Security update for the Linux Kernel (important)

openSUSE security update: security update for the linux kernel ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21388-1 Rating: important References: bsc1149651 bsc1204315 bsc1236743 bsc1255029 bsc1257506 bsc1258538 bsc1259800 bsc1260565 bsc1261250...

Security update for gpg2 (low)

openSUSE security update: security update for gpg2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21385-1 Rating: low References: bsc1269279 Cross-References: CVE-2026-57062 CVSS scores: CVE-2026-57062 SUSE : 2.9...

Security update for libgcrypt (moderate)

openSUSE security update: security update for libgcrypt ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21387-1 Rating: moderate References: bsc1262684 Cross-References: CVE-2026-41989 CVSS scores: CVE-2026-41989 SUSE : 6.3...

Command Injection

Overview @syncfusion/ej2-base is an A common package of Essential JS 2 base libraries, methods and class definitions Affected versions of this package are vulnerable to Command Injection via the use of childprocess.exec function which uses the package name from package.json without escaping befor...

CVE-2026-16631

A vulnerability was detected in publint up to 0.1.4. This impacts the function childprocess.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may b...

CVE-2026-16631 publint package-manager pack.js child_process.exec os command injection

A vulnerability was detected in publint up to 0.1.4. This impacts the function childprocess.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may b...

CVE-2026-16631

The CVE-2026-16631 entry concerns publint up to version 0.1.4 where the pack.js file in the package-manager Command Handler uses child_process.exec, enabling os command injection. Local attack required; exploit is public. A patch identified as adf2d9a09945fc98c85a2520a89f441d78b2dbd8 exists and s...

CVE-2026-16631 publint package-manager pack.js child_process.exec os command injection

A vulnerability was detected in publint up to 0.1.4. This impacts the function childprocess.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may b...

CVE-2026-16631 publint package-manager pack.js child_process.exec os command injection

A vulnerability was detected in publint up to 0.1.4. This impacts the function childprocess.exec of the file src/node/pack.js of the component package-manager Command Handler. The manipulation results in os command injection. Attacking locally is a requirement. The exploit is now public and may b...

Important: Red Hat Security Advisory: kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_143_1, and kpatch-patch-4_18_0-477_97_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2026-16630

A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function childprocess.exec of the file package.json. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been disclosed publicly a...

Cross-site Scripting (XSS)

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the image viewer. An attacker can execute arbitrary code on the server by tricking a user into opening a specially crafted image file in the image viewer...

Incorrect Behavior Order: Validate Before Canonicalize

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize when enforcing blocklists for extension installation due to insufficient normalization of package names. An attacker can bypass...

Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Summary Dompdf v3.1.5 is vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000 pixels. While Dompdf implements internal checks...

GHSA-F5GF-2CJ8-52G2 Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Summary Dompdf v3.1.5 is vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000 pixels. While Dompdf implements internal checks...

Important: Red Hat Security Advisory: kpatch-patch-5_14_0-687_10_1 security update

An update for kpatch-patch-5140-687101 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

redis-poc

Redis Authenticated RCE stream NACK double free Non-destruc...

CVE-2026-16629

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed...

CVE-2026-16628

A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function childprocess.exec of the component JIT Plugin Entry Handler. Performing a manipulation of the argument jitPlugins results in os command injection. The attack is only possible with local access. The...

CVE-2026-16630

A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function childprocess.exec of the file package.json. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been disclosed publicly a...