CVE-2026-16350 vulnerabilities

Vulnerabilities for packages: firefox, firefox-esr...

CVE-2026-16354 vulnerabilities

Vulnerabilities for packages: firefox, firefox-esr...

GHSA-RJR7-JGGH-PGCP vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, telegraf, kyverno, karma...

CVE-2025-12506 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

SUSE CVE-2026-58059

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

SUSE CVE-2026-58061

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

SUSE CVE-2026-58216

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

SUSE CVE-2026-59645

In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcutil-fips 2.0.7 2.0.X series and 2.1.7 2.1.X series...

SUSE CVE-2026-59647

In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpkix-fips 1.0.12 1.0.X series, 2.0.12 2.0.X series and 2.1.12 2.1.X series...

SUSE CVE-2026-59652

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper...

Malicious code in lib-mtop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1dad2a69d97f4f14b77fdb334f860745feac703828131718a950a54b2d7cece Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11167 Malicious code in local-config-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa2dd509a9d17ced72d7119cf68768f7356d3f67af131e9cbe5bfe981a626ac4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-21959

creationtimestamp| type| source ---|---|--- 2026-07-28 16:18:01+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04...

CVE-2025-21925

creationtimestamp| type| source ---|---|--- 2026-07-28 16:17:54+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04...

CVE-2024-58020

creationtimestamp| type| source ---|---|--- 2026-07-28 16:16:29+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04...

CVE-2026-18047

Removed by vendor...

PoD: Don't try to reclaim special pages

ISSUE DESCRIPTION A guest started with Populated on Demand enabled PoD can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen. IMPACT A buggy or malicious guest can cause corruption of Xen's state, leading to crashes or other...

GHSA-C2RV-HWQM-WJPG vulnerabilities

Vulnerabilities for packages: opensearch...

USN-8547-2: Linux kernel (Azure FIPS) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - RISC-V architecture; - Cryptographic API; - InfiniBand drivers; - IOMMU subsystem; - Network drivers; -...

MAL-2026-11096 Malicious code in @vaultflow/create-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 427ce4e703502549a51bc970efc1001b50680261cf55483c4eb1ac7569f61d48 On require/import, the package's main module performs an HTTPS fetch to https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 a gist owned by...