OPENSUSE-SU-2026:10741-1 go1.26-1.26.3-1.1 on GA media

These are all security issues fixed in the go1.26-1.26.3-1.1 package on the GA media of openSUSE Tumbleweed...

PYSEC-2026-2157

A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of the component Grid File Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit h...

DEBIAN-CVE-2026-8213

A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of the component Grid File Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit h...

CVE-2026-8213 OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflow

A vulnerability has been found in OSGeo gdal up to 3.13.0dev-4. Affected by this issue is the function GDSDfldsrch of the file frmts/hdf4/hdf-eos/GDapi.c of the component Grid File Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit h...

CVE-2026-42606 AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass

AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to...

EUVD-2026-28933

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and...

Monero: wallet-rpc describe_transfer uses real_output_in_tx_index instead of real_output: cold-wallet pre-sign review shows wrong ring member

The wallet-rpc method "describetransfer" was found to use the wrong index when retrieving information about the ring members for each input. Instead of using the "realoutput" index, which represents the position of the real entry in the ring, it used the "realoutputintxindex", which represents th...

CVE-2026-8185 UGREEN CM933 Administrative missing authentication

A security vulnerability has been detected in UGREEN CM933 1.1.59.4319. The impacted element is an unknown function of the component Administrative Interface. Such manipulation leads to missing authentication. The attack requires being on the local network. You should upgrade the affected...

OPENSUSE-SU-2026:20710-1 Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: Changes in ffmpeg-4: - CVE-2025-59728: Fixed out-of-bounds NUL-byte write when calculating the content path in handling of MPEG-DASH manifests bsc1251137. - CVE-2025-7700: Fixed a NULL Pointer Dereference in the ALS Decoder bsc1246790 -...

mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node

...

CVE-2026-42308

Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0...

CVE-2026-42051

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0...

CVE-2026-4647 affecting package crash for versions less than 9.0.0-2

CVE-2026-4647 affecting package crash for versions less than 9.0.0-2. A patched version of the package is available...

CVE-2026-23374 affecting package kernel for versions less than 6.6.137.1-2

CVE-2026-23374 affecting package kernel for versions less than 6.6.137.1-2. A patched version of the package is available...

CVE-2026-33056 affecting package rpm-ostree for versions less than 2024.4-10

CVE-2026-33056 affecting package rpm-ostree for versions less than 2024.4-10. A patched version of the package is available...

CVE-2026-33056 affecting package clamav for versions less than 1.5.2-2

CVE-2026-33056 affecting package clamav for versions less than 1.5.2-2. A patched version of the package is available...

CVE-2026-32288 affecting package moby-engine for versions less than 25.0.3-17

CVE-2026-32288 affecting package moby-engine for versions less than 25.0.3-17. A patched version of the package is available...

CVE-2026-41989 affecting package libgcrypt for versions less than 1.10.3-2

CVE-2026-41989 affecting package libgcrypt for versions less than 1.10.3-2. A patched version of the package is available...

CVE-2026-27456 affecting package util-linux for versions less than 2.40.2-4

CVE-2026-27456 affecting package util-linux for versions less than 2.40.2-4. A patched version of the package is available...

EUVD-2026-28897

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.18.0, four GET endpoints under /api/templates in Arcane's Huma backend are registered without any Security requirement, allowing any unauthenticated network client to list and read the full...