OESA-2026-3116 pipewire security update

is a server and user space API to deal with multimedia pipelines,contains command line utilities. Security Fixes: RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return.CVE-2026-14324...

OESA-2026-3115 pipewire security update

is a server and user space API to deal with multimedia pipelines,contains command line utilities. Security Fixes: RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return.CVE-2026-14324...

OESA-2026-3114 pipewire security update

is a server and user space API to deal with multimedia pipelines,contains command line utilities. Security Fixes: RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return.CVE-2026-14324...

SUSE CVE-2026-15793

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

SUSE CVE-2026-16493

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

EUVD-2026-48434

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...

PT-2026-64261

Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...

PT-2026-64235

Exim before 4.99.5 allows .forward privilege escalation because force command for a pipe transport is mishandled...

PT-2026-64373

Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The size guard 'Elixir.Bandit.WebSocket.Connection':oversize message?/2 called from handle frame/3 in...

PT-2026-64232

Name of the Vulnerable Software and Affected Versions OpenStack Ironic Python Agent versions prior to 11.6.1 Description A project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent. This occurs because the value of the ntp server variable is...

LWIS Kernel Driver Out-Of-Bounds Write

The lwis driver provides an interface for writing data to dma-buf objects via the LWISIOENTRYWRITETOBUFFER command. In lwisiobufferwrite, the driver performs a memcpy from a kernel-allocated copy of user data into the kernel mapping of a dma-buf. The driver uses the offset and sizeinbytes fields...

Security update for PackageKit (moderate)

openSUSE security update: security update for packagekit ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21425-1 Rating: moderate References: bsc1263252 bsc1267250 Cross-References: CVE-2026-10294 CVSS scores: CVE-2026-10294 SUSE : 4.3...

PT-2026-64378

Name of the Vulnerable Software and Affected Versions sysPass versions prior to 3.2.12 Description Authenticated administrators can execute arbitrary commands as the web server process user by configuring a malicious backup path and triggering a backup. The FileBackupService constructs a tar shel...

KLA91173 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Denial ...

Security update for perl-XML-Bare (moderate)

openSUSE security update: security update for perl-xml-bare ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21435-1 Rating: moderate References: bsc1271637 bsc1271640 Cross-References: CVE-2026-13401 CVE-2026-57074 CVSS scores: CVE-2026-13401 SUSE :...

Security update for ImageMagick (important)

openSUSE security update: security update for imagemagick ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21426-1 Rating: important References: bsc1268878 bsc1271484 bsc1271485 bsc1271486 bsc1271487 bsc1271488 bsc1271489 bsc1271490 bsc1271491...

Security update for net-tools (low)

openSUSE security update: security update for net-tools ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21429-1 Rating: low References: bsc1254323 Cross-References: CVE-2024-58251 CVSS scores: CVE-2024-58251 SUSE : 2.8...

Security update for perl (important)

openSUSE security update: security update for perl ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21411-1 Rating: important References: bsc1266304 bsc1266361 bsc1268349 bsc1271372 bsc1271386 Cross-References: CVE-2025-15649 CVE-2026-12087...

Security update for joe (important)

openSUSE security update: security update for joe ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21408-1 Rating: important References: bsc1269379 Cross-References: CVE-2026-13412 CVSS scores: CVE-2026-13412 SUSE : 7.8...

Security update for jline3 (important)

openSUSE security update: security update for jline3 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21423-1 Rating: important References: bsc1269021 bsc1270083 Cross-References: CVE-2026-56740 CVE-2026-56741 CVSS scores: CVE-2026-56740 SUSE : 7.5...