CVE-2026-80701

A flaw was found in the Linux kernel's drm/vmwgfx component. A local attacker with DRM master privileges could exploit this by providing oversized cursor dimensions through the DRMIOCTLMODECURSOR2 interface. This improper input validation can lead to a kernel crash, resulting in a Denial of Servi...

iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

CVE-2026-83492 WordPress Kubio AI Website Builder - Denial Of Service

Improper input validation vulnerability in Extend Themes Kubio AI Website Builder. This issue affects Kubio AI Website Builder: before 2.9.1...

EUVD-2026-68616

Improper input validation vulnerability in Extend Themes Kubio AI Website Builder. This issue affects Kubio AI Website Builder: before 2.9.1...

CVE-2026-83492

Extend Themes Kubio AI Website Builder (a WordPress plugin) is affected by an improper input validation vulnerability in versions prior to 2.9.1 . The flaw allows a high-privilege attacker to trigger a denial of service condition over the network with low complexity and no user interaction, resul...

CVE-2026-83492 WordPress Kubio AI Website Builder - Denial Of Service

Improper input validation vulnerability in Extend Themes Kubio AI Website Builder. This issue affects Kubio AI Website Builder: before 2.9.1...

SUSE-SU-2026:23375-1 Security update for the Linux Kernel RT (Live Patch 20 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-42.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie bsc1270023 - CVE-2026-53246: sctp: validate cached peer INIT chunk length in...

SUSE-SU-2026:23378-1 Security update for the Linux Kernel RT (Live Patch 23 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-46.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie bsc1270023 - CVE-2026-53246: sctp: validate cached peer INIT chunk length in...

SUSE-SU-2026:23420-1 Security update for the Linux Kernel (Live Patch 18 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-41.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie bsc1270023 - CVE-2026-53246: sctp: validate cached peer INIT chunk length in...

SUSE-SU-2026:23418-1 Security update for the Linux Kernel (Live Patch 16 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-39.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie bsc1270023 - CVE-2026-53246: sctp: validate cached peer INIT chunk length in...

SUSE-SU-2026:3901-1 Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.6.3. - CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775...

SUSE-SU-2026:3895-1 Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.5.5. - CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775...

Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.4.6. CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775. Patch Instructions: To install this SUSE update use the SUSE recommended installatio...

Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 3.3.22. CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775. Patch Instructions: To install this SUSE update use the SUSE recommended installati...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

SUSE-SU-2026:3883-1 Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276667...

CVE-2026-76985

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings...

CVE-2026-76986

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no choice is selected — into the markup as it is, while every...

CVE-2026-62380

A flaw was found in the Netty SOCKS client encoders. This vulnerability allows a remote attacker to inject null bytes or Carriage Return Line Feed CRLF characters into domain address and authentication fields due to insufficient validation. By manipulating these fields, an attacker can truncate o...

CVE-2026-78077

CVE-2026-78077 is a Stored Cross-Site Scripting (XSS) vulnerability in the Joomla extension Helix Ultimate (by joomshaper.com) versions below 2.2.10 . The flaw resides in the MegaMenu Layout Container and Embed Inputs , where unsanitized column and item configuration values stored in the MegaMenu...