SUSE-SU-2026:23212-1 Security update for python311

This update for python311 fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1502: HTTP client proxy tunnel headers not validated for...

CVE-2026-45126: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

CVE-2026-61331: Improper Access Control

Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite component: Common Components. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-45129: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-45127: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...

CVE-2026-45119: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-74895

opensslencrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules...

CVE-2026-74885

opensslencrypt versions before 1.4.0 contain a logging bug in restorehiddenmodules that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another threa...

CVE-2026-74872 openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

opensslencrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in...

CVE-2026-74872: Untrusted Search Path

opensslencrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in...

GHSA-XPHW-4F88-5F39 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-transfer-fips, grafana-alloy-fips, crossplane-provider-aws-datapipeline, crossplane-provider-aws-cognitoidentity, dynamic-localpv-provisioner, rancher-agent, rancher-pushprox, yunikorn-web-fips, seaweedfs-rocksdb-fips,...

GO-2024-2937 vulnerabilities

Vulnerabilities for packages: hugo, ollama, hugo-extended, chainctl, gotenberg...

GO-2024-2453 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ec2, crossplane-provider-aws-kms, skaffold, terragrunt, spire-server-fips, crossplane, sops, boring-registry, actions-runner-controller, crossplane-provider-family-aws, flux-notification-controller, melange, policy-controller,...

GO-2026-4867 vulnerabilities

Vulnerabilities for packages: gitlab-pages, cni-plugins, percona-server-mongodb-operator, tetragon, vault-env, falco-no-driver, hey, howdy-yall, nri-mssql, buf, telegraf, prometheus, tkn, datadog-agent, helm, aws-application-networking-k8s, kubeflow-katib, docker-cli, nats-top, go,...

GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-lambda, grafana-alloy, crossplane-provider-aws-memorydb, crossplane-provider-aws-route53, crossplane-provider-aws-sqs, crossplane-provider-aws-firehose, crossplane-provider-azure-sql, nuclei, datadog-agent, crossplane-provider-aws-eks,...

GO-2024-2887 vulnerabilities

Vulnerabilities for packages: yq, terragrunt, cert-manager-webhook-pdns, cert-exporter, temporal, nri-mssql, dagdotdev, aactl, kyverno-policy-reporter-ui, croc, newrelic-infrastructure-agent, helm-push, gh, overmind, gitness, dask-gateway, mc, nri-redis, terraform, newrelic-infra-operator,...

CVE-2026-19785: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be...

UBUNTU-CVE-2026-56864

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

CVE-2026-56865

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that...

EUVD-2026-58514

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...