Security update for libxml2 (important)

openSUSE security update: security update for libxml2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21317-1 Rating: important References: bsc1262719 bsc1269790 Cross-References: CVE-2026-11979 CVE-2026-6732 CVSS scores: CVE-2026-11979 SUSE : 7...

Security update for grafana (moderate)

openSUSE security update: security update for grafana ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21351-1 Rating: moderate References: bsc1262187 bsc1263272 Cross-References: CVE-2025-12141 CVE-2026-21725 CVE-2026-41607 CVSS scores: CVE-2025-121...

Security update for tomcat11 (moderate)

openSUSE security update: security update for tomcat11 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21329-1 Rating: moderate References: bsc1232390 bsc1269791 bsc1269824 bsc1269907 bsc1269908 bsc1269909 bsc1269910 Cross-References: CVE-2026-50229...

PT-2026-60262

OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or...

CVE-2026-30618

xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulti...

CVE-2026-30618

CVE-2026-30618 affects xszyou Fay 4.3.1, where the MCP STDIO server management and command execution handling can be abused via a publicly exposed MCP management interface to execute arbitrary commands in the Fay service context. Technical details across sources describe an RCE via attacker-contr...

RockyLinux 10 : python3.12 (RLSA-2026:39183)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39183 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding descriptio...

AlmaLinux 10 : python3.12 (ALSA-2026:39183)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:39183 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

Malicious code in proxy-checker-j (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4316f8f54acc92939cdf73074666eecab7d5e680c7c4ad572ad3164671aa19dc The package is published on PyPI as proxy-checker-j with the summary 'packaged command for running the bundled qsshd executable', but its actual...

MAL-2026-10644 Malicious code in proxy-checker-j (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4316f8f54acc92939cdf73074666eecab7d5e680c7c4ad572ad3164671aa19dc The package is published on PyPI as proxy-checker-j with the summary 'packaged command for running the bundled qsshd executable', but its actual...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version v12.1.1.1 Vulnerability Details CVEID:CVE-2026-42342 DESCRIPTION: React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certai...

CVE-2025-56362

A reachable assertion vulnerability exists in the Matter SDK connectedhomeip before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is sent and immediately followed by a write of OperationMode=2 in the Pump Configuration and Control...

CVE-2025-56365

A reachable assertion vulnerability exists in the Matter SDK connectedhomeip before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster e.g., 0x34, the code incorrectly treats the endpoint as valid due to missing...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in OpenSSL

Summary OpenSSL for IBM i is vulnerable to out-of-bounds read when parsing a crafted DER-encoded ASN.1 structure with a 2 gigabyte primitive element or when using Cryptographic Message Services CMS password-based decryption and processing a stream-mode KEK cipher CVE-2026-34180, CVE-2026-9076,...

DEBIAN-CVE-2026-59733

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path,...

CVE-2026-59733

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path,...

DEBIAN-CVE-2026-59732

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as...

CVE-2026-59732

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as...

CVE-2026-54572

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an...

DEBIAN-CVE-2026-54572

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an...