CVE-2026-25145

melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file e.g., through pull request-driven CI or build-as-a-service scenarios could read arbitrary files from the host system. The...

CVE-2026-25145 melange has a path traversal in license-path which allows reading files outside workspace

melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file e.g., through pull request-driven CI or build-as-a-service scenarios could read arbitrary files from the host system. The...

melange has a path traversal in license-path which allows reading files outside workspace

An attacker who can influence a melange configuration file e.g., through pull request-driven CI or build-as-a-service scenarios could read arbitrary files from the host system. The LicensingInfos function in pkg/config/config.go reads license files specified in copyright.license-path without...

MAL-2025-2972 Malicious code in license-txt (PyPI)

--- -= Per source details. Do not edit below this line.=-...

openSUSE Security Update : cfitsio (openSUSE-2018-383)

This update for cfitsio fixes the following issues : Security issues fixed : - CVE-2018-1000166: Unsafe use of sprintf can allow a remote unauthenticated attacker to execute arbitrary code boo1088590 This update to version 3.430 also contains a number of upstream bug fixes. The following tracked...

Security update for cfitsio (important)

This update for cfitsio fixes the following issues: Security issues fixed: - CVE-2018-1000166: Unsafe use of sprintf can allow a remote unauthenticated attacker to execute arbitrary code boo1088590 This update to version 3.430 also contains a number of upstream bug fixes. The following tracked...

rsyslog security, bug fix, and enhancement update

5.8.10-2 - add patch to update information on debugging in the man page Resolves: 820311 - add patch to prevent debug output to stdout after forking Resolves: 820996 - add patch to support ssl certificates with domain names longer than 128 chars Resolves: 822118 5.8.10-1 - rebase to rsyslog 5.8.1...