Security update for wireshark

This update for wireshark fixes the following issues: Update to version 4.6.7: CVE-2026-5299: ICMPv6 dissector crash bsc1263757. CVE-2026-5401: AFP dissector crash bsc1263756. CVE-2026-5402: TLS dissector crash and possible code execution bsc1263755. CVE-2026-5403: SBC audio codec crash bsc126376...

CVE-2026-56852

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

Unchecked Input for Loop Condition

Overview org.apache.qpid:proton-j is a lightweight messaging library. Affected versions of this package are vulnerable to Unchecked Input for Loop Condition via the disposition process. An attacker can cause excessive CPU usage and disrupt service availability by sending crafted frames with large...

Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition in the disposition process. An attacker can exhaust system resources by sending specially crafted frames with large or illegal ranges, resulting in excessive CPU usage. Remediation Upgrade...

Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition through the AMQP 1.0 disposition processing in Session10 and the delivery registry. An authenticated attacker can exhaust CPU by sending a disposition frame with a large or illegal delivery range, whic...

gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata parser

A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using reskippascalstring without validating that offsets remain...

gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata parser

A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using reskippascalstring without validating that offsets remain...

PT-2026-68131

Name of the Vulnerable Software and Affected Versions libkcapi affected versions not specified Description A flaw exists in the Asynchronous Input/Output AIO interface. A local attacker can cause an application or thread to become unresponsive by reusing an AIO-enabled handle after a completion...

Linux Distros Unpatched Vulnerability : CVE-2026-71227

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an AIO-enabled...

CVE-2026-70493

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...

CVE-2026-70493

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...

GHSA-73CQ-MCGH-379C Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

Summary In every affected release, automation recurrence parsing anchors minutely and hourly rules at a fixed date of 2000-01-01 and then walks forward one interval at a time to find the next run. A single FREQ=MINUTELY rule therefore enumerates roughly a quarter-century of occurrences,...

Regular Expression Denial of Service (ReDoS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the automation recurrence rule process. An attacker can cause the application to become unresponsive and deny service to all users by submitting specially...

CVE-2026-70489

Technical details about CVE-2026-70489 are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-52917

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/openwebui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to...

DoS (Denial of Service) immutable Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, and 11.1.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

Security update for google-guest-agent

This update for google-guest-agent fixes the following issue: CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead to infinite loop bsc1272118. Patch Instructions: To install this SUSE update use the SUSE recommended installation metho...

SUSE-SU-2026:3497-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issue - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead to infinite loop bsc1272118...

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issue: CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead to infinite loop bsc1272118. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

SUSE-SU-2026:3496-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issue - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead to infinite loop bsc1272118...