SUSE CVE-2026-67293

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...

SUSE-SU-2026:23136-1 Security update for python-ujson

This update for python-ujson fixes the following issue: - CVE-2026-44660: failing to decrement a serialized JSON object during a write exception in ujson.dump can lead to memory leaks bsc1270301...

SUSE-SU-2026:23047-1 Security update for runc

This update for runc fixes the following issues: - CVE-2026-41579: runc allows a malicious image with a /dev symlink to trigger limited host filesystem integrity violations bsc1268275. Changes for runc: - update to 1.3.6: Various integration test improvements. 5222, 5237, 5226, 5229, 5239, 5249,...

SUSE CVE-2025-65852

unknown...

SUSE CVE-2026-39824

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...

SUSE CVE-2026-42500

Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image...

SUSE CVE-2026-16526

A flaw in the PCP linuxsockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root...

SUSE CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

SUSE CVE-2026-55244

ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROMPY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Interpreter.eval, while run and eval in asteval/asteval.py catch Exception rather...

SUSE CVE-2026-67201

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...

SUSE SLES15 Security Update : python-sqlparse (SUSE-SU-2026:3434-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3434-1 advisory. This update for python-sqlparse fixes the following issue - Fixed an issue where formatting list of tuples leads to denial of service...

SUSE SLED15 / SLES15 Security Update : python-sqlparse (SUSE-SU-2026:3435-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3435-1 advisory. This update for python-sqlparse fixes the following issue - Fixed an issue where formatting list of tuples leads to...

SUSE SLED15 / SLES15 Security Update : runc (SUSE-SU-2026:3433-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3433-1 advisory. Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem...

openSUSE 16: ctdb / ctdb-pcp-pmda / ldb-tools / libldb-devel / libldb2 / etc (openSUSE-SU-2026:21475-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21475-1 advisory. - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. - CVE-2026-15779: pamwinbind module with...

SUSE CVE-2026-9672

unknown...

SUSE CVE-2026-17543

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

SUSE CVE-2026-17544

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...

SUSE CVE-2026-44945

A privilege escalation vulnerability exists in Rancher's impersonation middleware pkg/auth/requests/impersonate.go. An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it...

SUSE CVE-2026-51235

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

SUSE CVE-2026-55996

A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured,...