OPENSUSE-SU-2026:10988-1 perl-Protocol-HTTP2-1.130.0-1.1 on GA media

These are all security issues fixed in the perl-Protocol-HTTP2-1.130.0-1.1 package on the GA media of openSUSE Tumbleweed...

Microsoft Windows Push Notifications 竞争条件问题漏洞

Microsoft Windows Push Notifications is a push notification service provided by the American company Microsoft. It provides a reliable way to deliver new updates. There are compatibility issues with Microsoft Windows Push Notifications. The following products and versions are affected: Windows...

RHEL 9 : thunderbird (RHSA-2026:24721)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:24721 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Memory safety bugs fixed in Firefox ES...

PT-2026-48609

Name of the Vulnerable Software and Affected Versions gdk-pixbuf-loader-libheif versions prior to 1.23.0-2.1 Description Security issues were identified and resolved in the gdk-pixbuf-loader-libheif package. Recommendations Update to version 1.23.0-2.1...

OPENSUSE-SU-2026:10983-1 gdk-pixbuf-loader-libheif-1.23.0-2.1 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.23.0-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-48598

Name of the Vulnerable Software and Affected Versions libzypp versions prior to 17.38.13 Description An issue exists where .repo files can contain an optional path that may lead to path traversal attacks. Path traversal is a technique that allows an attacker to access files and directories that a...

FreeBSD Security Advisory - FreeBSD-SA-26:35.openssl

FreeBSD Security Advisory - Multiple issues have been reported as part of this advisory with different issues affecting different OpenSSL versions and therefore different FreeBSD versions...

PT-2026-48599

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.4.0 through 3.4.11 Description The HTJ2K High-Throughput JPEG 2000 decoder in OpenEXRCore contains a heap-buffer-overflow READ in the ht undo impl function. This occurs because the function copies decoded pixels from a...

CVE-2026-46384

An integer overflow flaw was found in Go Avro in decoding logic. Multiple decoder paths performs unsafe integer conversions and overflow-prone arithmetic operations on attacker-controlled values from Avro payloads. A remote attacker during Avro decoder operations could exploit this issue using...

CLEANSTART-2026-LU08936 Security fixes for ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x applied in versions: 1.8.2-r0

Multiple security vulnerabilities affect the fulcio package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-48114

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include...

OPENSUSE-SU-2026:10974-1 python311-pypdf-6.13.0-1.1 on GA media

These are all security issues fixed in the python311-pypdf-6.13.0-1.1 package on the GA media of openSUSE Tumbleweed...

Important: perl-Archive-Tar

Issue Overview: Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. makespecialfile passes the tar header's linkname to symlink without validating it against absolute paths or .. segments. The secure-extract mode check tha...

OPENSUSE-SU-2026:10965-1 ack-3.10.0-1.1 on GA media

These are all security issues fixed in the ack-3.10.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-11236

An insufficient policy enforcement flaw was found in the Web Bluetooth component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=496427030...

AlmaLinux 9 : kernel (ALSA-2026:21556)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:21556 advisory. kernel: proc: use the same treatment to check proclseek as ones for procreaditer et.al CVE-2025-38653 kernel: ima: don't clear IMADIGSIG flag when settin...

CVE-2026-11441 theonedev Pull Request issues canAccessIssue improper authorization

A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component Pull Request Handler. Such manipulation of the argument issue leads to improper authorization. It is possible to launch the attack remotely...

PT-2026-47165

Name of the Vulnerable Software and Affected Versions Onedev versions prior to 15.0.6 Description Improper authorization exists in the Pull Request Handler component within the /issues/ file. Specifically, the canAccessIssue function fails to properly validate the issue argument, allowing a remot...

RHEL 8 : openssh (RHSA-2026:22329)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22329 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files...

RHEL 9 : firefox (RHSA-2026:22410)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22410 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...