SUSE-SU-2026:23052-1 Security update for helm

This update for helm fixes the following issues Update to version 3.21.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266598. - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth:...

Security Bulletin:Pillow Integer Overflow Vulnerability Fixed in Version 12.2.0

Summary Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0. Vulnerability Details...

Denial Of Service (DoS)

nanoid is vulnerable to Denial Of Service. The vulnerability is due to an infinite loop in customAlphabet and customRandom when configured with a size of 0, allowing attacker-controlled input to hang the calling thread and cause application unavailability...

Amazon Linux 2 : unbound, --advisory ALAS2-2026-3849 (ALAS-2026-3849)

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3849 advisory. In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined with...

CVE-2026-67199: Allocation of Resources Without Limits or Throttling

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...

PT-2026-67900

Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...

PT-2026-67857

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.10.0 Description Automation recurrence parsing in backend/open webui/utils/automations.py anchors minutely and hourly rules to a fixed date of 2000-01-01. When calculating the next run, the system walks...

thrift: Apache Thrift: Denial of Service via infinite loop

A flaw was found in Apache Thrift, affecting its Python, Go, PHP, and Java components. This vulnerability, known as an 'Infinite Loop', could allow a remote attacker to disrupt service availability. By exploiting this flaw, an attacker can trigger a continuous loop, leading to a denial of service...

SUSE-SU-2026:23051-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of inpu...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

AZL-94532 CVE-2026-69152 affecting package nodejs-nodemon 2.0.3-5

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...

AZL-94526 CVE-2026-69152 affecting package js-jquery 3.5.0-4

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...

K000162734: Apache HTTP Server vulnerability CVE-2026-44186

Security Advisory Description Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in the modproxyftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version...

GHSA-RGW5-RVV9-X895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Summary The maxLength mitigation added in 5.0.8 for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It bounds the accumulator where results are combined, but not the intermediate arrays that feed it. A 25 KB input still crashes the Node process with an uncatchable out-of-memory error, so...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Summary The maxLength mitigation added in 5.0.8 for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It bounds the accumulator where results are combined, but not the intermediate arrays that feed it. A 25 KB input still crashes the Node process with an uncatchable out-of-memory error, so...

CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...

CVE-2026-69152

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/net-v0.47.0 which is vulnerable to CVE-2026-33814

Summary IBM Maximo Application Suite - Visual Inspection component uses golang.org/x/net-v0.47.0 which is vulnerable to CVE-2026-33814. This bulletin contains information regarding the vulnerability and its remediation Vulnerability Details CVEID:CVE-2026-33814 DESCRIPTION: When processing HTTP/2...

SUSE-SU-2026:23077-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of inpu...