SUSE-SU-2026:21255-1 Security update for the Linux Kernel

The SUSE Linux Micro RT 6.0 and 6.1 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2024-38542: RDMA/manaib: boundary check before installing cq callbacks bsc1226591. - CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfsdcompare bsc124999...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007623)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007623 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix crash in nfsd4readrelease When tracing is enabled, the tracenfsdreaddone trace point...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007446)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007446 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: early: xhci-dbc: Fix a potential out-of-bound memory access If xdbcbulkwrite fails, the valu...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007589)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007589 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing/trigger: Fix to return error if failed to alloc snapshot Fix registersnapshottrigger to...

SUSE SLED15: himmelblau / himmelblau-sshd-config / libnss_himmelblau2 / etc (SUSE-SU-2026:1361-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1361-1 advisory. Update to version 2.3.9+git0.a9fd29b; jscPED-14511: - CVE-2026-34397: Fix LPE due to name collision during NSS...

SUSE-SU-2026:21123-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-38542: RDMA/manaib: boundary check before installing cq callbacks bsc1226591. - CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006705)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006705 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser-buffer when tracegetuser failed When the length of the string...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006667)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006667 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix the svcdeferredevent trace class Fix a NULL deref crash that occurs when an svcrqst i...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006637)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006637 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: Fix wild-memory-access in registersynthevent In registersynthevent, if...

CLSA-2026-1775224807 Fix of 95 CVEs

CVE-2025-39683 - tracing: Remove unneeded goto out logic CVE-2025-39683 - tracing: Limit access to parser-buffer when tracegetuser failed CVE-2025-39683 CVE-2025-38079 - crypto: algifhash - fix double free in hashaccept CVE-2025-38079 CVE-2025-38159 - wifi: rtw88: fix the 'para' buffer size to...

SUSE-FU-2026:20990-1 Feature update for himmelblau

This update for himmelblau fixes the following issues: Update to himmelblau 2.3.8 jscPED-14511: Security issues: - CVE-2025-54882: world readable cloud TGT token bsc1247735. - CVE-2025-58160: tracing-subscriber: Tracing log pollution bsc1249013. - CVE-2026-25727: time: parsing of user-provided...

CVE-2025-15381

A flaw was found in mlflow/mlflow. When the basic-auth application is enabled, tracing and assessment endpoints lack proper permission validation. This allows any authenticated user, even those without specific permissions on an experiment, to read sensitive trace information and create...

BIT-NATS-2026-33249 NATS: Message tracing can be redirected to arbitrary subject

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.11.0 and prior to versions 2.11.15 and 2.12.6, a valid client which uses message tracing headers can indicate that the trace messages can be sent to an arbitrary valid subject,...

openSUSE 16 Security Update : kernel (openSUSE-SU-2026:20416-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20416-1 advisory. The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues. The following security issues were fixed: - CVE-2025-39753:...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Contro...

GHSA-G6PG-52VF-843H MLFlow allows Tracing + Assessments Access

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere in the tracing and assessment endpoints. An attacker can access sensitive trace metadata and create unauthorized assessments by authenticating with any user...

MLFlow allows Tracing + Assessments Access

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

CVE-2025-15381

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

CVE-2025-15381

Affected software: mlflow/mlflow (deployments using mlflow server --app-name=basic-auth). Vulnerability: When the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators, allowing any authenticated user (including those with NO_PERMISSIONS on the exp...