CVE-2026-86494: Missing Authorization

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues...

CVE-2026-86489: Authorization Bypass Through User-Controlled Key

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...

CVE-2026-86174 Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

CVE-2026-80899

In the Linux kernel, the following vulnerability has been resolved: erofs: remove fscache backend entirely EROFS over fscache was introduced to provide image lazy pulling functionality. After the feature landed, the fscache subsystem made netfs a new hard dependency, which is unexpected for a loc...

GHSA-F6V4-57JR-PM94 vulnerabilities

Vulnerabilities for packages: chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-80899

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - erofs: remove fscache backend entirely EROFS over fscache was introduced to provide image lazy pulling functionality. After the feature landed, the fscache...

OPENSUSE-SU-2026:11690-1 python310-3.10.20-10.1 on GA media

These are all security issues fixed in the python310-3.10.20-10.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-89118

Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.2 Description A crafted image item containing a clap property and an ispe width or height greater than INT32 MAX + 1 can reach crop calculations through the heif image handle get image tiling function. The...

PT-2026-89119

Name of the Vulnerable Software and Affected Versions libheif versions 1.19.0 through 1.23.2 Description An integer overflow occurs in the unc decoder::get compressed image data uncompressed function within the no-icef full-item branch. This happens when a crafted uncompressed tile grid provides ...

PT-2026-85175

These are all security issues fixed in the glances-common-4.5.6-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-85176

These are all security issues fixed in the python313-aiosmtpd-1.4.6-6.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11672-1 libmsgpack-c2-7.0.2-2.1 on GA media

These are all security issues fixed in the libmsgpack-c2-7.0.2-2.1 package on the GA media of openSUSE Tumbleweed...

chromium -- security fixes

Chrome Releases reports: This update includes 26 security fixes: 522307103 Critical CVE-2026-84353: Use after free in Shared Tab Groups. 546260492 Critical CVE-2026-84352: Use after free in WebGL. 498839176 High CVE-2026-84354: Incorrect authorization in FileSystem. 514078656 High CVE-2026-84359:...

SUSE CVE-2026-74401

In the Linux kernel, the following vulnerability has been resolved: dlm: fix add msg handle in sendqueue ordered In a benchmark scenario triggering a lot of requests that triggers a lot of DLM messages on the network it can be that the mh-seq is not ordered according the oldest seq number. This...

OPENSUSE-SU-2026:20849-1 Security update for chromium

This update for chromium fixes the following issues: Changes in chromium: - Chromium 148.0.7778.215 boo1266471: CVE-2026-9872: Out of bounds write in GPU CVE-2026-9873: Use after free in Network CVE-2026-9874: Use after free in Dawn CVE-2026-9875: Out of bounds read in WebGL CVE-2026-9876: Use...

PT-2026-84368

These are all security issues fixed in the incus-7.4-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-83485

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.36.10 Envoy versions prior to 1.37.6 Envoy versions prior to 1.38.4 Envoy versions prior to 1.39.1 Description When Capsule Protocol is enabled, the HttpDatagramHandler caches the current RequestDecoder. During stream...

PT-2026-83488

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.36.10 Envoy versions prior to 1.37.6 Envoy versions prior to 1.38.4 Envoy versions prior to 1.39.1 Description The ext authz filter incorrectly assumes that a request always contains a :path pseudoheader when applying...

PT-2026-83490

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.36.10 Envoy versions prior to 1.37.6 Envoy versions prior to 1.38.4 Envoy versions prior to 1.39.1 Description Envoy fails to properly handle scoped IPv6 addresses when using Utility::copyInternetAddressAndPort and QU...

PT-2026-83493

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.36.10 Envoy versions prior to 1.37.6 Envoy versions prior to 1.38.4 Envoy versions prior to 1.39.1 Description Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates safe regex values using RE2's UTF-8...