters can lead to file or parameter smuggling bsc1268506. - CVE-2026-53538: urlencoded requests containing semicolons can lead to form field smuggling bsc1268496. -...

CVE-2026-10804

A flaw was found in Streamlit, within its Palette Handler component. This vulnerability stems from the use of a weak hashing algorithm. A local attacker could exploit this flaw, though it requires a high level of technical complexity. Successful exploitation may lead to a low impact on the...

CVE-2026-48090: Use After Free

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter envoy.filters.http.oauth2 can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late...

trivy-0.71.2-1.1 on GA media (moderate)

trivy-0.71.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11102-1 Rating: moderate Cross-References: CVE-2026-47262 CVE-2026-50195 CVE-2026-53488 CVE-2026-53489 CVE-2026-53492 CVSS scores: CVE-2026-47262 SUSE : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2026-50195 SUSE : 8.8...

CVE-2026-9717

CWE-78 Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could allow unauthorized execution of commands with elevated privileges, impacting system integrity, confidentiality, and availability when a privileged authenticated user interacts wi...

EUVD-2026-39434

CWE-78 Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could allow unauthorized execution of commands with elevated privileges, impacting system integrity, confidentiality, and availability when a privileged authenticated user interacts wi...

Linode Interfaces and Default Firewall Now Generally Available

...

EUVD-2026-39189

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'postid' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter and lack of sufficie...

ofono-2.19-3.1 on GA media (moderate)

ofono-2.19-3.1 on GA media Announcement ID: openSUSE-SU-2026:11095-1 Rating: moderate Cross-References: CVE-2023-2794 CVE-2023-4232 CVE-2023-4234 CVE-2024-7537 CVE-2024-7538 CVE-2024-7539 CVE-2024-7540 CVE-2024-7541 CVE-2024-7543 CVE-2024-7544 CVE-2024-7546 Affected Products: openSUSE Tumbleweed ...

lrzip-0.660-1.1 on GA media (moderate)

lrzip-0.660-1.1 on GA media Announcement ID: openSUSE-SU-2026:11093-1 Rating: moderate Cross-References: CVE-2025-15570 CVE-2025-9396 Affected Products: openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. Description: These are all security issues fixed in the...

libtar-1.2.20-3.1 on GA media (moderate)

libtar-1.2.20-3.1 on GA media Announcement ID: openSUSE-SU-2026:11092-1 Rating: moderate Cross-References: CVE-2021-33640 CVE-2021-33643 CVE-2021-33645 Affected Products: openSUSE Tumbleweed An update that solves 3 vulnerabilities can now be installed. Description: These are all security issues...

The vulnerability of the ADF Shared Components component in the Oracle Application Development Framework allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ADF Shared Components component in the Oracle Application Development Framework is related to access control errors. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

OPENSUSE-SU-2026:11116-1 dnsmasq-2.93-1.1 on GA media

These are all security issues fixed in the dnsmasq-2.93-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11125-1 tar-1.35-8.1 on GA media

These are all security issues fixed in the tar-1.35-8.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11117-1 giflib-devel-32bit-5.2.2-4.1 on GA media

These are all security issues fixed in the giflib-devel-32bit-5.2.2-4.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11121-1 corepack24-24.17.0-1.1 on GA media

These are all security issues fixed in the corepack24-24.17.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11118-1 jackson-databind-2.18.8-1.1 on GA media

These are all security issues fixed in the jackson-databind-2.18.8-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-12770

A flaw was found in BerriAI litellm. A remote attacker could exploit an improper authorization vulnerability within the Admin Key Handler component. This could allow the attacker to perform unauthorized actions, leading to limited impacts on data integrity and service availability...

CVE-2025-61025

A flaw was found in virtuoso-opensource. Attackers can exploit this vulnerability by sending specially crafted SQL statements, which can lead to a Denial of Service DoS. This issue impacts the availability of the affected system...

The vulnerability of the WebCenter Sites component in the user-service provisioning application for the internet. Oracle WebCenter Sites allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the WebCenter Sites application component for online user services in Oracle WebCenter Sites relates to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...