SUSE-SU-2026:2968-1 Security update for python-Authlib

This update for python-Authlib fixes the following issues - CVE-2026-41425: Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starletteclient.OAuth bsc1263114. - CVE-2026-44681: Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's...

Security Advisory Ivanti Xtraction (CVE-2026-14902, CVE-2026-14903)

Last Modified Date 23 Aug 2026 21:09:38...

python-pillow: Pillow: Denial of Service via crafted GD 2.x image file

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile.open function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a...

Open Redirect

Overview @sap/approuter is a Node.js based application router Affected versions of this package are vulnerable to Open Redirect via improper validation of incoming request headers during the OAuth2 login flow. An attacker can redirect users to arbitrary external sites by crafting a malicious link...

GHSA-44P5-3M5G-VFHJ SAP Approuter has an Open Redirect vulnerability

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results...

SAP Approuter has an Open Redirect vulnerability

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to improper timeout management during network read operations in the receive loop. An attacker can cause the application to become unresponsive or crash by sending specially crafted network packets. Details...

EUVD-2026-43603

EIPStackGroup OpENer 2.3.0 commit 76b95cf has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing short malformed packets. An attacker can send a valid ENIP outer frame carrying a malformed CIP ForwardOpen/LargeForwardOpen request, causing the parser...

CVE-2026-44745

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2026-44745 for potential details on affected versions, remediation, and impact.

CVE-2026-44745 Open Redirect vulnerability in SAP Approuter

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results...

CVE-2026-48000: URL Redirection to Untrusted Site

Adobe Commerce is affected by an Improper Redirect Open Redirect vulnerability that could result in a Security feature bypass. An attacker could construct a malicious URL that redirects a victim to an attacker-controlled site. Exploitation of this issue requires user interaction in that a victim...

PT-2026-60062

Name of the Vulnerable Software and Affected Versions OpenCost affected versions not specified Description OpenCost contains an unauthenticated file write issue in the POST /serviceKey endpoint. The AddServiceKey function in pkg/costmodel/router.go accepts user-supplied data via the key parameter...

PT-2026-58777

Name of the Vulnerable Software and Affected Versions Magento Open Source affected versions not specified Adobe Commerce affected versions not specified Adobe Commerce B2B affected versions not specified Description An Improper Redirect Open Redirect issue exists where the software fails to...

On the Security Implications of PQC in TLS: Handshake Exhaustion and IDS Degradation

Post-Quantum Cryptography PQC is increasingly being integrated into TLS 1.3 to enhance resilience against quantum-enabled attacks. However, the additional computational and communication overhead introduced by PQC primitives during the handshake phase may also amplify the impact of TLS handshake...

ROS-20260714-73-0060

The vulnerability of the ngxhttpcharsetmodule module in NGINX Plus and NGINX Open Source web servers relates to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information or cause...

CVE-2026-14902: URL Redirection to Untrusted Site

An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs...

PT-2026-58925

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal...

The vulnerability of Ollama’s artificial intelligence-based web interface, Open WebUI, allows a hacker to gain unauthorized access to protected information.

The vulnerability of Ollama’s AI-based web interface, Open WebUI, is related to the lack of authentication during the processing of endpoints like /api/generate, /api/embed, /api/embeddings, and /api/show. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to...

PT-2026-59002

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

KLA91148 Multiple vulnerabilities in Microsoft Open Source Software

Multiple vulnerabilities were found in Microsoft Open Source Software. Malicious users can exploit these vulnerabilities to gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Windows Subsystem for Linux WSL2 Kernel can...