SUSE-SU-2026:1173-1 Security update for LibVNCServer

This update for LibVNCServer fixes the following issues: - CVE-2026-32853: crafted FramebufferUpdate message can lead to information disclosure or denial of service bsc1260431. - CVE-2026-32854: crafted HTTP requests can cause a denial of service bsc1260429...

USN-8144-1 undertow vulnerability

It was discovered that Undertow incorrectly validated the Host header in incoming HTTP requests. A remote attacker could possibly use this issue to gain unintended access to user sessions...

USN-8144-1: Undertow vulnerability

It was discovered that Undertow incorrectly validated the Host header in incoming HTTP requests. A remote attacker could possibly use this issue to gain unintended access to user sessions...

Permissive Cross-domain Policy with Untrusted Domains

Overview vanna is a Generate SQL queries from natural language Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via CORS misconfiguration in the FastAPI/Flask server components. An attacker can cause unauthorized cross-domain requests by...

Belden Hirschmann HiOS Switch Platform 安全漏洞

The Belden Hirschmann HiOS Switch Platform is an industrial Ethernet switch operating system platform developed by the American company Belden. Versions prior to 09.4.05 and 10.3.01 of the Belden Hirschmann HiOS Switch Platform contained security vulnerabilities. These vulnerabilities stemmed fro...

WordPress plugin Webmention 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

PT-2026-29894

Name of the Vulnerable Software and Affected Versions HiOS Switch Platform versions 09.1.00 through 09.4.04 and version 10.3.01. Description The HiOS Switch Platform contains a denial-of-service issue in the web interface. Remote attackers can reboot the affected device by sending a malicious HTT...

Apache Traffic Server 安全漏洞

Apache Traffic Server ATS is a scalable HTTP proxy and caching server developed by the Apache Foundation in the United States. There are security vulnerabilities in Apache Traffic Server versions 9.2.12 and earlier, as well as 10.1.1 and earlier versions. These vulnerabilities stem from an error ...

Docker Desktop < 4.67.0 SSRF

The version of Docker Desktop is prior to 4.67.0. It is therefore affected by a server-side request forgery vulnerability. - Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model, Model Runner follows the realm URL from the registry’s...

Docker Desktop < 4.67.0 SSRF (CVE-2026-33990)

The version of Docker Desktop installed on the remote host is prior to 4.67.0. It is, therefore, affected by a server-side request forgery SSRF vulnerability: - Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model, Model Runner follows t...

Devolutions Server < 2026.1.12 Multi-Factor Authentication Vulnerabilities (DEVO-2026-0010)

The version of Devolutions Server installed on the remote host is prior to 2026.1.12. It is, therefore, affected by multiple vulnerabilities: - Improper access control in the multi-factor authentication MFA management API allows an authenticated attacker to delete their own configured MFA factors...

MCP Go SDK 安全漏洞

MCP Go SDK is an open-source development toolkit for the Model Context Protocol. Versions of MCP Go SDK prior to 1.4.0 contained security vulnerabilities. These vulnerabilities stemmed from the default lack of DNS rebinding protection, allowing malicious websites to bypass the same-origin policy...

PT-2026-29849

A critical HTTP authentication bypass CVE-2026-34121 has been identified in TP-Link devices, potentially allowing unauthorized access. Technical Breakdown Vulnerability Type: Authentication Bypass Impact: Allows an attacker to circumvent HTTP authentication mechanisms on affected TP-Link devices,...

CVE-2026-34384

Admidio is an open-source user management solution. Prior to version 5.0.8, the createuser, assignmember, and assignuser action modes in modules/registration.php approve pending user registrations via GET request without validating a CSRF token. Unlike the deleteuser mode in the same file which...

Server-side Request Forgery (SSRF)

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the upload endpoint. An attacker can cause the server to initiate unauthorized outbound HTTP requests to arbitrary URLs by...

Payload has Authenticated SSRF via Upload Functionality

Impact An authenticated Server-Side Request Forgery SSRF vulnerability existed in the upload functionality. Authenticated users with create or update access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs. Consumers are affected if ALL of...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the TCPConnector function. An attacker can cause excessive memory consumption by making requests to a very large number of hosts, leading to resource exhaustion. Remediation Upgrad...

GHSA-C65F-X25W-62JV openssl-encrypt has CORS wildcard with allow_credentials=True in standalone servers

Summary Both standalone servers configure CORS with alloworigins="", allowcredentials=True, allowmethods="", and allowheaders="". Affected Code python server/key-server/app/main.py:86-92 server/telemetry-server/app/main.py:23-29 app.addmiddleware CORSMiddleware, alloworigins=settings.corsorigins,...

Use of GET Request Method With Sensitive Query Strings

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Insertion of Sensitive Information Into Sent Data

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...