GitLab Workhorse HTTP Request Handler RCE

The vulnerability of GitLab Workhorse’s HTTP request handler, a software platform based on git for collaborative code development in GitLab CE/EE, relates to the disclosure of information during data transmission. Exploiting this vulnerability can allow an attacker to compromise the...

Google Chrome Downloads DoS

The vulnerability of the Downloads component in the Google Chrome browser is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Apache Log4j Core verifyHostName Man-in-the-Middle

The vulnerability of the verifyHostName configuration parameter in the Apache Log4j Core logging library is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” attack remotely...

Deep Learning for Cyber Threat Detection and Mitigation in Healthcare-IoT

Cybersecurity is a fundamental requirement for protecting wearable devices used in healthcare Internet of Things H-IoT systems. Security failures in these resource-constrained systems directly compromise patient safety. Physiological data and network traffic are frequent targets of cyberattacks i...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the TransferSubscriptions process. An attacker can cause a denial of service or potentially execute arbitrary code by sending specially crafted requests after authenticating. Remediation Upgrade open62541 to version...

CVE-2026-17655

An insufficient validation of untrusted input flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522556145...

CVE-2026-17779

An inappropriate implementation flaw was found in the Site Isolation component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513478933...

CVE-2026-17940

An insufficient validation of untrusted input flaw was found in the Picture-in-Picture component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514069440...

ECHO-CBB5-1EDE-A942

Bulletin has no description...

CVE-2026-55777

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...

DEBIAN-CVE-2026-54715

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. In version 1.10.2, parsebrowser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Age...

DEBIAN-CVE-2026-67550

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII...

RLSA-2026:47756 Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Rocky Linux...

SUSE CVE-2026-17940

Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-17999

Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-25779

Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirectto values...

SUSE CVE-2026-34454

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the session cookie when rendering the sign-in page. In deployments that rely on the sign-in page as part of their logout flow, a user may be...

SUSE CVE-2026-34605

SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the unauthenticated /api/icon/getDynamicIcon endpoint can be bypassed by using namespace-prefixed element names such as . The Go HTML5...

SUSE CVE-2026-40910

frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser...

SUSE CVE-2026-41646

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require function, bypassing the default local file acce...