3295 matches found
Security update for ignition
This update for ignition fixes the following issues CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invalid...
SUSE-SU-2026:3300-1 Security update for ignition
This update for ignition fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invali...
Security update for ignition
This update for ignition fixes the following issues CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invalid...
SUSE-SU-2026:3267-1 Security update for ignition
This update for ignition fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invali...
SUSE-SU-2026:3266-1 Security update for ignition
This update for ignition fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invali...
Security update for ignition
This update for ignition fixes the following issues CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invalid...
SUSE-SU-2026:3265-1 Security update for ignition
This update for ignition fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invali...
PT-2026-65001
cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace...
Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic
Summary When an application configures hubuumclient with ClientBuilder::withtransport, several client operations still use the built-in reqwest client directly. The bypass includes password login, bearer-token validation, authentication-provider discovery, health and readiness probes, export-outp...
GHSA-MQHR-6J6H-74P5 Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak
Summary Budibase attaches a REST datasource's stored credentials Bearer/Basic tokens and static headers to an outgoing request before it decides which host the request goes to, and never checks that the destination host matches the datasource. A query's request path can be pointed at any host via...
GHSA-C8VC-7PV3-G98P Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
Summary POST /api/v2/email on the account portal account.budibase.app starts an email-change workflow using a client-supplied accountId that is not validated against the authenticated session. A logged-in attacker supplies a victim's accountId and an email address they control; the verification...
CVE-2026-15243
Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...
OPENSUSE-SU-2026:21441-1 Security update for distribution
This update for distribution fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266629. - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on...
SUSE CVE-2026-52686
The issue is a DNSSEC validation bypass where wildcard expansion proofs NSEC/NSEC3 records are accepted without signature validation when the wildcard answer is a CNAME or DNAME record...
SUSE SLES12 Security Update : google-osconfig-agent (SUSE-SU-2026:3209-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3209-1 advisory. This update for google-osconfig-agent fixes the following issue - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...
CVE-2026-47769
APIFold is the affected software. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5, its OpenAPI/Swagger-based MCP server could accept arbitrary unauthenticated JSON on the /webhooks/:serverSlug/:eventName endpoint, storing payloads in Redis and webhook_events without signature checks or a...
CVE-2026-15612
The Logto identity platform contains an OIDC nonce validation bypass (CVE-2026-15612) within its core protocol handling. The vulnerability occurs because the system stores a nonce in the connector session but only performs a validation check if the nonce claim is present in the id_token. When an ...
CVE-2026-15612 LOIDC nonce validation bypass
Logto bypasses OIDC nonce validation when the nonce claim is absent from the idtoken, enabling replay of authentication tokens and weakening session-binding...
