SUSE CVE-2026-52976

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix error cleanup in xeexecqueuecreateioctl Two error handling issues exist in xeexecqueuecreateioctl: 1. When xehwenginegroupaddexecqueue fails, the error path jumps to putexecqueue which skips xeexecqueuekill. If the VM...

SUSE CVE-2026-53043

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qrnumregions in dlmmatchregions Patch series "ocfs2/dlm: fix two bugs in dlmmatchregions". In dlmmatchregions, the qrnumregions field from a DLMQUERYREGION network message is used to drive loops over the...

SUSE CVE-2026-56766

Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an...

[SECURITY] Fedora 44 Update: pacemaker-3.0.2-3.fc44

Pacemaker is an advanced, scalable High-Availability cluster resource manager. It supports more than 16 node clusters with significant capabilities for managing resources and dependencies. It will run scripts at initialization, when machines go up or down, when related resources fail and can be...

PT-2026-53077

Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin versions prior to 23.7 Description Authenticated users with Subscriber-level access can delete arbitrary files on the server, including sensitive files like wp-config.php, which may lead to a full site takeover. Th...

EUVD-2026-39487

pnpm: stage download writes outside its destination directory via manifest name/version traversal...

EUVD-2026-39484

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes...

GHSA-W466-C33R-3GJP pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected fixed behavior, then use the detailed exploit narrative below only if you want to replay the original path. - Advisory: CAND-PNPM-063 / GHSA-w466-c33r-3gjp - Advisory URL:...

EUVD-2026-39483

pnpm: Repository-controlled configDependencies can select a pacquet native install engine...

pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

Summary Keep build approval for opaque dependency sources byte-exact for GHSA-5wx6-mg75-v57r / CAND-PNPM-123. Merged upstream commit bf1b731ee6 fixed the original name-only approval bypass by making build policy consume the resolved dependency identity. One collision remained: the generic...

EUVD-2026-39488

pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field...

GHSA-Q6XX-5VR8-P898 Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

Summary In nezha v1.14.13–v1.14.14 and v2.0.0–v2.0.9, the WebSocket endpoints GET /ws/terminal/:id and GET /ws/file/:id authenticate the caller only by the presence of a valid stream UUID, with no ownership check tying that UUID to the user who created the stream. Any authenticated dashboard user...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: vitess, flux-image-automation-controller-fips, grafana, seaweedfs-rocksdb-fips, gitlab-rails-ce, keda-fips, chisel-fips, argo-workflows-fips, opentelemetry-collector, flux-source-controller-fips, trivy-fips, argo-cd-fips, coder, gitlab-rails-ce-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-authorization, tekton-chains, kubescape, cert-manager, fulcio, glab, ksops, gatus, external-dns, flux-kustomize-controller, zot, argo-cd, buildkitd, ko, neuvector-sigstore-interface, rancher, kots, rootlesskit, k8sgpt, eksctl, syft, kaf,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-authorization, tekton-chains, kubescape, crossplane-provider-aws-cloudfront, cert-manager, crossplane-provider-aws-sqs, fulcio, glab, ksops, gatus, external-dns, flux-kustomize-controller, zot, argo-cd, buildkitd, ko,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: argocd-image-updater, cilium-cli, kyverno, containerd, gitea, helm, kine, kubescape, knative-serving, cert-manager, nerdctl, external-dns, snyk-cli, istio, zot, flux-image-automation-controller, flux-source-controller, trivy, k9s, trivy-operator, kubernetes-dashboard...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, cilium-cli, kyverno, containerd, gitea, helm, kine, kubescape, knative-serving, cert-manager, nerdctl, external-dns, snyk-cli, istio, zot, flux-image-automation-controller, flux-source-controller, trivy, k9s, trivy-operator, kubernetes-dashboard...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: kubescape, cert-manager, external-dns, zot, argo-cd, rancher, kots, syft, kaf, flux, prometheus-operator, terragrunt, telegraf, kyverno, helm, pulumi-kubernetes-operator, kine, apko, pulumi-language-dotnet, snyk-cli, buildah, podman, flux-source-controller,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: cilium-cli, kyverno, containerd, helm, kine, knative-serving, cert-manager, nerdctl, external-dns, snyk-cli, istio, buildah, podman, zot, kubernetes-dashboard, loki, aactl, opentelemetry-collector, cloud-provider-aws, rancher, cilium, kots, spire-server, kaf, flux,...

DEBIAN-CVE-2026-53309

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlmmatchregions region comparison The local-vs-remote region comparison loop uses '=' instead of '', causing it to read one entry past the valid range of qrregions. The other loops in the same functio...