GHSA-3F6R-V6W8-RW99 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-azure, linux-vmware, linux-qemu, linux-gcp...

GHSA-R46F-Q3F8-WRRG vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-gcp...

GHSA-X889-PRF3-G3VG vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu...

GHSA-6HVC-RWFC-MP4J vulnerabilities

Vulnerabilities for packages: linux-aws, linux-azure, linux-vmware, linux-qemu, linux-gcp...

Security update for the Linux Kernel (Live Patch 83 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.310 fixes various security issues The following security issues were fixed: CVE-2026-43037: ip6tunnel: clear skb2-cb in ip4ip6err bsc1265197. CVE-2026-45970: bonding: alb: fix UAF in rlbarprecv during bond up/down bsc1267206...

MGASA-2026-0256 Updated poppler packages fix a security vulnerability

The updated packages fix a security vulnerability: Integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication. CVE-2026-10118...

EUVD-2026-44837

A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file /webui/?g=logfwnbcmailjsondata. Executing a manipulation of the argument subject can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be...

CVE-2026-3842

A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpuphysicalmemorymap returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in...

ALSA-2026:40895 Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fixes: jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution...

The vulnerability of the CouchDbProducer class in the camel-couchbase framework of the Apache Camel framework allows a attacker to gain access to read, modify, or delete data.

The vulnerability of the CouchDbProducer class in the camel-couchbase framework of the Apache Camel framework is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to gain read, modify, or delete access to data...

CVE-2026-46709

creationtimestamp| type| source ---|---|--- 2026-07-15 23:10:54+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mqptrql7f623 2026-07-15 23:11:10+00:00| seen| https://mastodon.social/users/hugovalters/statuses/116926517721073292...

CVE-2026-55445

creationtimestamp| type| source ---|---|--- 2026-07-15 23:06:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqptj5juer2c 2026-07-16 00:38:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpyoz5fpx22 2026-07-16 01:30:26+00:00| seen|...

GHSA-R3HX-X5RH-P9VV django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization

Remote Code Execution via eval in Elasticsearch Result Deserialization Summary The Elasticsearch backend in django-haystack calls eval on raw field values returned from Elasticsearch when a SearchField is declared with an indexfieldname alias that differs from the logical field name. During resul...

GHSA-7GCF-G7XR-8HXJ serde_with: KeyValueMap serialization panics on empty sequence or map entries

Summary The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through serdeasas =...

libexpat: libexpat: Arbitrary code execution due to integer overflow

An integer overflow exists in libexpat's doProlog function due to improper handling of entity value lengths. A local attacker could exploit this to execute arbitrary code or access sensitive system data...

CVE-2026-62314

Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP...

GHSA-XV26-6W52-CPH6 websocket-driver: Message corruption via abuse of protocol length headers

Impact The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server pars...

CVE-2026-55398

creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:21+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpptm4mdb2w...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments

A flaw was found in Net::IMAP, a Ruby library that provides Internet Message Access Protocol IMAP client functionality. This vulnerability allows a remote attacker to inject arbitrary IMAP commands. This is achieved by passing specially crafted symbol arguments to IMAP commands. Successful...