CVE-2026-64551

CVE-2026-64551 concerns the Linux kernel SCTP stack. A vulnerability in the handling of an ERROR chunk with a STALE_COOKIE cause in the COOKIE_ECHOED state can cause an out-of-bounds read: the code reads the 4-byte Measure of Staleness from after the cause header, but the staleness field may not ...

CVE-2026-64551 sctp: validate STALE_COOKIE cause length before reading staleness

In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a STALECOOKIE cause is received in the COOKIEECHOED state, sctpsfdo526stale reads the 4-byte Measure of Staleness that follows the cause...

CVE-2026-56748

Cribl Stream (before 4.18.2) is affected by an improper validation of symbolic links in the Pack Git import feature. A remote authenticated attacker with Pack import and pipeline preview permissions can trigger arbitrary code execution as the Cribl server process by delivering a crafted Git repos...

EUVD-2026-49570

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link...

CVE-2026-56747 Code Injection in JSON Pointer Processing Component in Cribl Stream

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

EUVD-2026-49567

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

CVE-2026-56747

Cribl Stream before 4.18.2 is affected by an improper control of code generation in the JSON Pointer-to-accessor compiler. The vulnerability allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pa...

CVE-2026-12383

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

CVE-2026-12383

The CVE-2026-12383 entry describes a flaw in the Event-Driven Ansible (EDA) server where ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny] , authentication_classes=[] ), relying solely on the Subject header for mTLS authentication and not validating that th...

EUVD-2026-49406

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

CVE-2026-12383 Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

CVE-2026-12383 Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues: CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser bsc1268971. CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write bsc1268406...

SUSE-SU-2026:3299-1 Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues: - CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser bsc1268971. - CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write bsc1268406. -...

GO-2026-5047 Integer overflow in Avro decoder in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2

Several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets, the truncation paths can silently bypass byte-slice limits,...

Security update for python-Pillow

This update for python-Pillow fixes the following issues: CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. CVE-2026-54059: bomb protection bypass via PCF font loading due to Image.frombytes being called without decompressionbombcheck bsc1270409...

SUSE-SU-2026:3268-1 Security update for python-Pillow

This update for python-Pillow fixes the following issues: - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. - CVE-2026-54059: bomb protection bypass via PCF font loading due to Image.frombytes being called without decompressionbombcheck bsc1270409. -...

EUVD-2026-49109

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nlalen field is u16. Commit a1e64addf3ff "net: openvswitch: remove misbehaving actions length check" allowed the...

PT-2026-65226

In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALE COOKIE cause length before reading staleness When an ERROR chunk with a STALE COOKIE cause is received in the COOKIE ECHOED state, sctp sf do 5 2 6 stale reads the 4-byte Measure of Staleness that follows the...

PT-2026-65154

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 tvOS versions prior to 26.6 visionOS versions prior to 26.6 watchOS versio...