137162 matches found
SUSE-SU-2026:23186-1 Security update for suseconnect-ng
This update for suseconnect-ng fixes the following issue: - Build against outdated go1.24-openssl bsc1268900. Changes for suseconnect-ng: - Update version to 1.23.0: - Use product identifier for product migrations bsc1268596. - Switch to using go1.26-openssl as the default Go version to install t...
RHSA-2026:54836 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
RHSA-2026:54835 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python-cryptography: python3-cryptography-50.0.0-1.hum1 aarch64, x8664 python-cryptography-50.0.0-1.hum1.src src...
BIT-SEAWEEDFS-2026-72921 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...
BIT-NODE-MIN-2026-58040
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...
BIT-NODE-2026-58040
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...
BIT-GHOST-2026-70588 Ghost: Cross-Site Scripting in Universal Import
Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1...
BIT-AIRFLOW-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users
Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...
CLSA-2026-1786943805 TuxCare security update for org.apache.activemq (1 CVE)
TuxCare rebuilt 55 org.apache.activemq packages to address 1 CVE. Fixed in 2.37.0-tuxcare.1...
CVE-2026-19984 jkawamoto mcp-florence2 __init__.py get_images server-side request forgery
A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function getimages of the file src/mcpflorence2/init.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and...
CVE-2026-19965 automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy
A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...
PT-2026-82439
TuxCare rebuilt pypdf to address 6 CVEs. Fixed in 5.9.0.post12+tuxcare...
CVE-2026-67967
Buffer Overflow vulnerability in Tenda W20E V16.01.0.62782 allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819...
EUVD-2026-60537
Buffer Overflow vulnerability in Tenda W20E V16.01.0.62782 allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819...
CVE-2026-67967
A stack-based buffer overflow and command injection vulnerability exists in the Tenda W20E V5.0 wireless router running firmware US_W20EV5.0qu_V16.01.0.6(2782)_CN&EN_TDE01.bin. The flaw occurs in the /goform/module API, where the setDhcpStaticBindList.bindMACAddr handler uses strcpy() without len...
PT-2026-73202
A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl nas sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be...
OPENSUSE-SU-2026:11530-1 gh-2.97.0-1.1 on GA media
These are all security issues fixed in the gh-2.97.0-1.1 package on the GA media of openSUSE Tumbleweed...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gstreamer1-plugins-good (UTSA-2026-022345)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-022345 advisory. An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gstwavparseadtlchunk function. The patch added a size validation check lsize + 8 size, but it do...