137124 matches found
CVE-2026-77348 Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...
CVE-2026-77348
Wallos , an open-source self-hostable subscription tracker, ships a second unauthenticated logo-image search endpoint—endpoints/payments/search.php—that was missed when the original httpoxy SSRF fix (CVE-2026-33407) hardened endpoints/logos/search.php. Prior to version 5.0.0 , the endpoint passes...
CVE-2026-77348 Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...
CLSA-2026-1788210245 TuxCare security update for 21 packages (1 CVE)
TuxCare rebuilt 21 packages to address 1 CVE. Fixed in 2.5-tuxcare.1...
CLSA-2026-1788200476 TuxCare security update for org.springframework.data:spring-data-keyvalue (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 4 CVEs. Fixed in 3.3.13-tuxcare.3...
CVE-2026-65637
A flaw was found in Apache Tomcat. This improper input validation vulnerability, stemming from an incomplete fix for CVE-2026-32990, allows for an HTTP/2 no-authority bypass of strict Server Name Indication SNI validation. This could potentially lead to unauthorized access or misrouting of...
CLSA-2026-1788193903 TuxCare security update for io.netty (2 CVEs)
TuxCare rebuilt 40 io.netty packages to address 2 CVEs. Fixed in 4.1.48.Final-tuxcare.3...
SUSE CVE-2026-72241
In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr on it might result in a buffer overread. The same thing will happen when said string is use...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: glibc: compat-libpthread-nonshared-2.43-8.4.hum1 aarch64, x8664 glibc-2.43-8.4.hum1 aarch64, x8664 glibc-all-langpacks-2.43-8.4.hum1 aarch64, x8664 glibc-benchtests-2.43-8.4.hum1 aarch64, x8664...
SUSE-SU-2026:23366-1 Security update for the Linux Kernel (Live Patch 19 for SUSE Linux Enterprise Micro 6.0)
This update for the SUSE Linux Enterprise Kernel 6.4.0-42.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie bsc1270023 - CVE-2026-53246: sctp: validate cached peer INIT chunk length in...
CLSA-2026-1788187104 TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)
TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 4.0.1-tuxcare.1...
Important: Red Hat Security Advisory: OpenShift Virtualization v4.16 Images
Red Hat OpenShift Virtualization release v4.16 is now available with updates to packages and images that fix several bugs and add enhancements. OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform. This advisory contains OpenShift...
SUSE CVE-2026-72135
In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODEPREAD and FMODEPWRITE enabled. After a command leaves a response pendin...
USN-8678-3 openssl vulnerability
USN-8673-1 fixed vulnerabilities in OpenSSL. The update inadvertently left out the fix for CVE-2026-75803 in Ubuntu 26.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that OpenSSL incorrectly handled the QUIC server incoming...
ROOT-OS-DEBIAN-13-CVE-2026-41080 CVE-2026-41080 in expat - Patched by Root
Root has patched CVE-2026-41080 in the expat package for Root:Debian:13. Multiple fixed versions available...
CVE-2026-45570
A flaw was found in go-git, a library used for Git operations. The component responsible for secure shell SSH communication does not correctly handle special characters in repository paths. This oversight allows a remote attacker to manipulate the command executed on the server by including a...
CLSA-2026-1788172688 TuxCare security update for django (3 CVEs)
TuxCare rebuilt django to address 3 CVEs. Fixed in 5.0.1.post6+tuxcare...
RHSA-2026:61261 Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update
Bulletin has no description...