SUSE-SU-2026:4335-1 Security update for hplip

This update for hplip fixes the following issues: - CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions bsc1281303. - CVE-2026-91098...

buildkit: github.com/moby/buildkit: BuildKit: File escape vulnerability

A flaw was found in BuildKit. A custom client with valid permissions to access the BuildKit control API can produce an upload request that allows files to escape from the BuildKit-controlled state directory. This could lead to unauthorized modification or disclosure of sensitive data...

PT-2026-97736

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description Improper Access Control allows unauthorized access or modification of resources within the system. Recommendations Update to version 1.11.00.022 or later...

CVE-2026-95985: Inclusion of Functionality from Untrusted Control Sphere

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to...

PT-2026-98235

Name of the Vulnerable Software and Affected Versions ServiceNow AI Platform affected versions not specified Description A SQL injection issue exists in the ServiceNow AI Platform. This flaw allows an unauthenticated user to execute arbitrary SQL statements against the underlying database,...

CVE-2026-3253: Missing Authorization

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

CVE-2026-6718

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

CVE-2026-6718 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

CVE-2026-6718 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

CVE-2026-6718

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

EUVD-2026-85658

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

SUSE-SU-2026:23910-1 Security update for cjose

This update for cjose fixes the following issues: - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap-based buffer overflow bsc1279844. - CVE-2026-53939: zero-filled content-encryption key generation in AES-CBC-HMAC JWE encryption within cjose ca...

OPENSUSE-SU-2026:21944-1 Security update for cjose

This update for cjose fixes the following issues: - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap-based buffer overflow bsc1279844. - CVE-2026-53939: zero-filled content-encryption key generation in AES-CBC-HMAC JWE encryption within cjose ca...

CVE-2026-63132

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...

CVE-2026-86064 Klever-Go: /log controls global node logging

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in...

CVE-2026-18185

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

EUVD-2026-85351

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

CVE-2026-18185 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

CVE-2026-18185

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is affected by CVE-2026-18185 , which stems from missing authentication for a critical function (CWE-306). A remote attacker could exploit this flaw to access sensitive information and modify system configurations . The vulnerability im...

CVE-2026-18185 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...