Security update for xar (moderate)

openSUSE security update: security update for xar ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21153-1 Rating: moderate References: bsc1047874 bsc1047875 bsc1108595 bsc1108596 Cross-References: CVE-2017-11124 CVE-2017-11125 CVE-2018-17093...

Sentry: Improper authentication on SAML SSO process allows user identity linking

ImpactA critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program.The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sent...

TensorFlow has a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation

ImpactAttackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or RCE.When axis is larger than the dim of input, c-Diminput,axis goes out of bound.Same problem occurs in the QuantizeAndDequantizeV2/V3/V4/V4Grad...

PYSEC-2026-549 TensorFlow has a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation

Impact Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or RCE. When axis is larger than the dim of input, c-Diminput,axis goes out of bound. Same problem occurs in the QuantizeAndDequantizeV2/V3/V4/V4Gra...

TensorFlow has a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation

ImpactAttackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or RCE.When axis is larger than the dim of input, c-Diminput,axis goes out of bound.Same problem occurs in the QuantizeAndDequantizeV2/V3/V4/V4Grad...

PYSEC-2026-337 Use of hard-coded, security-relevant constants in deepset-ai/haystack

Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack in version 1.15.0 and prior. A patch is available at commit 5fc84904f198de661d5b933fde756aa922bf09f1...

LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

SummaryA serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data...

Qiskit allows arbitrary code execution decoding QPY format versions < 13

ImpactA maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats 13. A python process calling Qiskit's qiskit.qpy.load function could potentially execute any arbitrary Python code embedded in the correc...

Qiskit allows arbitrary code execution decoding QPY format versions < 13

ImpactA maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats 13. A python process calling Qiskit's qiskit.qpy.load function could potentially execute any arbitrary Python code embedded in the correc...

PYSEC-2026-511 Qiskit allows arbitrary code execution decoding QPY format versions < 13

Impact A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats 13. A python process calling Qiskit's qiskit.qpy.load function could potentially execute any arbitrary Python code embedded in the corre...

CVE-2026-13540

A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack i...

CVE-2026-13523 GPAC ISOBMFF base_encoding.c data amplification

A weakness has been identified in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/baseencoding.c of the component ISOBMFF Parser. Executing a manipulation can lead to highly compressed data. The attack needs to be launched locally. The exploit has been made available to the...

PT-2026-53618

Impact Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or RCE. When axis is larger than the dim of input, c-Diminput,axis goes out of bound. Same problem occurs in the QuantizeAndDequantizeV2/V3/V4/V4Gra...

PT-2026-53761

Name of the Vulnerable Software and Affected Versions Open Access Management OpenAM versions prior to 16.1.1 Description An improper authentication issue exists in the private key jwt client authentication path. The system uses ClientJwksResolverCache without reliably binding a cached jwks uri...

libxml2 security update

2.9.1-6.0.13.6 - Backport fix for CVE-2025-9714 Orabug: 39476695 2.9.1-6.0.11.6 - Fix CVE-2025-32415: Fix heap buffer overflow Orabug: 38310750 2.9.1-6.0.9.6 - Fix CVE-2025-7425: heap-use-after-free in xmlFreeID Orabug: 38290330 2.9.1-6.0.7.6 - Fix CVE-2025-6021, CVE-2025-32414, CVE-2025-49794,...

PT-2026-53653

A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4. Affected by this issue is the function BufWriter::append of the component EtherNet IP Message Handler. Performing a manipulation results in out-of-bounds write. Remote exploitation of the attack is...

PT-2026-53617

Impact Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or RCE. When axis is larger than the dim of input, c-Diminput,axis goes out of bound. Same problem occurs in the QuantizeAndDequantizeV2/V3/V4/V4Gra...

PT-2026-53619

Impact Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or RCE. When axis is larger than the dim of input, c-Diminput,axis goes out of bound. Same problem occurs in the QuantizeAndDequantizeV2/V3/V4/V4Gra...

PT-2026-53267

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.3.1 through 3.1.2 fast-uri version 4.0.0 Description The software fails to canonicalize Unicode Internationalized Domain Names IDN for HTTP-family URLs. This occurs because the IDN conversion path utilizes a helper missing...

PT-2026-53420

Impact S3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILES Depending on how files are handled, this may lead to...