CVE-2026-57860 ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository

ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...

CVE-2026-8297

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: fr...

CVE-2026-8297

CVE-2026-8297 describes an SQL injection in GisLab Laboratory Management System by Gis Informatics Engineering Consulting (Gis Informatics). Affected versions: 1.4.03 through 08072026. The issue is a generic SQL injection vulnerability with network attack vector, no user interaction, and no privi...

CVE-2026-8297 SQLi in GIS Informatics' GisLab Laboratory Management System

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: fr...

EUVD-2026-45201

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: fr...

CVE-2026-8297 SQLi in GIS Informatics' GisLab Laboratory Management System

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: fr...

Security update for python-dulwich

This update for python-dulwich fixes the following issue CVE-2026-47734: Unbounded memory allocation in receive-pack from crafted thin packs bsc1268138. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for libqt4

This update for libqt4 fixes the following issue CVE-2025-14575: local user can load rogue CA certificates as trusted system authority via a crafted file placed in the application's working directory bsc1265896. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

Security update for vorbis-tools

This update for vorbis-tools fixes the following issue CVE-2026-34253: buffer underflow in the ogg123 utility in function remotethread of remote.c bsc1265361. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for vorbis-tools

This update for vorbis-tools fixes the following issue CVE-2026-34253: buffer underflow in the ogg123 utility in function remotethread of remote.c bsc1265361. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Vulnerabilities in Splunk Enterprise and Splunk Cloud Platform

Splunk has identified vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. The first vulnerability relates to insufficient CSRF protection and input validation in the Deployment Server endpoints. This allows attackers to execute arbitrary SPL queries under the Splunk-system-user contex...

Security update for python-msgpack

This update for python-msgpack fixes the following issue CVE-2026-57585: Unpacker reuse after a caught error can lead to an out-of-bounds read and a crash bsc1269947. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

Security update for tomcat10

This update for tomcat10 fixes the following issues Update to Tomcat 10.1.56. Security issues fixed: CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example bsc1269791. CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused...

Security update for libxml2

This update for libxml2 fixes the following issue CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in --shell mode bsc1269790. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for mariadb-connector-c

This update for mariadb-connector-c fixes the following issue: CVE-2026-44172: mysqlrealescapestring incorrectly handled big5 bsc1266438. Changes for mariadb-connector-c: Update to 3.1.28. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for joe

This update for joe fixes the following issue CVE-2026-13412: arbitrary command execution via malicious tags file bsc1269379. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comma...

SUSE-SU-2026:3108-1 Security update for joe

This update for joe fixes the following issue - CVE-2026-13412: arbitrary command execution via malicious tags file bsc1269379...

CVE-2026-9494

An information disclosure vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in...

CVE-2026-11386

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client constructs APT source files such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents using data received directly from the contract server response via...

UBUNTU-CVE-2026-12391

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic informatio...