Security update for chromium (important)

openSUSE security update: security update for chromium ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21382-1 Rating: important References: bsc1271656 Cross-References: CVE-2026-15899 CVE-2026-15900 CVE-2026-15901 CVE-2026-15902 CVE-2026-15903...

Security update for cyrus-imapd (moderate)

openSUSE security update: security update for cyrus-imapd ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21368-1 Rating: moderate References: bsc1271617 bsc1271618 bsc1271619 bsc1271620 bsc1271621 bsc1271622 bsc1271623 bsc1271624 bsc1271625...

Security update for go1.26-openssl (important)

openSUSE security update: security update for go1.26-openssl ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21321-1 Rating: important References: bsc1245878 bsc1255111 bsc1264395 bsc1271014 bsc1271015 Cross-References: CVE-2026-39822 CVE-2026-42505...

CVE-2026-58503

Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via the resetpassword endpoint. This issue is fixed in versions 16.16.0 and 15.106.0...

PT-2026-57334

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.16.0 Frappe versions prior to 15.106.0 Description User enumeration is possible through the 'reset password' endpoint. User enumeration is a technique used to verify if a specific user exists within a system by...

CVE-2026-49866

CVE-2026-49866 affects the JavaScript libp2p implementation, specifically the @libp2p/gossipsub component. The root cause is defaultDecodeRpcLimits allowing maxIhaveMessageIDs and maxIwantMessageIDs to be Infinity prior to v16.0.0, enabling oversized IHAVE/IWANT control message arrays in message/...

PT-2026-56603

Name of the Vulnerable Software and Affected Versions libp2p versions prior to 16.0.0 Description In the @libp2p/gossipsub module, the defaultDecodeRpcLimits configuration sets maxIhaveMessageIDs and maxIwantMessageIDs to Infinity. This allows oversized IHAVE and IWANT control message arrays in...

EUVD-2026-40888

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blockid' and other shortcode attributes of the 'givewpcampaigncomments' shortcode in versions up to, and including, 4.16.0. This is due to insufficient input sanitizati...

CVE-2026-54414

FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint /api/folder/uploadToSharedFolder.php, leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEXFILENAME, which permit...

EUVD-2026-34008

wire-ios is an iOS client for the Wire secure messaging application. Prior to version 4.16.0, upon receiving a crafted malicious Proteus external message with an encrypted payload that is shorter than 16 bytes, the Wire iOS client crashes. The crash is triggered automatically after message receiv...

PT-2026-45830

wire-ios is an iOS client for the Wire secure messaging application. Prior to version 4.16.0, upon receiving a crafted malicious Proteus external message with an encrypted payload that is shorter than 16 bytes, the Wire iOS client crashes. The crash is triggered automatically after message receiv...

Security update for openjpeg2 (important)

openSUSE security update: security update for openjpeg2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20842-1 Rating: important References: bsc1247650 Cross-References: CVE-2025-54874 CVSS scores: CVE-2025-54874 SUSE : 7...

CVE-2026-42333

CVE-2026-42333 affects Quarkus OpenAPI Generator. The issue: the generated authentication filter can match OpenAPI path templates too broadly, causing a security scheme for one operation to be applied to a different, similarly-named operation. This can cause bearer tokens, API keys, or basic cred...

Security update for openexr (important)

openSUSE security update: security update for openexr ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20652-1 Rating: important References: bsc1262425 bsc1262426 Cross-References: CVE-2026-40244 CVE-2026-40250 CVSS scores: CVE-2026-40244 SUSE : 7.8...

Security update for libsodium (moderate)

openSUSE security update: security update for libsodium ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20642-1 Rating: moderate References: bsc1255764 bsc1256070 Cross-References: CVE-2025-15444 CVE-2025-69277 CVSS scores: CVE-2025-15444 SUSE : 6.8...

Security update for glibc (important)

openSUSE security update: security update for glibc ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20501-1 Rating: important References: bsc1258319 bsc1260078 bsc1260082 Cross-References: CVE-2026-4437 CVE-2026-4438 CVSS scores: CVE-2026-4437 SUSE ...

Security update for xwayland (important)

openSUSE security update: security update for xwayland ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20560-1 Rating: important References: bsc1260922 bsc1260923 bsc1260924 bsc1260925 bsc1260926 Cross-References: CVE-2026-33999 CVE-2026-34000...

PT-2026-32601

Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...

Security update for cockpit-repos (important)

openSUSE security update: security update for cockpit-repos ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20464-1 Rating: important References: bsc1258637 Cross-References: CVE-2026-26996 CVSS scores: CVE-2026-26996 SUSE : 7.5...

Security update for expat (important)

openSUSE security update: security update for expat ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20448-1 Rating: important References: bsc1259711 bsc1259726 bsc1259729 Cross-References: CVE-2026-32776 CVE-2026-32777 CVE-2026-32778 CVSS scores:...