SUSE-SU-2026:3878-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: - CVE-2026-54874: Excessive Memory Use Buffering DTLS Records for a Future Epoch bsc1274795. - CVE-2026-63072: Heap Buffer Overflow in CMS Key Unwrapping bsc1274788. Changes for openssl-11: - August 2026 release bsc1274774...

Security update for openssl-1_1

This update for openssl-11 fixes the following issues: CVE-2026-54874: Excessive Memory Use Buffering DTLS Records for a Future Epoch bsc1274795. CVE-2026-63072: Heap Buffer Overflow in CMS Key Unwrapping bsc1274788. Changes for openssl-11: August 2026 release bsc1274774 Patch Instructions: To...

SUSE-SU-2026:3877-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: - CVE-2026-54874: Excessive Memory Use Buffering DTLS Records for a Future Epoch bsc1274795. - CVE-2026-63072: Heap Buffer Overflow in CMS Key Unwrapping bsc1274788. Changes for openssl-11: - August 2026 release bsc1274774...

Security update for openssl-3

This update for openssl-3 fixes the following issues: CVE-2026-54874: Excessive Memory Use Buffering DTLS Records for a Future Epoch bsc1274795. CVE-2026-63072: Heap Buffer Overflow in CMS Key Unwrapping bsc1274788. CVE-2026-63074: CMP Indefinite Cache Growth of ExtraCerts bsc1274797...

SUSE-SU-2026:3876-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2026-54874: Excessive Memory Use Buffering DTLS Records for a Future Epoch bsc1274795. - CVE-2026-63072: Heap Buffer Overflow in CMS Key Unwrapping bsc1274788. - CVE-2026-63074: CMP Indefinite Cache Growth of ExtraCerts bsc1274797. -...

SUSE-SU-2026:23585-1 Security update for openssl-3-x86_64-v3-livepatches

This update for openssl-3-x8664-v3-livepatches fixes the following issues: - HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271713, bsc1271712. - CVE-2026-14457: RPK server signature algorithm selection can dereference a missing...

CVE-2026-75594: Improper Limitation of a Pathname to a Restricted Directory

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache...

PT-2026-84048

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description An issue exists in the MediaStreamController.php file where the /media/id/download/slug endpoint and its administration variant honor the inline query parameter for...

PT-2026-83996

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.5 Kirby versions prior to 5.5.2 Description The media handler in this content management system uses incomplete filesystem containment checks within src/Filesystem/Dir.php and src/Filesystem/F.php via the functions...

PT-2026-84036

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed KirbyCmsMedia::thumb to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache...

PT-2026-84041

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description An issue exists in the preview-link endpoint and the src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php file where VIEW permissions are not enforced f...

Joomla com_baforms Code Execution

The vulnerability of the combaforms component of the Balbooa Forms extension in the Joomla content management system involves unlimited loading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

DIAFAN.CMS SQL Injection

The vulnerability of the DIAFAN.CMS website content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-39275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and...

CVE-2019-10068-PoC

PoC de CVE-2019-10068 para Kentico CMS Exploit de prueba de concepto para CVE-2019-10068, que aprovecha una RCE por deserialización en Kentico CMS para subir una web shell. Aviso legal: Esta prueba de concepto se proporciona únicamente con fines educativos y de investigación de seguridad...

CVE-2026-82449

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82449

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82449 Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcry...

CVE-2026-82449

Cockpit CMS before 2.14.1 is affected by an account enumeration vulnerability in the auth check endpoint (modules/App/Controller/Auth.php). The root cause is a timing discrepancy in password verification: requests for existing accounts trigger a bcrypt hash comparison (slower), while requests for...