SUSE CVE-2026-43446

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix runtime suspend deadlock when there is pending job The runtime suspend callback drains the running job workqueue before suspending the device. If a job is still executing and calls pmruntimeresumeandget, it can...

SUSE CVE-2026-43469

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decrement rereceiving on the early exit paths In the event that rpcrdmapostrecvs fails to create a work request due to memory allocation failure, say or otherwise exits early, we should decrement ep-rereceiving before...

kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel

A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The...

PT-2026-40697

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.5.8 protobufjs versions prior to 8.2.0 Description protobufjs compiles protobuf definitions into JavaScript functions. The software can recurse without a depth limit when expanding nested JSON descriptors through...

protobuf.js security vulnerabilities

protobuf.js is an open-source implementation of the Protocol Buffer library, written entirely in JavaScript. It supports protocols for Node.js and browsers using TypeScript. It’s easy to use, extremely fast, and can be used out of the box with.proto files. Versions prior to 7.5.8 and 8.2.0 of...

CVE-2026-44289: Uncontrolled Recursion

protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message fields. A crafted protobuf...

CVE-2026-45740: Uncontrolled Recursion

protobufjs compiles protobuf definitions into JavaScript JS functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON and Namespace.addJSON. A crafted JSON descriptor with deeply nested namespace definitions...

CVE-2026-44441: Server-Side Request Forgery (SSRF)

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, a malicious user could send a crafted request to an endpoint, which would lead to the server making an HTTP call to a service of the user's choice. This vulnerability is fixed in 15.106.0 and 16.16...

PT-2026-40802

Name of the Vulnerable Software and Affected Versions CPython affected versions not specified Description The ftpcp function in Lib/ftplib.py fails to use the actual peer address, instead trusting the host address supplied by the server during a PASV command. This occurs because ftpcp calls...

kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel

A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The...

kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel

A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The...

CVE-2026-8449

This CVE ID has been rejected or withdrawn...

io.github.coffee330501:internal-call (>=1.0, <=1.1.0), org.apache.ranger:embeddedwebserver (2.4.0) +2 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (8.5.86)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.86 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - io.github.coffee330501:internal-call =1.0, =1.1.0 -...

io.github.coffee330501:internal-call (>=1.0, <=1.1.0), org.apache.ranger:embeddedwebserver (2.4.0) +2 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (8.5.86)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.86 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - io.github.coffee330501:internal-call =1.0, =1.1.0 -...

io.github.coffee330501:internal-call (>=1.0, <=1.1.0), org.apache.ranger:embeddedwebserver (2.4.0) +2 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.5.86)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.86 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - io.github.coffee330501:internal-call =1.0, =1.1.0 -...

io.github.coffee330501:internal-call (>=1.0, <=1.1.0), org.apache.ranger:embeddedwebserver (2.4.0) +2 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (8.5.86)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.86 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - io.github.coffee330501:internal-call =1.0, =1.1.0 -...

io.github.coffee330501:internal-call (>=1.0, <=1.1.0), org.apache.ranger:embeddedwebserver (2.4.0) +2 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (8.5.86)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.86 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - io.github.coffee330501:internal-call =1.0, =1.1.0 -...

io.github.coffee330501:internal-call (>=1.0, <=1.1.0), org.apache.ranger:embeddedwebserver (2.4.0) +2 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.86)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.86 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - io.github.coffee330501:internal-call =1.0, =1.1.0 -...

CVE-2026-43992 JunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool sendtokens, executecontract, instantiatecontract, uploadwasm, ibctransfer, etc. accepted 'mnemonic: string' as an explicit tool-call parameter. The BIP-39 seed was consequently embedded in th...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through unbounded recursion when decoding nested message fields. An attacker can exhaust the call stack and cause the application to crash by supplying specially crafted protobuf binary data containing deeply nest...