OPENSUSE-SU-2026:21486-1 Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.120. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

SUSE-SU-2026:3419-1 Security update for tomcat

This update for tomcat fixes the following issues: Update to Tomcat 9.0.120. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Other...

CVE-2026-35590

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in...

Linux Distros Unpatched Vulnerability : CVE-2026-35590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the ran...

PT-2026-52943

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A soft lockup occurs when opening /dev/sgX due to improper validation of the def reserved size module parameter. While the sg proc write dressz function enforces a size limit between 0 a...

RUSTSEC-2026-0186 Unchecked pointer offset in crate `memmap2`

Affected versionf of memmap2 did not perform enough validation on the offset and len parameters of Mmap::uncheckedadviserange, MmapMut::uncheckedadviseranage and MmapMut::flushasyncrange. This can cause undefined behavior due to invalid values being passed to pointer::offset and pointer::add when...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: The block range must be validated before being used in ext4mbclearbb. The block range to be freed is validated in ext4freeblocks, using ext4 inodeblockvalid, and then it is passed to ext4mbclearbb. However, in some cases on...

GHSA-V25J-WQCW-FVHJ wger has an Uncontrolled Resource Consumption issue

Summary Any authenticated user can create a routine spanning an arbitrarily long date range e.g. 100 years and then trigger the datesequence computation via any of the routine detail endpoints. The server iterates once per day in an unbounded while loop with no maximum duration validation, causin...

PT-2026-37469

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the Integrity Measurement Architecture IMA measurement buffer passed from a previous kernel may fall outside the addressable RAM of a new kernel when the second-sta...

ROS-20260505-73-0077

A vulnerability in the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address and ipaddress.IPv6Network classes of the ipaddress module of the Python programming language interpreter CPython is related to incorrect IP address range validation. Exploitation of the vulnerability could...

ROS-20260505-73-0079

A vulnerability in the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address and ipaddress.IPv6Network classes of the ipaddress module of the Python programming language interpreter CPython is related to incorrect IP address range validation. Exploitation of the vulnerability could...

ROS-20260505-73-0078

A vulnerability in the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address and ipaddress.IPv6Network classes of the ipaddress module of the Python programming language interpreter CPython is related to incorrect IP address range validation. Exploitation of the vulnerability could...

CVE-2026-5466

wolfSSL's ECCSI signature verifier wcVerifyEccsiHash decodes the r and s scalars from the signature blob via mpreadunsignedbin with no check that they lie in 1, q-1. A crafted forged signature could verify against any message for any identity, using only publicly-known constants...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.22 contained security vulnerabilities. These vulnerabilities stemmed from insufficient range validation in the device.pair.approve method, which could lead to privilege escalati...

SUSE CVE-2025-14443

A flaw was found in ose-openshift-apiserver. This vulnerability allows internal network enumeration, service discovery, limited information disclosure, and potential denial-of-service DoS through Server-Side Request Forgery SSRF due to missing IP address and network-range validation when processi...

OpenClaw 代码问题漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.2.22 had code vulnerabilities. These vulnerabilities stemmed from the incomplete validation of the IPv4 special-purpose range by the isPrivateIpv4 function, which could allow...

GO-2026-4578 openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References in github.com/openshift/openshift-apiserver

openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References in github.com/openshift/openshift-apiserver...

REVA 安全漏洞

REVA is an open-source data platform software developed by OpenCloud. Versions of REVA prior to 2.42.3 and 2.40.3 contained security vulnerabilities. These vulnerabilities were caused by a bypass in range validation of the GRPC authorization middleware, which could lead to the creation of archive...

PT-2026-5233

Name of the Vulnerable Software and Affected Versions soroban-sdk versions 22.0.9 through 25.0.1 soroban-sdk version 23.5.1 soroban-sdk version 25.0.2 Description The soroban-sdk contains an arithmetic overflow issue in the Bytes::slice, Vec::slice, and Prng::gen range for u64 methods. When...

Azure Linux 3.0 Security Update: kernel (CVE-2024-56663)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-56663 advisory. - In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix NL80211ATTRMLOLINKID...