OPENSUSE-SU-2026:10509-1 steampipe-2.4.1-1.1 on GA media

These are all security issues fixed in the steampipe-2.4.1-1.1 package on the GA media of openSUSE Tumbleweed...

ROS-20260408-73-0017

A vulnerability in the fs/btrfs/qgroup.c component of the Linux operating system kernel is related to the use of memory after it has been freed. Exploitation of the vulnerability allows an intruder to affect confidentiality, integrity and availability of protected information...

OPENSUSE-SU-2026:10504-1 corepack24-24.14.1-1.1 on GA media

These are all security issues fixed in the corepack24-24.14.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10501-1 MozillaThunderbird-140.9.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-140.9.1-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-37382

Name of the Vulnerable Software and Affected Versions gnutls versions prior to 3.8.13-1.1 Description No detailed information was provided regarding the nature of the security issues fixed in this package. Recommendations Update to version 3.8.13-1.1...

XPCOM Component Compromise Data Compromise

The vulnerability of the XPCOM component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to a numerical overflow vulnerability. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected informatio...

Mozilla Firefox ESR Memory Use After Free

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are related to the use of memory after it is freed. Exploiting these vulnerabilities can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

XPCOM Component Compromise Data Compromise

The vulnerability of the XPCOM component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to a numerical overflow vulnerability. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected informatio...

Mozilla Firefox JavaScript Engine Data Compromise

The vulnerability of the JavaScript Engine component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to access to resources through incompatible types. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility ...

TOTOLink A7100RU setGameSpeedCfg Buffer Overflow

The vulnerability of the setGameSpeedCfg function in the microprogramming software of TOTOLink A7100RU relates to the lack of measures taken to protect data at the control level. Exploiting this vulnerability can allow an attacker operating remotely to compromise the confidentiality, integrity, a...

Access API Compromise Data Compromise

The vulnerability of the Access API components of Mozilla Firefox, Firefox ESR, and the email client Thunderbird relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

heroic-games-launcher-2.20.1-5.1 on GA media (moderate)

heroic-games-launcher-2.20.1-5.1 on GA media Announcement ID: openSUSE-SU-2026:10497-1 Rating: moderate Cross-References: CVE-2026-34601 CVSS scores: CVE-2026-34601 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2026-34601 SUSE : 8.7...

GHSA-RXMX-G7HR-8MX4 OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders

Summary Before OpenClaw 2026.4.2, Zalo webhook replay dedupe keys were not scoped strongly enough across chat and sender dimensions. Legitimate events from different conversations or senders could collide and be dropped as duplicates. Impact Cross-conversation or cross-sender collisions could cau...

GHSA-WWFP-W96M-C6X8 OpenClaw: Pairing pending-request caps were enforced per channel instead of per account

Summary Before OpenClaw 2026.3.31, pending pairing-request caps were enforced per channel file instead of per account. On multi-account channel setups, requests from other accounts could fill the shared pending window and block new pairing challenges on an unaffected account. Impact This issue...

Improper Link Resolution

kubevirt.io/kubevirt is vulnerable to improper link resolution. The vulnerability is due to lack of verification of whether the launcher-sock is a symlink or regular file, which allows an attacker with control over the virt-launcher pod file system to manipulate file ownership on the host and...

PT-2026-33566

Summary Before OpenClaw 2026.3.31, the Zalo webhook replay-dedupe cache was shared across authenticated webhook targets and keyed too broadly. In multi-account deployments, a replay seen on one account could suppress a legitimate event on another account if event name and message id matched. Impa...

OPENSUSE-SU-2026:10495-1 ckermit-9.0.302-20.1 on GA media

These are all security issues fixed in the ckermit-9.0.302-20.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-33578

Summary Before OpenClaw 2026.3.31, pending pairing-request caps were enforced per channel file instead of per account. On multi-account channel setups, requests from other accounts could fill the shared pending window and block new pairing challenges on an unaffected account. Impact This issue...

ROS-20260407-73-0014

A vulnerability in the sctprcv function of the net/sctp/input.c module of the Linux kernel is associated with the use of an uninitialized variable. Exploitation of the vulnerability may allow an intruder to affect confidentiality, integrity and availability of protected information...

ROS-20260407-73-0034

A vulnerability in the fs/buffer.c component of the Linux operating system kernel is related to the use of memory after it has been freed. Exploitation of the vulnerability allows an intruder to affect the integrity and availability of protected information...