SUSE-SU-2026:1081-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpicmpui bsc1254992. - CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply...

AppSec-Penetration-Testing-Lab

🔐 AppSec Penetration Testing Lab A hands-on application sec...

Security update for python310

This update for python310 fixes the following issues: Update to Python 3.10.20: CVE-2025-6075: quadratic complexity in os.path.expandvars bsc1252974. CVE-2025-11468: header injection with carefully crafted inputs bsc1257029. CVE-2025-12084: quadratic complexity in xml.minidom node ID cache cleari...

SUSE-SU-2026:1062-1 Security update for python310

This update for python310 fixes the following issues: Update to Python 3.10.20: - CVE-2025-6075: quadratic complexity in os.path.expandvars bsc1252974. - CVE-2025-11468: header injection with carefully crafted inputs bsc1257029. - CVE-2025-12084: quadratic complexity in xml.minidom node ID cache...

hunspell:persdicfuzzer: Use-of-uninitialized-value in HashMgr::add_hidden_capitalized_word

Project: https://github.com/hunspell/hunspell.git Detailed Report: https://oss-fuzz.com/testcase?key=6375041091829760 Project: hunspell Fuzzing Engine: libFuzzer Fuzz Target: persdicfuzzer Job Type: libfuzzermsanhunspell Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cra...

opencv:filestorage_read_file_fuzzer: Container-overflow in cv::FileNode::name

Detailed Report: https://oss-fuzz.com/testcase?key=6040757814493184 Project: opencv Fuzzing Engine: libFuzzer Fuzz Target: filestoragereadfilefuzzer Job Type: libfuzzerasanopencv Platform Id: linux Crash Type: Container-overflow READ 4 Crash Address: 0x7a5c27fe0213 Crash State: cv::FileNode::name...

exiv2:fuzz-read-print-write: Heap-buffer-overflow in Exiv2::getULong

Project: https://github.com/Exiv2/exiv2.git Detailed Report: https://oss-fuzz.com/testcase?key=6012684062752768 Project: exiv2 Fuzzing Engine: honggfuzz Fuzz Target: fuzz-read-print-write Job Type: honggfuzzasanexiv2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

qt:qtbase_gui_image_qimage_loadfromdata: Bad-cast to QSvgMarker from QSvgLine in QSvgMarker::drawHelper

Detailed Report: https://oss-fuzz.com/testcase?key=5789277043884032 Project: qt Fuzzing Engine: libFuzzer Fuzz Target: qtbaseguiimageqimageloadfromdata Job Type: libfuzzerubsanqt Platform Id: linux Crash Type: Bad-cast Crash Address: 0x59d2c3d702d0 Crash State: Bad-cast to QSvgMarker from QSvgLin...

binutils:fuzz_addr2line: Heap-buffer-overflow in _bfd_read_unsigned_leb128

Detailed Report: https://oss-fuzz.com/testcase?key=5599450797244416 Project: binutils Fuzzing Engine: honggfuzz Fuzz Target: fuzzaddr2line Job Type: honggfuzzasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x776b7ffe0761 Crash State: bfdreadunsignedleb128...

PT-2026-28219

Name of the Vulnerable Software and Affected Versions FreeBSD affected versions not specified Description A stack-based buffer overflow exists in the kgssapi.ko kernel module and the librpcgss sec library. The issue occurs during the validation of RPCSEC GSS data packets, where a routine...

PT-2026-28559

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.0 Description Forge, a native implementation of Transport Layer Security in JavaScript, has an issue where the pki.verifyCertificateChain function does not properly enforce RFC 5280 basicConstraints requirements...

PT-2026-28569

Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.8 Description Handlebars allows Remote Code Execution RCE through a crafted Abstract Syntax Tree AST object. The Handlebars.compile function accepts either a template string or a pre-parsed AST. When an AS...

PT-2026-57178

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.2.1 Description Two chained authorization flaws exist in the software. The 'LinkSharing.ReadAll' endpoint exposes share hashes to users with read access, which allows for permission escalation to admin-level shares...

PT-2026-28557

Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.0 Description Forge, a native implementation of Transport Layer Security in JavaScript, has a flaw in its RSASSA PKCS1 v1.5 signature verification process. This issue allows attackers to forge signatures for keys wi...

PT-2026-28389

Name of the Vulnerable Software and Affected Versions Kirby CMS versions through 5.1.4 Description Kirby CMS through version 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service DoS via a malformed image upload. The application does not properly...

PT-2026-28418

Name of the Vulnerable Software and Affected Versions Smart Slider 3 versions prior to 3.5.1.34 Description The Smart Slider 3 plugin for WordPress contains a flaw that allows authenticated attackers with Subscriber-level access or higher to read arbitrary files on the server. This is possible...

PT-2026-28523

Name of the Vulnerable Software and Affected Versions BentoML versions prior to 1.4.37 Description BentoML is a Python library used for building online serving systems for AI applications and model inference. A flaw exists where the docker.system packages field within the bentofile.yaml file does...

PT-2026-28574

Name of the Vulnerable Software and Affected Versions Happy DOM versions 15.10.0 through 20.8.7 Description Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions 15.10.0 through 20.8.7 contain a code injection issue in the ECMAScriptModuleCompile...

PT-2026-31774

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22 Description OpenClaw contains a privilege escalation issue in the device.pair.approve method. An operator with pairing approval rights can approve device requests with broader operator scopes than authorize...

PT-2026-28566

Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.8 Description Handlebars is a templating engine that allows users to build semantic templates. Versions 4.0.0 through 4.7.8 contain a flaw in the resolvePartial function within the Handlebars runtime. This...