CLSA-2026-1784900402 jsoup: Fix of CVE-2021-37714

CVE-2021-37714: fix uncontrolled recursion StackOverflow in HTML parser...

CVE-2026-45815

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response BLEATTOPREADMULTVARRSP may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through...

SUSE-SU-2026:3240-1 Security update for python-soupsieve

This update for python-soupsieve fixes the following issues - CVE-2026-49476: Memory Exhaustion via Large Comma-Separated Selector Lists bsc1271187. - CVE-2026-49477: Regular Expression Denial of Service ReDoS via Selector Parser bsc1271188...

SUSE-SU-2026:3239-1 Security update for python-soupsieve

This update for python-soupsieve fixes the following issues - CVE-2026-49476: Memory Exhaustion via Large Comma-Separated Selector Lists bsc1271187. - CVE-2026-49477: Regular Expression Denial of Service ReDoS via Selector Parser bsc1271188...

CVE-2026-45815

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response BLEATTOPREADMULTVARRSP may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through...

OESA-2026-3180 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

OESA-2026-3182 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

OESA-2026-3167 fluidsynth security update

FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use...

SUSE CVE-2026-63729

The SyncTeX parser synctexparser.c shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. ...

PT-2026-67251

Name of the Vulnerable Software and Affected Versions FluidSynth versions 2.5.0 through 2.5.5 Description The native DLS parser fails to verify if the multiplication and addition of the unsigned expression cues 4 + cbsize fit within 32 bits when validating ptbl chunks. An attacker can use a...

PT-2026-67611

Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser http/src/main/java/org/http4s/blaze/http/parser/ cause request-boundary disagreement with a stricter intermediary. All are reachable from a default BlazeServerBuilder with no non-default configuration. Impa...

PT-2026-71667

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description An unauthenticated remote attacker can cause a denial of service by sending repeated / sequences to the decode function within...

PT-2026-76593

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a...

CVE-2026-45815: Reachable Assertion

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response BLEATTOPREADMULTVARRSP may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through...

RDPEAR NDR RDP-client Parser DoS

The vulnerability of the RDPEAR NDR RDP-client FreeRDP lies in a memory reclamation error. Exploiting this vulnerability can allow an attacker to cause a service failure remotely...

PT-2026-67248

Name of the Vulnerable Software and Affected Versions FluidSynth versions 2.5.0 through 2.5.5 Description The SF2 parser in this software synthesizer fails to reject chunks smaller than one record when computing the DMOD modulator count. A specially crafted SF2 file with a zero-sized DMOD chunk...

PT-2026-67250

Name of the Vulnerable Software and Affected Versions FluidSynth versions 2.5.0 through 2.5.5 Description The native DLS parser fails to ensure that the multiplication and addition in the unsigned expression cbsize + connblocks 12 fit within 32 bits when validating articulation chunks. An attacke...

Security update for joe (important)

openSUSE security update: security update for joe ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21408-1 Rating: important References: bsc1269379 Cross-References: CVE-2026-13412 CVSS scores: CVE-2026-13412 SUSE : 7.8...

CVE-2026-50103

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value...

CVE-2026-50103 Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850

A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending a crafted GOOSE frame containing a malformed TLV value...