SUSE: Security Advisory (SUSE-SU-2026:20629-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2026-24181

Name of the Vulnerable Software and Affected Versions affected versions not specified Description Attackers are utilizing a technique involving malformed ZIP metadata, referred to as 'shadow archives', to circumvent antivirus AV and Endpoint Detection and Response EDR systems. This method allows...

PT-2026-26499

OpenClaw's system.run allowlist analysis did not honor POSIX shell comment semantics when deriving allow-always persistence entries. A caller in security=allowlist mode who received an allow-always decision could submit a shell command whose tail was commented out at runtime, for example by using...

PT-2026-24114

Name of the Vulnerable Software and Affected Versions Ghostty versions prior to 1.3.0 Description Ghostty allows control characters, such as 0x03 Ctrl+C, within pasted or dropped text. These characters can be leveraged to execute arbitrary commands in certain shell environments. Successful...

Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter

Register unwilling users for events potential harassment/spam - Cancel other users' event participation - Manipulate event participant counts and comments - If events have participation limits, fill slots with unwanted registrations...

llvm:clangd-fuzzer: Global-buffer-overflow in _GLOBAL__sub_I_DependencyScanningTool.cpp

Detailed Report: https://oss-fuzz.com/testcase?key=5886579209207808 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: clangd-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Global-buffer-overflow READ Crash Address: 0x5759a2773a02 Crash State:...

rdkit:mol_data_stream_to_mol_fuzzer: Use-of-uninitialized-value in RDKit::SGroupParsing::ParseV3000SGroupsBlock

Project: https://github.com/rdkit/rdkit.git Detailed Report: https://oss-fuzz.com/testcase?key=5517848155848704 Project: rdkit Fuzzing Engine: libFuzzer Fuzz Target: moldatastreamtomolfuzzer Job Type: libfuzzermsanrdkit Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Cras...

pyvex:irsb_fuzzer: Heap-buffer-overflow in libpyvex.so

Detailed Report: https://oss-fuzz.com/testcase?key=4798045517840384 Project: pyvex Fuzzing Engine: libFuzzer Fuzz Target: irsbfuzzer Job Type: libfuzzerasanpyvex Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x6160006566c9 Crash State: libpyvex.so disInstrARM bbtoIR...

libvips:vips_fuzzer: Heap-buffer-overflow in vips_sign_buffer

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=6674538674061312 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: vipsfuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

gdal:zarr_fuzzer: Heap-use-after-free in json_object_get

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=6311534883307520 Project: gdal Fuzzing Engine: libFuzzer Fuzz Target: zarrfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x77c010cf3dd4 Crash...

ffmpeg:ffmpeg_AV_CODEC_ID_EXR_DEC_fuzzer: Use-of-uninitialized-value in piz_uncompress

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=6310933506097152 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDEXRDECfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type:...

tinyobjloader:fuzz_ParseFromString: Heap-buffer-overflow in tinyobj::tryParseDouble

Project: https://github.com/tinyobjloader/tinyobjloader.git Detailed Report: https://oss-fuzz.com/testcase?key=5352302256128000 Project: tinyobjloader Fuzzing Engine: libFuzzer Fuzz Target: fuzzParseFromString Job Type: libfuzzerasantinyobjloader Platform Id: linux Crash Type: Heap-buffer-overflo...

checkstyle:CheckstyleFuzzer: Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.expr

Detailed Report: https://oss-fuzz.com/testcase?key=5193079262085120 Project: checkstyle Fuzzing Engine: libFuzzer Fuzz Target: CheckstyleFuzzer Job Type: libfuzzerasancheckstyle Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

PT-2026-24022

Name of the Vulnerable Software and Affected Versions Apache Airflow Providers Http versions prior to 6.0.0 Description A user with database access can create a malicious database entry that executes code on the Triggerer, granting them the same permissions as a Dag Author. Direct database access...

PT-2026-24192

Name of the Vulnerable Software and Affected Versions rssn versions prior to 0.2.9 Description The rssn scientific computing library for Rust has an issue in its JIT Just-In-Time compilation engine, which is exposed through the CFFI Foreign Function Interface. Insufficient input validation and...

CVE-2026-29783

The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent e.g., via prompt injection through repository files, MCP server...

graphicsmagick:coder_MP4_fuzzer: Use-of-uninitialized-value in void edge_filtering_luma_internal<unsigned char>

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=6187478779494400 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderMP4fuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value...

ffmpeg:ffmpeg_AV_CODEC_ID_VVC_fuzzer: Heap-buffer-overflow in cbs_h266_read_pps

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4711353817563136 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDVVCfuzzer Job Type: libfuzzerasani386ffmpeg Platform Id: linux Crash Type:...

ffmpeg:ffmpeg_BSF_EXTRACT_EXTRADATA_fuzzer: Heap-buffer-overflow in write_lcevc_nalu

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4605696279904256 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegBSFEXTRACTEXTRADATAfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type:...

CVE-2026-28436

Frappe is a full-stack web application framework. Prior to versions 16.11.0 and 15.102.0, an attacker can set a crafted image URL that results in XSS when the avatar is displayed, and it can be triggered for other users via website page comments. This issue has been patched in versions 16.11.0 an...