SUSE CVE-2026-62425

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

CVE-2026-48487

A flaw was found in Zeroconf, a Python library for multicast DNS service discovery. An unauthenticated attacker on the local network can exploit a vulnerability in how the system processes incoming DNS records. By sending a specially crafted record with an excessive length, the attacker can cause...

firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: DNS component...

CVE-2026-51268

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2025-37785

creationtimestamp| type| source ---|---|--- 2026-07-28 16:18:37+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04...

CVE-2025-21938

creationtimestamp| type| source ---|---|--- 2026-07-28 16:17:59+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04...

CVE-2024-58056

creationtimestamp| type| source ---|---|--- 2026-07-28 16:16:32+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04...

CVE-2026-41637

A flaw was found in Unbound, a Domain Name System DNS resolver. A remote attacker can exploit this vulnerability by sending and immediately terminating DNS-over-QUIC DoQ queries. This improper handling of terminated queries can lead to a build-up of pending responses, causing a degradation of...

CVE-2026-64278

A flaw was found in the Linux kernel's i2c: imx-lpi2c driver. During system suspend and resume operations, certain I2C client drivers may attempt to perform I2C transfers while the underlying hardware resources are temporarily unavailable. This can occur because the I2C adapter is not properly...

Security update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn

This update for apache-commons-lang3, google-guice, maven, maven-resolver, xmvn fixes the following issues: apache-commons-lang3 was updated to 3.20.0: New features: Add SystemProperties.getPathString, Supplier Add JavaVersion.JAVA25 Add JavaVersion.JAVA26 Add SystemUtils.ISJAVA25 Add...

K000162478: PostgreSQL vulnerability CVE-2026-6637

Security Advisory Description Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint"...

CVE-2026-7521

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

EUVD-2026-49852

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

CVE-2026-7521 SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

CVE-2026-7521 SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

MINI-5F8F-PXR7-F44P

Bulletin has no description...

MINI-C245-VHC2-3J3X

Bulletin has no description...

MAL-2026-11135 Malicious code in ethers-secure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa36b9a8ec228142a26760738fbbca9c72f9634ed0abedb9d5beeae6a2441244 Package name mimics the popular ethers library. Its exported wallet API WalletClient/createWalletClient/parseAccount accepts an Ethereum private key...

MAL-2026-11152 Malicious code in tidal-embed-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005d40bc86aa5e012bfb9a0cd23cf5de5c4d93b1f65880b2273b8708891fa7e5 package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo.username,...

MAL-2026-11153 Malicious code in triage_bot_using_sdkv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed39efd544cae19da3ed546fecb2383729aef637bf623e00a9cf02f1f8ded05c package.json registers a preinstall hook that runs index.js on npm install. index.js collects os.hostname, os.userInfo, home directory, DNS server...