SUSE-SU-2026:22297-1 Security update for glib-networking

This update for glib-networking fixes the following issue - CVE-2026-10028: two certificates which are each signed by the other can lead to an infinite loop bsc1267979...

CVE-2024-58351

creationtimestamp| type| source ---|---|--- 2026-06-20 16:09:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moqakzjajf2b 2026-06-21 03:00:16+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3morewulhnb2f...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apache Tomcat

No d...

CVE-2026-48908

creationtimestamp| type| source ---|---|--- 2026-06-20 13:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mopxorztly2f 2026-06-20 13:30:35+00:00| seen| https://infosec.exchange/users/offseq/statuses/116782676365105563 2026-06-20 13:39:57+00:00| seen|...

CVE-2026-48908

CVE-2026-48908 affects the Joomla extension SP Page Builder (com_sppagebuilder). Reports and PoCs confirm unauthenticated file upload via the asset.uploadCustomIcon task, allowing arbitrary files to be written to the webroot and potentially executing PHP code. Affected versions are 1.0.0 through ...

CVE-2026-11911

creationtimestamp| type| source ---|---|--- 2026-06-20 10:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mopnmxu4ut2i 2026-06-20 10:30:34+00:00| seen| https://infosec.exchange/users/offseq/statuses/116781968685290768 2026-06-20 11:49:52+00:00| seen|...

SUSE-SU-2026:22189-1 Security update for perl-HTML-Parser

This update for perl-HTML-Parser fixes the following issue - CVE-2026-8829: HTML:Entities versions before 3.84 for Perl read freed heap memory in decodeentities bsc1267606...

BELL-CVE-2026-48930

Bulletin has no description...

SUSE CVE-2026-54274

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1...

SUSE CVE-2026-54531

pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerability is fixed in 6.13.0...

CVE-2026-53532

creationtimestamp| type| source ---|---|--- 2026-06-20 02:01:08+00:00| seen| https://bsky.app/profile/slackers.it/post/3moor6754ks2n...

CVE-2026-56213

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsertversionmeta SECURITY DEFINER function exposed via PostgREST RPC, allowing unauthenticated attackers to insert arbitrary rows into versionmeta for any appid. Attackers can exploit this by calling the RPC...

CVE-2026-11551

creationtimestamp| type| source ---|---|--- 2026-06-20 00:00:39+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mookgqp4bp2f 2026-06-20 00:00:46+00:00| seen| https://infosec.exchange/users/offseq/statuses/116779492087943579 2026-06-20 01:01:06+00:00| seen|...

CVE-2008-2474

creationtimestamp| type| source ---|---|--- 2026-06-19 23:37:05+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mooj4nccpj24...

CVE-2026-48772

creationtimestamp| type| source ---|---|--- 2026-06-19 22:12:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mooef5dho623 2026-06-20 04:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116780553070568538 2026-06-20 04:30:28+00:00| seen|...

Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions

Summary network-ai's ApprovalInbox lib/approval-inbox.ts is a shipped, exported, documented feature — "a web-accessible approval queue with REST API … and SSE streaming" SECURITY.md. It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit huma...

GHSA-JVCM-F35G-W78P Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

Summary AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling path such as /tmp/network-ai-sandboxevil/secret.txt. An agent/user that can call...

GHSA-2FMP-9RVW-HC96 Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

Summary EnvironmentManager.listBackups reads each backup's manifest.json and trusts the manifest's path field. EnvironmentManager.pruneBackups later passes that trusted entry.path directly to rmSyncentry.path, recursive: true, force: true . An attacker who can place or modify a manifest inside...

CVE-2026-56081 Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email

Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account, the attacker gains control over the account...

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Overview CoreWCF.Primitives is a port of the service side of Windows Communication Foundation WCF to .NET Core. The goal of this project is to enable existing WCF services to move to .NET Core. Affected versions of this package are vulnerable to Selection of Less-Secure Algorithm During Negotiati...