cn.ibizlab.plugin:ibiz-dataflow-flink (>=8.1.0.371, <=8.1.0.567.22), cn.sliew:flinkful-cli-descriptor-examples (>=1.0.2, <=1.0.7) +193 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (>=1.15.0, <=1.20.3)

org.apache.flink:flink-table-runtime MAVEN version =1.15.0, =8.1.0.371, =1.0.2, =1.0.3, =1.0.0, =1.0.2, =0.5.0, =0.5.0, =1.4.0, =1.4.0, =1.6.1, =1.4.0, =0.1.45, =0.1.47 - com.daasyyds.flink:flink-sql-analyzer 1.15.1-2022.07.1 and more Source cves: CVE-2026-35194 Source advisory: GHSA-2F54-V4HM-FX...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the SQL code generation process. An attacker can execute arbitrary code on TaskManagers by submitting specially crafted SQL queries that exploit improper escaping of user-controlled strings in generated Java...

com.datasqrl.flinkrunner:stdlib-json (>=0.9.0-alpha1, <=0.9.0-alpha2), com.datasqrl:sqrl-discovery (>=0.9.0-alpha1, <=0.9.0-alpha2) +15 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (>=2.1.0, <=2.1.1)

org.apache.flink:flink-table-runtime MAVEN version =2.1.0, =0.9.0-alpha1, =0.9.0-alpha1, =0.9.0-alpha1, =0.9.0-alpha1, =0.5.1-1-flink-2.1, =26.0.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.1 and more Source cves: CVE-2026-35194 Source advisory: OSV:GHSA-2F54-V4HM-FX73...

org.apache.doris:flink-doris-connector-2.0 (>=26.0.0, <=26.3.0), org.apache.flink:flink-examples-table_2.12 (>=2.0.0, <=2.0.1) +6 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (>=2.0.0, <=2.0.1)

org.apache.flink:flink-table-runtime MAVEN version =2.0.0, =26.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1 Source cves: CVE-2026-35194 Source advisory: OSV:GHSA-2F54-V4HM-FX73...

org.apache.doris:flink-doris-connector-2.0 (>=26.0.0, <=26.3.0), org.apache.flink:flink-examples-table_2.12 (>=2.0.0, <=2.0.1) +6 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (>=2.0.0, <=2.0.1)

org.apache.flink:flink-table-runtime MAVEN version =2.0.0, =26.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1 Source cves: CVE-2026-35194 Source advisory: GHSA-2F54-V4HM-FX73...

org.apache.doris:flink-doris-connector-2.0 (>=26.0.0, <=26.3.0), org.apache.flink:flink-examples-table_2.12 (>=2.0.0, <=2.0.1) +6 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (>=2.0.0, <=2.0.1)

org.apache.flink:flink-table-runtime MAVEN version =2.0.0, =26.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1 Source cves: CVE-2026-35194 Source advisory: SNYK:JAVA-ORGAPACHEFLINK-16799797...

cn.ibizlab.plugin:ibiz-dataflow-flink (>=8.1.0.371, <=8.1.0.567.22), cn.sliew:flinkful-cli-descriptor-examples (>=1.0.2, <=1.0.7) +193 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (>=1.15.0, <=1.20.3)

org.apache.flink:flink-table-runtime MAVEN version =1.15.0, =8.1.0.371, =1.0.2, =1.0.3, =1.0.0, =1.0.2, =0.5.0, =0.5.0, =1.4.0, =1.4.0, =1.6.1, =1.4.0, =0.1.45, =0.1.47 - com.daasyyds.flink:flink-sql-analyzer 1.15.1-2022.07.1 and more Source cves: CVE-2026-35194 Source advisory:...

com.datasqrl.flinkrunner:stdlib-json (>=0.9.0, <=0.10.1), com.datasqrl:sqrl-discovery (>=0.9.0, <=0.10.4) +18 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (2.2.0)

org.apache.flink:flink-table-runtime MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.flink:flink-table-runtime and may be impacted: - com.datasqrl.flinkrunner:stdlib-json =0.9.0, =0.9.0, =0.9.0, =0.9.0, =2.2.0-exness-0.1,...

com.datasqrl.flinkrunner:stdlib-json (>=0.9.0, <=0.10.1), com.datasqrl:sqrl-discovery (>=0.9.0, <=0.10.4) +18 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (2.2.0)

org.apache.flink:flink-table-runtime MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.flink:flink-table-runtime and may be impacted: - com.datasqrl.flinkrunner:stdlib-json =0.9.0, =0.9.0, =0.9.0, =0.9.0, =2.2.0-exness-0.1,...

com.datasqrl.flinkrunner:stdlib-json (>=0.9.0, <=0.10.1), com.datasqrl:sqrl-discovery (>=0.9.0, <=0.10.4) +18 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (2.2.0)

org.apache.flink:flink-table-runtime MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.flink:flink-table-runtime and may be impacted: - com.datasqrl.flinkrunner:stdlib-json =0.9.0, =0.9.0, =0.9.0, =0.9.0, =2.2.0-exness-0.1,...

com.datasqrl.flinkrunner:stdlib-json (>=0.9.0-alpha1, <=0.9.0-alpha2), com.datasqrl:sqrl-discovery (>=0.9.0-alpha1, <=0.9.0-alpha2) +15 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (>=2.1.0, <=2.1.1)

org.apache.flink:flink-table-runtime MAVEN version =2.1.0, =0.9.0-alpha1, =0.9.0-alpha1, =0.9.0-alpha1, =0.9.0-alpha1, =0.5.1-1-flink-2.1, =26.0.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.1 and more Source cves: CVE-2026-35194 Source advisory: GHSA-2F54-V4HM-FX73...

com.datasqrl.flinkrunner:stdlib-json (>=0.9.0-alpha1, <=0.9.0-alpha2), com.datasqrl:sqrl-discovery (>=0.9.0-alpha1, <=0.9.0-alpha2) +15 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (>=2.1.0, <=2.1.1)

org.apache.flink:flink-table-runtime MAVEN version =2.1.0, =0.9.0-alpha1, =0.9.0-alpha1, =0.9.0-alpha1, =0.9.0-alpha1, =0.5.1-1-flink-2.1, =26.0.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.1 and more Source cves: CVE-2026-35194 Source advisory: SNYK:JAVA-ORGAPACHEFLINK-16799797...

cn.ibizlab.plugin:ibiz-dataflow-flink (>=8.1.0.371, <=8.1.0.567.22), cn.sliew:flinkful-cli-descriptor-examples (>=1.0.2, <=1.0.7) +193 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (>=1.15.0, <=1.20.3)

org.apache.flink:flink-table-runtime MAVEN version =1.15.0, =8.1.0.371, =1.0.2, =1.0.3, =1.0.0, =1.0.2, =0.5.0, =0.5.0, =1.4.0, =1.4.0, =1.6.1, =1.4.0, =0.1.45, =0.1.47 - com.daasyyds.flink:flink-sql-analyzer 1.15.1-2022.07.1 and more Source cves: CVE-2026-35194 Source advisory:...

[SECURITY] [DLA 4585-1] firewalld security update

Debian LTS Advisory DLA-4585-1 [email protected] https://www.debian.org/lts/security/ Andreas Henriksson May 15, 2026 https://wiki.debian.org/LTS Package : firewalld Version : 0.9.3-2+deb11u1 CVE ID : CVE-2026-4948 Debian Bug : A flaw was found in firewalld where a local unprivileged us...

nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT

Impact A malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record containing a TaggedSigned with a signature field whose byte length is not exactly 64. When the victim node's DHT verifier calls TaggedSigned::verify, execution reaches...

org.apache.doris:flink-doris-connector-2.0 (>=26.0.0, <=26.3.0), org.apache.flink:flink-examples-table_2.12 (>=2.0.0, <=2.0.1) +6 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (>=2.0.0, <=2.0.1)

org.apache.flink:flink-table-runtime MAVEN version =2.0.0, =26.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1 Source cves: CVE-2026-35194 Source advisory: MEND:CVE-2026-35194...

cn.ibizlab.plugin:ibiz-dataflow-flink (>=8.1.0.371, <=8.1.0.567.22), cn.sliew:flinkful-cli-descriptor-examples (>=1.0.2, <=1.0.7) +193 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (>=1.15.0, <=1.20.3)

org.apache.flink:flink-table-runtime MAVEN version =1.15.0, =8.1.0.371, =1.0.2, =1.0.3, =1.0.0, =1.0.2, =0.5.0, =0.5.0, =1.4.0, =1.4.0, =1.6.1, =1.4.0, =0.1.45, =0.1.47 - com.daasyyds.flink:flink-sql-analyzer 1.15.1-2022.07.1 and more Source cves: CVE-2026-35194 Source advisory: MEND:CVE-2026-351...

com.datasqrl.flinkrunner:stdlib-json (>=0.9.0, <=0.10.1), com.datasqrl:sqrl-discovery (>=0.9.0, <=0.10.4) +18 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (2.2.0)

org.apache.flink:flink-table-runtime MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.flink:flink-table-runtime and may be impacted: - com.datasqrl.flinkrunner:stdlib-json =0.9.0, =0.9.0, =0.9.0, =0.9.0, =2.2.0-exness-0.1,...

com.datasqrl.flinkrunner:stdlib-json (>=0.9.0-alpha1, <=0.9.0-alpha2), com.datasqrl:sqrl-discovery (>=0.9.0-alpha1, <=0.9.0-alpha2) +15 more potentially affected by CVE-2026-35194 via org.apache.flink:flink-table-runtime (>=2.1.0, <=2.1.1)

org.apache.flink:flink-table-runtime MAVEN version =2.1.0, =0.9.0-alpha1, =0.9.0-alpha1, =0.9.0-alpha1, =0.9.0-alpha1, =0.5.1-1-flink-2.1, =26.0.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.1 and more Source cves: CVE-2026-35194 Source advisory: MEND:CVE-2026-35194...

Security update for firewalld

This update for firewalld fixes the following issue: CVE-2026-4948: local unprivileged users can modify the runtime firewall state without proper authentication due to D-Bus setter mis-authorizations bsc1260903. Patch Instructions: To install this SUSE update use the SUSE recommended installation...