CVE-2026-50642

diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return \r and escape sequences e.g., OSC, CSI, to pass through unsanitized. An attack...

Security update for python-dulwich

This update for python-dulwich fixes the following issue CVE-2026-38974: Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramikovendor.py bsc1271525. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for openvpn

This update for openvpn fixes the following issues: CVE-2026-13122: denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled bsc1270413. CVE-2026-13698: denial of service via memory leak triggered by remote attackers with a valid...

Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. CVE-2026-46917: unauthenticated attacker with...

SUSE-SU-2026:3406-1 Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: - CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: unauthenticated attacker with...

Security update for PackageKit

This update for PackageKit fixes the following issue: CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Special Instructions and Notes: Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for PackageKit

This update for PackageKit fixes the following issues: CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Special Instructions and Notes: Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaS...

Security update for perl-XML-Bare

This update for perl-XML-Bare fixes the following issues CVE-2026-13401: infinite loop when parsing malformed attributes in parsercparse function bsc1271640. CVE-2026-57074: out-of-bounds read due to unbounded character lookahead in the parsercparse function bsc1271637. Patch Instructions: To...

Security update for python-ujson

This update for python-ujson fixes the following issue: CVE-2026-44660: failing to decrement a serialized JSON object during a write exception in ujson.dump can lead to memory leaks bsc1270301. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

CVE-2026-54572

A flaw was found in Rclone, a command-line program for syncing files with cloud storage. When handling symbolic links symlinks with the -l or --links option, Rclone serializes them as text objects and recreates them without proper validation. A remote attacker could exploit this by providing a...

Security update for sssd

This update for sssd fixes the following issue: CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free bsc1269807. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Exploit for OS Command Injection in Php

HTSOC — SOC lab phát hiện CVE-2024-4577 Đây là bộ mã nguồn, c...

Exploit for OS Command Injection in Openhands

CVE-2026-33718 OpenHands is Vulnerable to Command Injection t...

CVE-2026-50642

diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return \r and escape sequences e.g., OSC, CSI, to pass through unsanitized. An attack...

CVE-2026-50642 Terminal Escape Injection in diff‑so‑fancy

diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return \r and escape sequences e.g., OSC, CSI, to pass through unsanitized. An attack...

CVE-2026-50642 Terminal Escape Injection in diff‑so‑fancy

diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return \r and escape sequences e.g., OSC, CSI, to pass through unsanitized. An attack...

CVE-2026-50642

CVE-2026-50642 — diff-so-fancy exposes non-SGR terminal control sequences in diff output, not sanitizing characters like CR and OSC/CSI. An attacker can place malicious control sequences in filenames, diff metadata, or file content, which render in the terminal during diff viewing and may cause o...

CVE-2026-50642 Terminal Escape Injection in diff‑so‑fancy

diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return \r and escape sequences e.g., OSC, CSI, to pass through unsanitized. An attack...

EUVD-2026-50278

diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return \r and escape sequences e.g., OSC, CSI, to pass through unsanitized. An attack...

CVE-2026-56389 Arbitrary Command Execution in GNU Bison

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...