SUSE CVE-2026-16371

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15...

SUSE CVE-2026-16379

Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

SUSE CVE-2026-16398

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the QUIC transport parameters extension handler during the processing of HelloRetryRequest messages. An attacker can cause increased memory consumption by repeatedly triggering...

Photon OS 5.0: Dnsmasq PHSA-2026-5.0-0914

An update of the dnsmasq package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0914. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

The vulnerability of the sk_mc_loop() function in the net/core/sock.c module exposes the support for networking functions in the Linux kernel, allowing attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the skmcloop function in the net/core/sock.c module related to Linux kernel network functions is associated with improper disabling or release of resources. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of...

PT-2026-64053

These are all security issues fixed in the distribution-registry-3.1.1-4.1 package on the GA media of openSUSE Tumbleweed...

The vulnerability of the sdio_release_func() function in the drivers/mmc/core/sdio_bus.c file of the MMC/SD/SDIO card driver module in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sdioreleasefunc function in the drivers/mmc/core/sdiobus.c file of the MMC/SD/SDIO card driver for the Linux operating system is related to errors during the update of the link counters. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the mtk_vcodec_probe() function in the driver/media/platform/mediatek/vcodec/mtk_vcodec_dec_drv.c file of the Linux operating system’s multimedia device drivers allows a hacker to cause a service failure.

The vulnerability of the mtkvcodecprobe function in the drivers/media/platform/mediatek/vcodec/mtkvcodecdecdrv.c driver for multimedia devices in Linux operating systems is related to improper disabling or release of resources. Exploiting this vulnerability can allow an attacker to cause service...

python313-bleach-6.4.0-1.1 on GA media (moderate)

python313-bleach-6.4.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11323-1 Rating: moderate Cross-References: CVE-2018-7753 CVE-2020-6802 CVE-2020-6816 CVE-2020-6817 CVE-2021-23980 CVSS scores: CVE-2021-23980 SUSE : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUS...

Important: java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixes: JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK: Enhance X...

CVE-2026-56444: Missing Release of Resource after Effective Lifetime

In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout discard-timeout 0' contrary to the suggested values, the discard-timeout branch during the serve expired logic drops an aged client reply without...

CVE-2026-63971

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A race condition exists in the sctpwaitforconnect function, where a socket lock is temporarily released and re-acquired. During this brief period, another process can move the SCTP association to a...

CVE-2026-47254

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, Track::initsampletimingtable in libheif/sequences/track.cc stores an out-of-bounds chunk index mchunks.size into mpresentationtimeline when the number of chunks defined in the stco box is less than the number of...

GHSA-Q423-49RW-G9MH Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

Summary GHSA-8fwc-qjw5-rvgp "Gitea may send release notification emails for private repositories to users whose access has been revoked", fix in PR 36319 / commit 8a98ac22 added repomodel.ClearRepoWatches as a defense for the state transition public→private. The cleanup was wired into...

EUVD-2026-46451

libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API heifimagehandlegetimagetiling when a malformed uncompressed HEIF image item has an associated uncC property but no associated ispe property. In debug builds this trips the ispe && uncC...

CVE-2026-63918

A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol l2tp module. A race condition exists where a network session's memory could be prematurely released while still in use. This vulnerability, caused by incorrect reference counting, may allow a local attacker to trigger a system cras...

Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

CVE-2026-47237

CVE-2026-47237 affects Kubeflow Community Distribution prior to version 26.03-rc.1. A Kubeflow setup based on official manifests or most packaged distributions is vulnerable to authorization token stealing from any Kubeflow UI/API user (Dashboard, Pipelines API, Notebooks). An attacker with kubef...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the web release edit process. An attacker can bypass configured file extension restrictions by renaming existing release attachments to forbidden extensions via the web interface, allowing the distribution ...