PT-2026-88745

Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

PT-2026-88648

Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

Security update for curl

This update for curl fixes the following issues: CVE-2026-5773: wrong reuse of SMB connection bsc1262633. CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. CVE-2026-8926: password leak with netrc and user in URL bsc1268412. CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause a...

SUSE-SU-2026:4047-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926: password leak with netrc and user in URL bsc1268412. - CVE-2026-13608: flow in OpenLDAP SASL negotiation can...

CVE-2026-84173

In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a CompleteStateRequest or...

CVE-2026-84173

Eclipse Ankaios versions v0.5.1 through v1.0.1 contain an authorization flaw in the agent-side Control Interface authorizer . When a multi-segment allow rule begins with a wildcard (e.g., *.workloads.some_workload), an authenticated workload can submit a CompleteStateRequest or UpdateStateRequest...

CVE-2026-84173

In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a CompleteStateRequest or...

EUVD-2026-72323

In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a CompleteStateRequest or...

CVE-2026-84173

In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a CompleteStateRequest or...

CVE-2026-18149

undicis retry handler can leave an already-exposed response body pend...

PT-2026-86665

In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rules whose first path segment is a wildcard. An authenticated workload with access restricted by such a rule can submit a CompleteStateRequest or...

Linux Distros Unpatched Vulnerability : CVE-2026-80778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - futex/pi: Reject cross-mm private futex owners A private futex key borrows the waiter's mm without taking an mmusers reference. Nevertheless, attachtopiowner...

CVE-2026-80231

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting CURLSSLOPTNATIVECA than when the connection was created...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053320)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053320 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Update intermediate power state for SI Update the current state as boot state during...

SUSE CVE-2026-80828

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Complete cleanup after system-resume errors A failed system resume can leave the card unusable until reboot. usbaudioresume jumps to errout when sndusbpcmresume or sndusbmixerresume fails. The error path skips th...

SUSE CVE-2026-80875

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in TCP state lookup TCP state handling reparses the skb to find the TCP header. For IPv6 it uses sizeofstruct ipv6hdr, while the surrounding IPVS code already parsed the packet with ipvsfilliphsk...

CVE-2026-82712

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device...

GHSA-F2RW-W22V-54VH SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72797. Summary POST /api/notebook/getEncryptedNotebookStatus returns the identifier, name, and current lock state of every encrypted notebook, with no publish-access filtering. The route is registered CheckAuth only, no CheckReadonly, no...

CVE-2026-82712 Tycon Systems TPDIN-Monitor-WEB3 Cross-Site Request Forgery

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device...

CVE-2026-82712

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are affected by a cross-site request forgery (CSRF) flaw that allows an attacker to perform state-changing operations on the device, including factory resets , credential extraction, and data theft. The product is deployed in critical manu...