CVE-2026-60651

CVE-2026-60651 affects Oracle WebCenter Content (Web Content Management) in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows an unauthenticated, network-accessible attacker (via HTTP) to compromise WebCenter Content; exploitation requires user in...

CVE-2026-60248

...

SUSE CVE-2026-50274

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or...

SUSE CVE-2026-54463

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions of the WebSocket protocol in websocket-driver include a length header that allows an arbitrarily large integer to be encoded as bytes with the high bit set, and a server or client can send an...

CVE-2026-57825

Unknown description...

CVE-2026-45094

Unknown description...

SUSE CVE-2026-54904

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReferenceupdate can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReferenceupdate, which retries until compareandsetoldvalue,...

@openinc/parse-server-opendash (>=3.31.25 <=4.0.34) potentially affected by unknown CVE via parse-server (>=9.6.0-alpha.37 <=9.9.0)

parse-server NPM version =9.6.0-alpha.37, =3.31.25, =4.0.34 Source cves: unknown CVE Source advisory: SNYK:JS-PARSESERVER-17420049...

SUSE CVE-2026-54282

Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating scheme://hostpath and re-parsing the result, a path that does not begin with / for example...

CVE-2026-39043

Unknown description...

SUSE CVE-2026-11791

A flaw was found in 389 Directory Server. During schema reload, the attrsyntaxswapht function unconditionally frees attribute syntax information nodes, bypassing the refcount-based deferred deletion used elsewhere in the attribute syntax subsystem. If an administrator triggers schema reload while...

CVE-2026-47165

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was originally designed to operate without a challenge–response authentication model. This has been changed in versions 6.9.13-48 an...

IMAPServer (=0.2.0), IMAPServer-cli (=0.1.0) +369 more potentially affected by unknown CVE via diesel (>=0.10.1 <=2.2.12)

diesel CARGO version =0.10.1, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.1.4, =0.1.11, =0.1.0, =0.5.0, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0172...

adx (>=4.0.0 <=4.1.0), aicommits-rs (>=0.1.0 <=0.2.0) +301 more potentially affected by unknown CVE via surf (>=1.0.1 <=2.3.2)

surf CARGO version =1.0.1, =4.0.0, =0.1.0, =1.0.0, =0.3.0, =0.10.0, =0.3.0, =0.5.0, =0.1.0, =0.6.0, =0.3.0, =0.1.0, =0.0.1, =0.2.4 - async-bybit =0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0169...

crypt_guard (=0.1.4), env_encryption_tool (=0.9.17) +7 more potentially affected by unknown CVE via pqcrypto (>=0.11.1 <=0.18.1)

pqcrypto CARGO version =0.11.1, =0.1.0, =0.1.0, =0.1.2, =0.1.0, =0.23.0, =0.23.0, =12.0.2 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0164...

@arc-laboratories/arclocale-compiler (=0.2.0-alpha.8), @iharkharytanovich/found (>=0.1.1 <=0.1.4) +8 more potentially affected by unknown CVE via ai-sdk-ollama (>=3.0.0 <=3.8.4)

ai-sdk-ollama NPM version =3.0.0, =0.1.1, =0.1.5, =0.4.2-canary-0ba39cdeb6, =0.1.303, =0.1.303, =0.1.303, =0.1.303, =0.4.2, =0.1.5, =1.1.0 Source cves: unknown CVE Source advisory: SNYK:JS-AISDKOLLAMA-17146454...

@redhat-cloud-services/frontend-components-config (>=6.0.0 <=6.2.10) potentially affected by unknown CVE via @redhat-cloud-services/tsc-transform-imports (=1.2.1)

@redhat-cloud-services/tsc-transform-imports NPM version =1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on @redhat-cloud-services/tsc-transform-imports and may be impacted: - @redhat-cloud-services/frontend-components-config =6.0.0, =6.2.10 Source...

edgetest (>=2026.4.0 <=2026.5.0), r7-surcom-sdk (>=0.12.15 <=0.14.16) +1 more potentially affected by unknown CVE via uv (>=0.10.0 <=0.10.7)

uv PYPI version =0.10.0, =2026.4.0, =0.12.15, =3.10.18, =3.10.21 Source cves: unknown CVE Source advisory: OSV:GHSA-4GG8-GXPX-9RPH...

dicom-transfer-syntax-registry (>=0.8.2 <=0.9.1), dset (>=0.1.0 <=0.1.2) +10 more potentially affected by unknown CVE via jxl-grid (>=0.1.1 <=0.5.3)

jxl-grid CARGO version =0.1.1, =0.8.2, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.5.0-rc0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0151...

SUSE CVE-2026-44168

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. No...