SUSE-SU-2026:23085-1 Security update for the Linux Kernel (Live Patch 19 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-42.1 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. -...

SUSE-SU-2026:23015-1 Security update for the Linux Kernel (Live Patch 20 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-43.1 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060. -...

CVE-2026-64538

A flaw was found in the Linux kernel's IPv6 networking component. A null pointer dereference vulnerability exists in the fib6nhmtuchange function. This can occur when the idev in6device pointer is cleared during network interface shutdown, but the fib6nhmtuchange function attempts to dereference ...

@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition

Hi Novu team, Reporting an SSRF blocklist gap in the shared validateUrlSsrf guard. A complete self-contained reproduction is inlined below — copy the four files into a directory and run docker compose up, plus a single-file probe that runs against Node directly. Locally validated against HEAD...

Security update for the Linux Kernel (Live Patch 16 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.60 fixes various security issues: The following security issues were fixed: CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role bsc1270060. CVE-2026-53366: ipv4: account for fraggap on the paged...

MAL-2026-11144 Malicious code in react-puller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3ac07c0f6c79714a7b1f6bfd1272f9f7942cf0473875ca5276a1034c084f06d The package's postinstall hook runs node index.js, which spawns a detached worker that downloads two Windows executables CDPUserPlatform.exe and...

MAL-2026-11126 Malicious code in app-sim-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8470a75b327a72623ec4379302a2fc6ecdbaa302acf4fa1e39f1c688103562be package.json declares a postinstall hook that runs node test.js on npm install; test.js invokes fromstr2 and fromstr1 in index.js. fromstr2 fetches...

CVE-2026-54272

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery SSRF due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassificatio...

SUSE-SU-2026:3350-1 Security update for the Linux Kernel (Live Patch 42 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.172 fixes various security issues: The following security issues were fixed: - CVE-2026-43038: ipv6: icmp: clear skb2-cb in ip6errgenicmpv6unreach bsc1271648. - CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to...

CVE-2026-58404

A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings integer,...

USN-8615-1 linux, linux-aws, linux-aws-5.4, linux-aws-fips, linux-azure, linux-azure-5.4, linux-azure-fips, linux-bluefield, linux-fips, linux-gcp, linux-gcp-5.4, linux-gcp-fips, linux-hwe-5.4, linux-iot, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

USN-8615-1: Linux kernel vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

USN-8547-2: Linux kernel (Azure FIPS) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - RISC-V architecture; - Cryptographic API; - InfiniBand drivers; - IOMMU subsystem; - Network drivers; -...

Security update for the Linux Kernel (Live Patch 2 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.6 fixes various security issues: The following security issues were fixed: CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060...

CakePHP 5.4.1 Released

CakePHP 5.4.1 Released The CakePHP core team is happy to announce the immediate availability of CakePHP 5.4.1. This is a maintenance release for the 5.4 branch that fixes community reported issues, regressions and a security issue with RateLimitMiddleware. Thank you to yousukezan for reporting th...

Linux Distros Unpatched Vulnerability : CVE-2026-54272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through...

SUSE SLES15 Security Update : kernel (Live Patch 9 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3286-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3286-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.31 fixes various security issues: The following security issues were fixed: -...

SUSE SLES15 Security Update : kernel RT (Live Patch 15 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3248-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3248-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.54 fixes various security issues: The following security issues were fixed: -...

Server-side Request Forgery (SSRF)

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to insufficient validation in the Address6 class methods isLoopback, isLinkLocal, isMulticast, and...

@aikidosec/broker-client (>=1.0.47, <=1.0.49), @kirick/ip (0.2.1) +4 more potentially affected by CVE-2026-54272 via ip-address (>=10.1.1, <=10.2.0)

ip-address NPM version =10.1.1, =1.0.47, =0.6.0, =2.0.0, =0.1.3, =7.6.5-beta.0, =8.0.3 Source cves: CVE-2026-54272 Source advisory: SNYK:JS-IPADDRESS-18343249...