56344 matches found
SUSE SLED15 / SLES15 Security Update : gd (SUSE-SU-2026:3553-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3553-1 advisory. This update for gd fixes the following issue: - CVE-2026-9672: security issues in libgd bsc1273101. Tenable has extract...
SUSE-SU-2026:23237-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-23259: iouring/rw: free potentially allocated iovec on cache put failure bsc1259866. - CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled...
SUSE-SU-2026:23231-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-23259: iouring/rw: free potentially allocated iovec on cache put failure bsc1259866. - CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled...
SUSE-SU-2026:23221-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-23259: iouring/rw: free potentially allocated iovec on cache put failure bsc1259866. - CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled...
SUSE-SU-2026:3589-1 Security update for python-pip
This update for python-pip fixes the following issue: - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to be installed to arbitrary locations on disk bsc1273090...
SUSE-SU-2026:3586-1 Security update for ImageMagick
This update for ImageMagick fixes the following issue: - CVE-2026-64685: heap buffer over-read in BGR decoder due to missing end-of-file check bsc1272953...
SUSE-SU-2026:3585-1 Security update for spice-vdagent
This update for spice-vdagent fixes the following issues: Security fixes: - CVE-2026-57965: integer overflow in udscswrite can lead to heap buffer overflow bsc1269553. - CVE-2026-57966: improper sanitization allows a compromised SPICE host to write arbitrary files to any location on the guest...
SUSE-SU-2026:23174-1 Security update for pcp
This update for pcp fixes the following issues: - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. - CVE-2026-16527: missing...
Security update for libpng16
This update for libpng16 fixes the following issues: Changes for libpng16: version update to 1.6.58 jscPED-16190. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed fo...
SUSE CVE-2026-23603
Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim...
SUSE CVE-2026-30246
Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request path and does not include the query string. As a result, requests for the same path with different query parameters can share a cache key...
SUSE CVE-2026-42931
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint...
SUSE CVE-2026-44517
Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left ...
SUSE CVE-2026-45045
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add instead of Header.Set when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream serve...
SUSE CVE-2026-49837
GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded b...
SUSE CVE-2026-49838
GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length ASPATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP...
SUSE CVE-2026-52845
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forwardauth copyheaders deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through phpfastcgi, Caddy normalizes HTTP headers int...
SUSE CVE-2026-55982
OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...