SUSE-SU-2026:22895-1 Security update for python-cryptography

This update for python-cryptography fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-...

PT-2026-63323

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete locations backup file callback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level...

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated Disable Account action and issuing a fresh authenticated session in t...

GHSA-G9G6-QHRC-P3QC Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever the user authenticates through a linked external identity provider, silently undoing any administrator-initiated Disable Account action and issuing a fresh authenticated session in t...

CVE-2026-63919

A flaw was found in the Linux kernel's xfrm input component. The transport-mode reinjection process, which handles network packet re-injection, stores a network namespace pointer that must remain valid until a deferred callback completes. However, a missing reference count for the network namespa...

CVE-2026-63902

A flaw was found in the Linux kernel's cypressm8 USB serial driver. This vulnerability allows a local attacker to cause a denial of service DoS due to an out-of-bounds read. The cypressreadintcallback function does not properly validate the length of interrupt packets, leading to attempts to read...

AZL-93258 CVE-2026-59850 affecting package libssh for versions less than 0.10.6-9

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions...

EulerOS Virtualization 2.12.0 : pyOpenSSL (EulerOS-SA-2026-2794)

According to the versions of the pyOpenSSL package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 0.14.0 and prior to version 26.0.0, if a user...

CVE-2026-63768

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...

CVE-2026-63768 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...

CVE-2026-63768

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...

EUVD-2026-46073

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...

CVE-2026-63768 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...

CVE-2026-63768 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...

AZL-92855 CVE-2026-64192 affecting package kernel for versions less than 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPFMAPTYPEINODESTORAGE creation if BPF LSM is uninitialized When CONFIGBPFLSM=y is set, BPF inode storage maps BPFMAPTYPEINODESTORAGE are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at...

SUSE-SU-2026:22801-1 Security update for python-cryptography

This update for python-cryptography fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-...

Linux Distros Unpatched Vulnerability : CVE-2026-63903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: belkinsa: validate interrupt status length The Belkin interrupt callback treats interrupt data as a four-byte status report and reads LSR/MSR field...

Malicious code in twilio-platform-request (npm)

The twilio-platform-request package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a private...

Important: nodejs24

Issue Overview: A use-after-free / double-free in c-ares' query-completion handling. The same flaw -- a query's callback being invoked while the query is still linked in the channel's internal lookup structures -- is present at multiple points in the resend/finish path timeout handling, response...

PT-2026-61691

Name of the Vulnerable Software and Affected Versions cal.diy versions 6.2.0 and earlier Description An open redirect issue exists in the conferencing OAuth callback endpoint. Attackers can redirect users to arbitrary URLs by crafting malicious state parameters, specifically exploiting the unsign...