SUSE CVE-2026-80529

In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlogrecoverdquotcommitpass2 validates the recovered dquot with xfsdqblkverify and, on failure, sets error = -EFSCORRUPTED and jumps to outrelease. But outrelease unconditional...

SUSE CVE-2026-80538

In the Linux kernel, the following vulnerability has been resolved: xfs: propagate errors from xfsrtginodeload xfsrtginodeensure treats every xfsrtginodeload error other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error. Growfs th...

SUSE CVE-2026-80565

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix error path in devmqceregisteralgs If ops-registeralgs fails, the error path repeatedly calls the same ops-unregisteralgs from the failed registration. Use the loop index to unregister the previously registered...

SUSE CVE-2026-80567

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Previously, rmif54bufferqueue waited for the worker thread to finish but ignored whether it succeeded. If the worker failed e.g., due to a timeout or register read...

CVE-2026-75573: Insertion of Sensitive Information into Log File

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclos...

ROS-20260827-73-0011

The vulnerability of the bondxmithash function in the drivers/net/bonding/bondmain.c file of the Linux kernel’s network device driver is related to a data processing error. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

ROS-20260827-73-0031

The vulnerability in the kernel-lt is related to a memory rerelease error. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-81100: Origin Validation Error

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-59297: Origin Validation Error

Implementation of isSecure call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

CVE-2026-81099: Origin Validation Error

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

Security update for dracut (important)

openSUSE security update: security update for dracut ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21639-1 Rating: important References: bsc1274432 Cross-References: CVE-2026-15816 CVSS scores: CVE-2026-15816 SUSE : 7.5...

Security update for xmlrpc-c (moderate)

openSUSE security update: security update for xmlrpc-c ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21633-1 Rating: moderate References: bsc1272769 Cross-References: CVE-2026-15928 CVSS scores: CVE-2026-15928 SUSE : 5.4...

CVE-2026-81092: Origin Validation Error

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81095: Origin Validation Error

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...

CVE-2026-81102: Origin Validation Error

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81676: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

PT-2026-82498

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limit videos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-75159: Double Free

An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until...

PT-2026-82496

The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database...

PT-2026-82800

Name of the Vulnerable Software and Affected Versions jwcrypto affected versions not specified Description A flaw allows a remote attacker to cause a denial of service DoS by sending a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token forc...