SUSE CVE-2026-33758

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callbackmode=direct configured are vulnerable to XSS via the errordescription parameter on the page for a failed...

CVE-2025-71403 better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account...

CVE-2025-71403

The CVE-2025-71403 entry concerns better-auth versions prior to 1.1.20, where a bypass in trustedOrigins validation logic affects absolute URLs and wildcard domains. This enables an attacker to craft malicious callbackURL parameters that bypass origin checks and trigger open redirects, potentiall...

CVE-2025-71403 better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account...

MAL-2026-11433 Malicious code in @0xlr/test-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f54fc6282ea45cdd155c621f41ce7bb3d8f5622ba8eef14cec7e97397b3efa @0xlr/[email protected] is a minimal package with no observed installer-harm behavior. No lifecycle scripts performing network fetches or shell...

CVE-2026-10685 Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

The Zephyr Bluetooth GATT client CCC-write response handler gattwritecccrsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the document...

CVE-2026-10685 Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

The Zephyr Bluetooth GATT client CCC-write response handler gattwritecccrsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the document...

CVE-2026-10685 Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

The Zephyr Bluetooth GATT client CCC-write response handler gattwritecccrsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the document...

CVE-2026-10685

CVE-2026-10685 : In Zephyr, the GATT client CCC-write response handler gatt_write_ccc_rsp() may call the application’s params->subscribe() after already invoking params->notify(conn, params, NULL, 0). A NULL data notify signals termination; calling subscribe() on the same bt_gatt_subscribe_...

PT-2026-66758

The Zephyr Bluetooth GATT client CCC-write response handler gatt write ccc rsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the...

SUSE CVE-2026-28735

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL...

SUSE CVE-2026-40302

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template which performs no HTML escaping instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the...

SUSE CVE-2026-58422

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts...

EUVD-2026-50470

Flyto2 Core: Unauthenticated flyto-verification /run: callbackurl SSRF and internal runner-secret exfiltration...

GHSA-JX74-CQJV-2C67 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Summary The standalone flyto-verification service exposes POST /run with no authentication, on all interfaces 0.0.0.0:8344 per the shipped Dockerfile. The request body's callbackurl is used verbatim for an outbound POST that unconditionally attaches X-Internal-Key: $FLYTORUNNERSECRET. The...

Server-side Request Forgery (SSRF)

Overview flyto-core is an A workflow engine with 412 built-in modules. Trace every step. Replay from any point. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the run process. An attacker can access internal resources and exfiltrate sensitive internal...

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Summary The standalone flyto-verification service exposes POST /run with no authentication, on all interfaces 0.0.0.0:8344 per the shipped Dockerfile. The request body's callbackurl is used verbatim for an outbound POST that unconditionally attaches X-Internal-Key: $FLYTORUNNERSECRET. The...

Security update for python3-pyOpenSSL

This update for python3-pyOpenSSL fixes the following issue: CVE-2026-27448: unhandled exception in settlsextservernamecallback callback can result in connection not being cancelled and allows for possible security measure bypassing bsc1259804. Patch Instructions: To install this SUSE update use...

SUSE-SU-2026:3424-1 Security update for python3-pyOpenSSL

This update for python3-pyOpenSSL fixes the following issue: - CVE-2026-27448: unhandled exception in settlsextservernamecallback callback can result in connection not being cancelled and allows for possible security measure bypassing bsc1259804...

CVE-2026-64417

A flaw was found in the Linux kernel's memory management mm shrinker subsystem. This vulnerability arises because the shrinkerdebugfsadd function unconditionally creates debugfs files for 'count' and 'scan' operations, even if the corresponding callback functions like scanobjects are not...