SUSE-SU-2026:22554-1 Security update for rust-keylime

This update for rust-keylime fixes the following issues: Update to version 0.2.9+49. Security issues fixed: - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270174. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callbac...

MAL-2026-10014 Malicious code in nodemon-sudo (npm)

The npm package nodemon-sudo is a typosquat of the popular nodemon package: its package.json description "Simple monitor script for use during development of a Node.js app.", main entry ./lib/nodemon, and forged author field Remy Sharp, the real maintainer of nodemon are copied from the legitimat...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +174 more potentially affected by CVE-2026-55575 via liquidjs (>=10.2.0, <=10.27.0)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.4.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.8.0, =12.0.0, =1.0.1-beta.0, =1.0.4 and more Source cves: CVE-2026-55575 Source advisory: SNYK:JS-LIQUIDJS-17901238...

@aoagents/ao (>=0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, <=0.10.1-nightly-249c67046d14809943d228b01eefedb10821e5dc), @aoagents/ao-cli (>=0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, <=0.10.1-nightly-249c67046d14809943d228b01eefedb10821e5dc) +84 more potentially affected by CVE-2026-59807 via @composio/core (>=0.1.0-rc.3, <=0.13.1)

@composio/core NPM version =0.1.0-rc.3, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.0.2, =1.0.0, =0.1.0-rc.3, =4.4.0, =3.8.11, =3.8.11, =3.7.18, =3.7.18, =3.7.18,...

@228-fund/elysia-effect (0.0.1), @228-fund/elysia-msgpack (>=0.0.1, <=0.0.3) +73 more potentially affected by CVE-2026-56669 via elysia (>=1.0.9, <=1.4.28)

elysia NPM version =1.0.9, =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.4, =0.1.0, =0.1.0-next.4, =1.0.0-next.4, =1.0.0, =0.0.1, =1.0.0, =1.0.2 and more Source cves: CVE-2026-56669 Source advisory: SNYK:JS-ELYSIA-17908759...

shadcn-ui-lib (>=0.0.9, <=0.0.15) potentially affected by CVE-2026-55596 via @platejs/media (53.0.0)

@platejs/media NPM version 53.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @platejs/media and may be impacted: - shadcn-ui-lib =0.0.9, =0.0.15 Source cves: CVE-2026-55596 Source advisory: SNYK:JS-PLATEJSMEDIA-17901642...

@bitsocial/ai-moderation-challenge (>=0.1.0, <=0.1.1), @bitsocial/bitsocial-cli (>=0.19.44, <=0.19.72) +6 more potentially affected by CVE-2026-49866 via @libp2p/gossipsub (>=15.0.0-049bfa0fa, <=15.0.22-5692f3f16)

@libp2p/gossipsub NPM version =15.0.0-049bfa0fa, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =6.0.0-049bfa0fa, =9.0.0-049bfa0fa, =0.0.17, =0.0.47 Source cves: CVE-2026-49866 Source advisory: SNYK:JS-LIBP2PGOSSIPSUB-17901717...

@injectivelabs/wallet-base (1.20.21), @injectivelabs/wallet-core (1.20.21) +9 more potentially affected by unknown CVE via @injectivelabs/sdk-ts (1.20.21)

@injectivelabs/sdk-ts NPM version 1.20.21 is affected by a known vulnerability. The following packages have a transitive dependency on @injectivelabs/sdk-ts and may be impacted: - @injectivelabs/wallet-base 1.20.21 - @injectivelabs/wallet-core 1.20.21 - @injectivelabs/wallet-cosmos 1.20.21 -...

CVE-2026-58212

Further research determined the issue is not a vulnerability based on CNA Rule 4.1.12 The act of updating Product dependencies MUST NOT be determined to be a Vulnerability, regardless of whether the dependencies have Vulnerabilities...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains through the unauthenticated local API exposed in proxy mode, which accepts cross-origin requests due to a permissive CORS policy and lack of authentication. An attacker can achieve...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains through the unauthenticated local API exposed in proxy mode, which accepts cross-origin requests due to a permissive CORS policy and lack of authentication. An attacker can achieve...

UBUNTU-CVE-2026-59948

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project...

UBUNTU-CVE-2026-59946

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and...

UBUNTU-CVE-2026-59947

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug outp...

CVE-2026-59948

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project...

CVE-2026-10536

A flaw was found in libcurl. This use-after-free vulnerability occurs when an application configures an HTTP/2 stream-dependency tree and then performs a sequence of operations involving curleasyreset and curleasycleanup. During the final cleanup, libcurl attempts to access memory that has alread...

@3kles/3kles-socketio (>=2.1.5, <=2.4.1), @5minds/processcube_engine (>=16.0.0-alpha.2, <=18.0.0-renovate-fc9b99-lz9hhvt1) +270 more potentially affected by CVE-2026-59724 via engine.io (>=6.5.1, <=6.6.6)

engine.io NPM version =6.5.1, =2.1.5, =16.0.0-alpha.2, =2.17.13, =1.16.10, =3.0.4, =2.0.28, =1.1.5-13, =0.1.0, =0.1.0, =0.1.0, =1.2.0, =12.0.1, =17.0.0 and more Source cves: CVE-2026-59724 Source advisory: SNYK:JS-ENGINEIO-17900560...

@adobe/helix-docx2md (1.9.29), @adobe/helix-importer (>=3.4.141, <=3.4.143) +32 more potentially affected by CVE-2026-59868 +1 more via js-yaml (>=5.0.0, <=5.1.0)

js-yaml NPM version =5.0.0, =3.4.141, =2.2.62, =1.0.8, =0.2.12, =0.2.12, =0.2.12, =0.2.13, =0.2.12, =0.2.16, =0.2.14, =0.2.12, =0.2.17 and more Source cves: CVE-2026-59868, CVE-2026-59869 Source advisory: SNYK:JS-JSYAML-17900092...

02-infrastructure (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +21414 more potentially affected by CVE-2026-59869 via js-yaml (>=3.0.0, <=3.14.2)

js-yaml NPM version =3.0.0, =1.0.0, =1.0.4, =5.0.0, =1.0.3, =2.0.0, =0.0.1, =0.0.2 - 23g-base-css 1.0.0 and more Source cves: CVE-2026-59869 Source advisory: SNYK:JS-JSYAML-17900054...

02.aula (1.0.0), 0xrtest (1.0.0) +10564 more potentially affected by CVE-2026-59869 via js-yaml (>=4.0.0, <=4.2.0)

js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =1.1.9, =0.1.23, =0.1.4, =6.1.5, =0.2.0, =0.14.0 and more Source cves: CVE-2026-59869 Source advisory: SNYK:JS-JSYAML-17900054...