147538 matches found
April 14, 2026-KB5082420 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 24H2
None None...
JLSEC-2026-111 Deno's --deny-write check does not prevent permission bypass
Summary Deno.FsFile.prototype.utime and Deno.FsFile.prototype.utimeSync are not limited by the permission model check --deny-write=./. It's possible to change to change the access atime and modification mtime times on the file stream resource even when the file is opened with read only permission...
JLSEC-2026-108 Deno's AES GCM authentication tags are not verified
Summary This affects AES-256-GCM and AES-128-GCM in Deno, introduced by commit 0d1beed. Specifically, the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks the guarantees expected from AES-GCM. Older versions of Deno...
Security update for go1.25
This update for go1.25 fixes the following issues: Update to go1.25.9 bsc1244485. CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG bsc1261653. CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination bsc1261654. CVE-2026-27144: cmd/compile: no-op...
Security update for go1.26
This update for go1.26 fixes the following issues: Update to go1.26.2 bsc1255111. CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG bsc1261653. CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination bsc1261654. CVE-2026-27144: cmd/compile: no-op...
Security update for sudo
This update for sudo fixes the following issue: CVE-2026-35535: Fixed potential privilege escalation when running the mailer bsc1261420. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can ru...
SUSE CVE-2026-1502
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...
Important: Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update
An update for golang-github-openprinting-ipp-usb is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...
BELL-CVE-2026-31405
Bulletin has no description...
BELL-CVE-2026-23468
Bulletin has no description...
BELL-CVE-2026-23422
Bulletin has no description...
BELL-CVE-2026-31415
Bulletin has no description...
MINI-P4WV-5VFV-7P4P
Bulletin has no description...
CVE-2026-39425
MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting XSS vulnerability that allows authenticated users to inject arbitrary HTML and JavaScript into the Application prologue Opening Remarks field by wrapping malicious payloads in tags...
GHSA-3JP4-MHH4-GCGR Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler
Summary The SAML authentication success handler in Kimai returns the RelayState POST parameter as a redirect destination without validating the host or scheme. After a user successfully authenticates via SAML, they are redirected to an attacker-controlled URL if the IdP includes a malicious...
EUVD-2026-22813
Sigstore Timestamp Authority has Improper Certificate Validation in verifier...
CVE-2026-21712 affecting package nodejs24 for versions less than 24.14.1-1
CVE-2026-21712 affecting package nodejs24 for versions less than 24.14.1-1. An upgraded version of the package is available that resolves this issue...
EUVD-2026-22122
A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. Performing a manipulation results in sandbox issue. The attack can be...
CVE-2026-39423
Summary (CVE-2026-39423) MaxKB (enterprise open‑source) × affected version: 2.7.1 and earlier. A vulnerability in the Markdown rendering engine enables an Eval Injection that lets any user in the AI chat interface execute arbitrary JavaScript in other users’ browsers, including administrators, le...