kernel security update

3.10.0-1160.119.1.0.16 - net: sched: sfb: fix null pointer access issue when sfbinit fails CVE-2022-50356 Orabug: 38790244 - fs: fix UAF/GPF bug in nilfsmdtdestroy CVE-2022-50367 Orabug: 38790244 - iomap: iomap: fix memory corruption when recording CVE-2022-50406 Orabug: 38790244 - mm: fix zswap...

CVE-2025-62514 `libparsec_crypto` does not check for weak order point of curve 25519

Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, libparseccrypto, a component of the Parsec application, does not check for weak order point of Curve25519 when compiled with its RustCrypto backend. In practice this means ...

SUSE-SU-2026:20176-1 Security update for elemental-register, elemental-toolkit

This update for elemental-register, elemental-toolkit fixes the following issues: elemental-register was updated to 1.8.1: Changes on top of v1.8.1: Update headers to 2026 Update questions to include SL Micro 6.2 Update to v1.8.1: Install yip config files in before-install step Bump...

CVE-2026-24850

The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard ML-DSA. Starting in version 0.0.4 and prior to version 0.1.0-rc.4, the ML-DSA signature verification implementation in the RustCrypto ml-dsa crate incorrectly accepts signatures with repeated duplicat...

ROS-20260129-73-0062

A vulnerability in the ssh-agent library ssh-agent server for the Go crypto programming language involves reading beyond buffer boundaries in memory. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

ROS-20260129-73-0079

A vulnerability in the SSH server of the library for the Go crypto programming language is related to unrestricted resource allocation. Exploitation of the vulnerability could allow a remote attacker to affect the availability of protected information...

ROS-20260129-73-0077

A vulnerability in the SSH server of the library for the Go crypto programming language is related to unrestricted resource allocation. Exploitation of the vulnerability could allow a remote attacker to affect the availability of protected information...

Tenda AC23 Router Buffer Overflow DoS

The vulnerability of the Tenda AC23 router’s microprogramming software is related to the execution of an operation outside the buffer in memory when processing the wpapskcrypto parameter. Exploiting this vulnerability allows a remote attacker to cause a service failure by sending a specially...

ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices

Affected Crate: ml-dsa Affected Versions: v0.1.0-rc.2 and commits since b01c3b7 Severity: Medium Reporter: Oren Yomtov Fireblocks Summary The ML-DSA signature verification implementation in the RustCrypto ml-dsa crate incorrectly accepts signatures with repeated duplicate hint indices. According ...

SUSE-SU-2026:0317-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2022-50630: mm: hugetlb: fix UAF in hugetlbhandleuserfault bsc1254785. - CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer bsc1255576. - CVE-2023-53254:...

SUSE CVE-2026-22992

In the Linux kernel, the following vulnerability has been resolved: libceph: return the handler error from monhandleauthdone Currently any error from cephauthhandlereplydone is propagated via finishauth but isn't returned from monhandleauthdone. This results in higher layers learning that despite...

CVE-2026-24850

The CVE-2026-24850 issue affects the RustCrypto ml-dsa crate. A regression in the signature verification path allowed repeated hint indices by using a non-strict monotonic check (<=) instead of a strict

kernel security update

3.10.0-1160.119.1.0.15 - Bluetooth: L2CAP: fix use-after-free in l2capconndel CVE-2022-3640 Orabug: 38742878 - Bluetooth: L2CAP: Fix use-after-free caused by l2capchanput Orabug: 38742878 - Bluetooth: L2CAP: Fix user-after-free CVE-2022-50386 Orabug: 38742878 - wifi: brcmfmac: fix use-after-free...

OPENSUSE-RU-2026:20161-1 Recommended update for hauler

This update for hauler fixes the following issues: Changes in hauler: - Update to version 1.4.1 bsc1256546, CVE-2026-22772: fixed typos for containerd imports 493 fix and support containerd imports of hauls 492 bump github.com/sigstore/fulcio 489 - Update to version 1.4.0: added/updated logging f...

AZL-76128 CVE-2025-69418 affecting package edk2 for versions less than 20230301gitf80f052277c8-47

Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof 16 bytes can leave the final partial block unencrypted and unauthenticated.Impact summary: The trailing 1-15 bytes of a message may be exposed...

CVE-2026-1420

A flaw has been found in Tenda AC23 16.03.07.52. This impacts an unknown function of the file /goform/WifiExtraSet. This manipulation of the argument wpapskcrypto causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used...

FreeBSD-SA-26:01.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:01.openssl Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in OpenSSL Category: contrib Module: openssl Announced: 2026-01-27 Credits:...

de.adorsys.sts:keycloak-storage-provider (>=1.1.23, <=1.1.28), io.phasetwo.keycloak:keycloak-events (0.20) +17 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (22.0.4)

org.keycloak:keycloak-services MAVEN version 22.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =1.1.23, =0.20, =0.12, =0.14 -...

de.arbeitsagentur.opdt:keycloak-extension-filestore (>=1.0.2-25.0, <=1.0.4-25.0), org.keycloak:keycloak-crypto-fips1402 (25.0.5) +13 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (25.0.5)

org.keycloak:keycloak-services MAVEN version 25.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-extension-filestore =1.0.2-25.0, =1.0.4-25.0 -...

fr.cnieg.keycloak:attribute-login-provider (1.4.2), io.phasetwo.keycloak:keycloak-orgs (>=0.53, <=0.57) +24 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (23.0.6)

org.keycloak:keycloak-services MAVEN version 23.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.4.2 - io.phasetwo.keycloak:keycloak-orgs =0.53, =0.57...