SUSE SLED15 / SLES15 Security Update : containerd (SUSE-SU-2026:4787-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4787-1 advisory. - CVE-2026-53488: CRI plugin propagates labels from an image config to a container without validation bsc1268430. Tenab...

ALSA-2026:88316 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113716 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113716 Source advisory: OSV:GHSA-CW65-GX24-RC82...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), microscopemetrics (0.2.4) +11 more potentially affected by CVE-2026-113724 via virtualenv (20.32.0)

virtualenv PYPI version 20.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - appcensus-dynamic-repos =2.0.113, =0.6.0, =1.0.0, =0.1.1, =0.5.4, =1.0.1, =1.0.119 Source cves: CVE-2026-113724 Source advisory:...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113724 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113724 Source advisory: OSV:GHSA-43MP-35Q3-X3FQ...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113722 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113722 Source advisory: OSV:GHSA-C978-59M8-C77V...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114144 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114144 Source advisory: MEND:CVE-2026-114144...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114143 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114143 Source advisory: MEND:CVE-2026-114143...

Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

Summary Image.merge checks the mode of every input band except band 0. If band 0 is a single-band I or F image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain Image.open followed by a load, and IPTC ha...

GHSA-CP9V-662Q-VVX9 Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

Summary Image.merge checks the mode of every input band except band 0. If band 0 is a single-band I or F image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain Image.open followed by a load, and IPTC ha...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114142 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114142 Source advisory: MEND:CVE-2026-114142...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114141 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114141 Source advisory: MEND:CVE-2026-114141...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +2666 more potentially affected by CVE-2026-112402 via pillow (12.3.0)

pillow PYPI version 12.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 3d-rcnet =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source...

DEBIAN-CVE-2026-111813

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users...

DEBIAN-CVE-2026-111804

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

CVE-2026-111804

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

CVE-2026-111813

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users...

UBUNTU-CVE-2026-111804

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

CVE-2026-111804

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

CVE-2026-111813

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users...