actix-session-surrealdb (>=0.1.0 <=0.1.5) potentially affected by unknown CVE via surrealdb (=1.0.0-beta.9)

surrealdb CARGO version =1.0.0-beta.9 is affected by a known vulnerability. The following packages have a transitive dependency on surrealdb and may be impacted: - actix-session-surrealdb =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: OSV:GHSA-XX7M-69FF-9CRP...

openmls (>=0.4.0-pre.1 <=0.4.0-pre.2), openmls_evercrypt (>=0.1.0-pre.1 <=0.1.0-pre.2) +2 more potentially affected by unknown CVE via hpke-rs (=0.1.2)

hpke-rs CARGO version =0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on hpke-rs and may be impacted: - openmls =0.4.0-pre.1, =0.1.0-pre.1, =0.1.0, =0.3.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0069...

SUSE CVE-2026-1584

A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key PSK binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and...

@authnlabs/authn (>=1.0.10 <=1.0.18), @s-ui/sui-tool-app (>=1.5.0 <=1.27.0) potentially affected by unknown CVE via @capgo/capacitor-native-biometric (>=5.1.1 <=6.0.4)

@capgo/capacitor-native-biometric NPM version =5.1.1, =1.0.10, =1.5.0, =1.27.0 Source cves: unknown CVE Source advisory: OSV:GHSA-VX5F-VMR6-32WF...

a-gpt (>=0.1.0 <=0.4.0), abacuz (=0.1.1) +1061 more potentially affected by unknown CVE via git2 (>=0.10.0 <=0.1.21)

git2 CARGO version =0.10.0, =0.1.0, =1.1.0, =0.0.1, =0.3.0, =1.0.0, =0.1.0, =0.3.3 - amisgitpm =0.0.1 - amp =0.6.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-J39J-6GW9-JW6H...

hpke-rs (>=0.1.0-pre.1 <=0.1.0-pre.2), openmls (>=0.4.0-pre.1 <=0.4.0-pre.2) +2 more potentially affected by unknown CVE via hpke-rs-rust-crypto (=0.1.1)

hpke-rs-rust-crypto CARGO version =0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on hpke-rs-rust-crypto and may be impacted: - hpke-rs =0.1.0-pre.1, =0.4.0-pre.1, =0.1.0, =0.3.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-00...

SUSE CVE-2026-1767

A flaw was found in the GNOME localsearch previously known as tracker-miners MP3 Extractor tracker-extract-mp3 component. A remote attacker could exploit this heap buffer overflow vulnerability by providing a specially crafted MP3 file containing malformed ID3 tags. This incorrect length...

01os (>=0.0.1 <=0.0.14), aaf (>=0.3.5 <=0.3.9) +598 more potentially affected by unknown CVE via litellm (>=1.0.0 <=1.80.11)

litellm PYPI version =1.0.0, =0.0.1, =0.3.5, =0.1.0, =0.4.0, =0.8.1, =0.1.0, =0.1.39, =0.2.1, =0.1.0, =0.14.1a0, =0.4.1, =0.1.0, =0.4.0 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-LITELLM-15170825...

aperture-shared (=0.1.0), assemblylift-awslambda-host (>=0.2.0 <=0.3.0) +98 more potentially affected by unknown CVE via capnp (>=0.0.1 <=0.23.2)

capnp CARGO version =0.0.1, =0.2.0, =0.3.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.0.1, =0.1.0, =0.0.1, =0.4.0, =0.5.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5W5R-MF82-595P...

@saltcorn/cli (>=1.1.1 <=1.4.1-beta.3), @saltcorn/mobile-builder (>=1.1.1 <=1.4.1-beta.3) potentially affected by unknown CVE via @saltcorn/server (>=1.1.1 <=1.4.1)

@saltcorn/server NPM version =1.1.1, =1.1.1, =1.1.1, =1.4.1-beta.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15126139...

@bcswaper/apis (>=1.0.0 <=1.0.138), @bcswaper/engine (>=1.0.0 <=1.0.60) +5 more potentially affected by unknown CVE via @dydxprotocol/v4-client-js (>=1.0.17 <=1.22.0)

@dydxprotocol/v4-client-js NPM version =1.0.17, =1.0.0, =1.0.0, =1.0.0, =3.0.3, =1.0.5, =0.2.1, =0.2.6 Source cves: unknown CVE Source advisory: SNYK:JS-DYDXPROTOCOLV4CLIENTJS-15244901...

dydx-trading-sdk (>=0.1.1 <=0.1.5), locast (>=0.1.0 <=0.1.9) +1 more potentially affected by unknown CVE via dydx-v4-client (=1.1.6)

dydx-v4-client PYPI version =1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on dydx-v4-client and may be impacted: - dydx-trading-sdk =0.1.1, =0.1.0, =0.1.1, =1.0.7 Source cves: unknown CVE Source advisory: SNYK:PYTHON-DYDXV4CLIENT-15244902...

libcrux-kem (>=0.0.2 <=0.0.2-beta.3), libcrux-psq (=0.0.2-beta.3) potentially affected by unknown CVE via libcrux-ecdh (>=0.0.2-beta.3 <=0.0.2)

libcrux-ecdh CARGO version =0.0.2-beta.3, =0.0.2, =0.0.2-beta.3 - libcrux-psq =0.0.2-beta.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0023...

CVE-2026-22993

In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL ptr issue after soft reset During soft reset, the RSS LUT is freed and not restored unless the interface is up. If an ethtool command that accesses the rss lut is attempted immediately after reset, it will...

actix-session-surrealdb (>=0.1.0 <=0.1.5) potentially affected by unknown CVE via surrealdb (=1.0.0-beta.9)

surrealdb CARGO version =1.0.0-beta.9 is affected by a known vulnerability. The following packages have a transitive dependency on surrealdb and may be impacted: - actix-session-surrealdb =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: OSV:GHSA-3V2X-9XCV-2V2V...

CVE-2026-0907

Incorrect security UI in Split View in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

scalyc (>=0.0.2 <=0.0.5) potentially affected by unknown CVE via scaly (>=0.0.2 <=0.0.5)

scaly CARGO version =0.0.2, =0.0.2, =0.0.5 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0080...

@daffaadev/baileys (=1.0.1), @daffaadev/baileyss (=1.0.0) potentially affected by unknown CVE via @daffadeveloper/signal-node (=0.0.1-security)

@daffadeveloper/signal-node NPM version =0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @daffadeveloper/signal-node and may be impacted: - @daffaadev/baileys =1.0.1 - @daffaadev/baileyss =1.0.0 Source cves: unknown CVE Source advisory:...

@veramo/kv-store (>=6.0.0 <=6.0.2-next.57) potentially affected by unknown CVE via @veramo/core-types (>=6.0.0 <=6.0.2-next.57)

@veramo/core-types NPM version =6.0.0, =6.0.0, =6.0.2-next.57 Source cves: unknown CVE Source advisory: SNYK:JS-VERAMOCORETYPES-15032936...

SUSE CVE-2025-59464

A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. When applications call socket.getPeerCertificatetrue, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through...