Security update for ignition

This update for ignition fixes the following issues CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invalid...

SUSE-SU-2026:3267-1 Security update for ignition

This update for ignition fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invali...

Security update for ignition

This update for ignition fixes the following issues CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invalid...

SUSE-SU-2026:3266-1 Security update for ignition

This update for ignition fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invali...

SUSE-SU-2026:3265-1 Security update for ignition

This update for ignition fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invali...

GHSA-MQHR-6J6H-74P5 Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak

Summary Budibase attaches a REST datasource's stored credentials Bearer/Basic tokens and static headers to an outgoing request before it decides which host the request goes to, and never checks that the destination host matches the datasource. A query's request path can be pointed at any host via...

GHSA-C8VC-7PV3-G98P Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)

Summary POST /api/v2/email on the account portal account.budibase.app starts an email-change workflow using a client-supplied accountId that is not validated against the authenticated session. A logged-in attacker supplies a victim's accountId and an email address they control; the verification...

CVE-2026-15243

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

OPENSUSE-SU-2026:21441-1 Security update for distribution

This update for distribution fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266629. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on...

SUSE CVE-2026-52686

The issue is a DNSSEC validation bypass where wildcard expansion proofs NSEC/NSEC3 records are accepted without signature validation when the wildcard answer is a CNAME or DNAME record...

SUSE SLES12 Security Update : google-osconfig-agent (SUSE-SU-2026:3209-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3209-1 advisory. This update for google-osconfig-agent fixes the following issue - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...

CVE-2026-47769

APIFold is the affected software. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5, its OpenAPI/Swagger-based MCP server could accept arbitrary unauthenticated JSON on the /webhooks/:serverSlug/:eventName endpoint, storing payloads in Redis and webhook_events without signature checks or a...

EUVD-2026-48304

Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...

CVE-2026-15612

CVE-2026-15612 affects Logto Identity Platform. The vulnerability arises when the OIDC nonce validation is skipped if the id_token omits the nonce claim, because the validation path checks if data.nonce. As a result, a missing nonce can allow replay of authentication tokens and weaken session-bin...

CVE-2026-15615 SAML <Conditions> element not validated

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

Incorrect Behavior Order: Validate Before Canonicalize

Overview @auth/core is an Authentication for the Web. Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address...

Security update for google-guest-agent

This update for google-guest-agent fixes the following issue CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. Patch Instructions: To install this SUSE update use the SUSE recommended...

CVE-2026-65912

DOMPurify before 3.3.2 has a URI validation bypass when ADD_ATTR is used as a predicate via EXTRA_ELEMENT_HANDLING.attributeCheck. An attacker can craft a predicate to accept specific attribute/tag combinations, allowing unsafe protocols like javascript: to bypass validation and execute as DOM-ba...

CVE-2026-65912 DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADDATTR is provided as a predicate function via EXTRAELEMENTHANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe...

CVE-2026-65912

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADDATTR is provided as a predicate function via EXTRAELEMENTHANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe...