Security update for the Linux Kernel (Live Patch 46 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.184 fixes various security issues: The following security issues were fixed: CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1269284. CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk...

CVE-2026-53524

A flaw was found in WeeChat. An authenticated user of the relay module's WebSocket functionality can send a small compressed frame that, when decompressed, expands to a significantly larger size. This "decompression bomb" can exhaust all available server memory, leading to a Denial of Service DoS...

Security Bulletin: Langflow is affected by weaknesses in secret handling and sensitive configuration access

Summary Langflow includes features for secret protection, environment access, and runtime configuration of workflow components. Weaknesses in cryptographic key handling, exposure of process environment values, and insufficient restriction of sensitive runtime configuration fields could allow...

Security Bulletin: Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Summary Langflow OSS supports Agentic Assistant generated components and user-supplied custom Python components for workflow development. Weaknesses in code security scanning, runtime validation, custom component execution paths, and trusted code enforcement could allow authenticated users to...

Security update for the Linux Kernel (Live Patch 5 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.19 fixes various security issues: The following security issues were fixed: CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIEECHO processing bsc1253437 bsc1270023 bsc1270024...

Fake Microsoft security scans trick victims into uninstalling their antivirus

A wave of websites is offering to check whether your antivirus is working. They call themselves SysScan , carry Microsoft branding, and all reach the same conclusion: Your computer has serious problems, and the cause is the antivirus software you installed. Windows, they claim, no longer supports...

SUSE-SU-2026:23253-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent creation escapes the destination tree bsc1269043. -...

SUSE-SU-2026:23254-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent...

kernel: dlm: validate length in dlm_search_rsb_tree

A flaw was found in the Linux kernel's Distributed Lock Manager dlm module. An attacker could send specially crafted network messages with an oversized length parameter to the dlmdumprsbname function. This lack of validation can lead to an out-of-bounds write in the dlmsearchrsbtree function,...

kernel: selinux: fix overlayfs mmap() and mprotect() access checks

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...

CVE-2026-76843

The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodelfile and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...

CVE-2026-76842

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

MAL-2026-14410 Malicious code in @temptation.js/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b8ac41747a5c926627c28c9f1a651df91cd3447b07ca4cafabc1916004d1e70 The package registers a preinstall hook node index.js that runs on npm install and harvests installer-side data: os.hostname, OS username, home...

Malicious code in @temptation.js/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b8ac41747a5c926627c28c9f1a651df91cd3447b07ca4cafabc1916004d1e70 The package registers a preinstall hook node index.js that runs on npm install and harvests installer-side data: os.hostname, OS username, home...

CVE-2026-74681

A flaw was found in the Linux kernel's USB subsystem, specifically within the usbio module. An incorrect buffer size validation occurs in the usbiobulkmsg function, where the bulk IN receive buffer size is mistakenly compared against the bulk OUT endpoint size instead of the actual receive buffer...

CVE-2026-74660

A flaw was found in the Linux kernel's netfilter: ebtnflog component. This vulnerability occurs because the ebtnflog module does not properly manage references to the nfnetlinklog module. An attacker with the ability to configure ebtables rules could exploit this by causing an ebtables nflog rule...

CVE-2026-74603

A flaw was found in the Linux kernel's ptp: ocp module. This vulnerability occurs because the EEPROM board ID, a fixed-size field, is not guaranteed to be null-terminated. When this ID is processed as a C string, it may lead to an over-read beyond its intended memory boundary. This memory...

CVE-2026-68765

A flaw was found in hashcat. Attackers can exploit a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module by providing an oversized ninth hash field token. The module processes input up to 600 hexadecimal characters into a fixed 256-byte buffer without proper length validation...

nanoid: nanoid: Denial of Service via negative size input in non-secure module functions

A flaw was found in nanoid Nano ID, a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a negative size input to the customAlphabet or nanoid functions within the library's non-secure module. When a...

CVE-2026-76843

CVE-2026-76843 affects the official Flair wheels for versions 0.15.0 and 0.15.1 . The file flair/models/clustering.py remains present in the distributed package despite being removed from the documented API. Its ClusteringModel.load static method deserializes via pickle.loads(joblib.load(str(mode...