SUSE CVE-2026-68372

In the Linux kernel, the following vulnerability has been resolved: usb: core: port: Deattach Type-C connector on component unbind connectorunbind is the mirror of connectorbind, but it is missing the symmetric call to typecdeattach that connectorbind makes via: if portdev-child...

MINI-7Q64-M7HV-HXHQ

Bulletin has no description...

MINI-76RF-C7W5-8G5V

Bulletin has no description...

MINI-22XR-PHJ3-FRW8

Bulletin has no description...

MINI-PV4J-Q6MR-M3RH

Bulletin has no description...

MINI-M5H7-65VH-PC9P

Bulletin has no description...

MINI-8P2G-7MP2-5XW2

Bulletin has no description...

MINI-HXQ2-QX55-VGR3

Bulletin has no description...

MINI-5M6Q-C35P-2VPH

Bulletin has no description...

MINI-Q8J4-XPP3-GJ68

Bulletin has no description...

GO-2026-5501 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

CVE-2026-73667

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -...

GHSA-HF6X-8P5F-CGMF vulnerabilities

Vulnerabilities for packages: wazuh-indexer, sonarqube, apache-nifi, opensearch, apicurio-registry-fips, traccar, pinot-fips, wavefront-proxy, logstash, apache-hop-fips, apache-hop, airbyte-platform, kayenta, druid, nrjmx, kserve-modelmesh, jmeter, wso2is, apicurio-registry, pinot, akhq, zipkin,...

SUSE CVE-2026-5917

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend USESSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacte...

JLSEC-2026-1316

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found. The vulnerability is in the CRW image parser. This issue has been patched in version 0.28.8...

New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Afghan telecom providers and South Asian critical infrastructure organizations have emerged as the target of a new ongoing campaign that delivers a previously undocumented backdoor called PATCHCORD. According to Acronis Threat Research Unit TRU, the backdoor is a compiled C/C++ implant delivered ...

CVE-2026-53802

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

OESA-2026-3387 xmlrpc-c security update

XML-RPC is a quick-and-easy way to make procedure calls over the Internet. It converts the procedure call into an XML document, sends it to a remote server using HTTP, and gets back the response as XML. Security Fixes: XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected...

OESA-2026-3385 xmlrpc-c security update

XML-RPC is a quick-and-easy way to make procedure calls over the Internet. It converts the procedure call into an XML document, sends it to a remote server using HTTP, and gets back the response as XML. Security Fixes: XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected...