SUSE CVE-2026-44883

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer's authentication middleware accepts JWT bearer tokens passed...

SUSE CVE-2026-45148

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, broken access control in the searchAsset, searchTag, searchWidget, and searchTemplate publish-mode Readers can enumerate metadata from documents that are invisible to the publish service. This vulnerability is fixed in...

SUSE CVE-2026-48126

Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain or --letsencrypt, which silently turns on --domain at engine/flags.go:372, the request handler resolves the served directory by joining the configured --dir with the value of the...

SUSE CVE-2026-52801

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddres...

SUSE CVE-2026-55078

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, POST /api/v2/files converts zip uploads to tar in memory via CreateTarFromZip, which enforced a per-entry size limit but no...

SUSE CVE-2026-55415

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema...

SUSE CVE-2026-59247

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

EUVD-2026-50553

linuxfabrik-lib: fetch forwards credential headers across a cross-origin redirect...

CVE-2026-41186

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

Summary OliveTin's OAuth2 login handler stores per-login state in an in-memory map registeredStates that grows unboundedly. States are added on every /oauth/login request but are never deleted or expired. An unauthenticated attacker can send millions of requests to /oauth/login to fill the map wi...

EUVD-2026-50563

OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion Unbounded Map Growth...

GHSA-XPXJ-F2FM-RQCH OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

Summary OliveTin's OAuth2 login handler stores per-login state in an in-memory map registeredStates that grows unboundedly. States are added on every /oauth/login request but are never deleted or expired. An unauthenticated attacker can send millions of requests to /oauth/login to fill the map wi...

react-router: React Router: Open Redirect vulnerability via backslashes in navigation components

A flaw was found in React Router, a routing library for React applications. A remote attacker could exploit this vulnerability by crafting a malicious link that uses backslashes within the or useNavigate components. This could lead to an Open Redirect, allowing the attacker to redirect users to...

MINI-J3RR-48MM-CH3F

Bulletin has no description...

RLSA-2026:47757 Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Rocky Linux...

RLSA-2026:47755 Moderate: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Rocky Linux...

Cross Site Scripting

DOMPurify is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of cross-realm DOM elements in INPLACE mode, where elements from a different window or iframe bypass sanitization, allowing attackers to preserve and execute malicious JavaScript...

CVE-2026-64465

A flaw was found in the Linux kernel's USB xHCI eXtensible Host Controller Interface driver. When a USB device with active stream endpoints is disconnected, the system attempts to free stream resources while holding a lock with interrupts disabled. This can lead to a situation where a function th...

CVE-2022-4994

CVE-2022-4994 concerns a Linux kernel KVM/x86 issue where the fast IN path for in-kernel PIO was adjusted. The change routes fast PIO through __emulator_pio_in() directly instead of bouncing via emulator_pio_in(), since __emulator_pio_in() now fills the required value and vcpu->arch.pio.count ...

CVE-2022-4994

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: wean fast IN from emulatorpioin Use emulatorpioin directly for fast PIO instead of bouncing through emulatorpioin now that emulatorpioin fills "val" when handling in-kernel PIO. vcpu-arch.pio.count is guaranteed to be...