SUSE-SU-2026:22948-1 Security update for libssh

This update for libssh fixes the following issues: - CVE-2026-15370: stack buffer overflow in SFTP server longname construction bsc1272162. - CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. - CVE-2026-59844: denial of service via oversized SFTP read length...

Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

...

PT-2026-64580

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nilfs2 file system where user-supplied segment numbers are not validated before the nilfs clean segments function begins processing. The range check is performed...

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Summary Budibase's OIDC SSO login links an incoming SSO identity to an existing Budibase account by email address alone, without ever checking the emailverified claim of the OIDC ID token. Budibase first tries to match the IdP sub; when that misses any fresh attacker IdP account it silently falls...

GHSA-HP6V-6JW7-GV2F Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Summary Budibase's OIDC SSO login links an incoming SSO identity to an existing Budibase account by email address alone, without ever checking the emailverified claim of the OIDC ID token. Budibase first tries to match the IdP sub; when that misses any fresh attacker IdP account it silently falls...

GHSA-C8VC-7PV3-G98P Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)

Summary POST /api/v2/email on the account portal account.budibase.app starts an email-change workflow using a client-supplied accountId that is not validated against the authenticated session. A logged-in attacker supplies a victim's accountId and an email address they control; the verification...

GO-2026-5566 Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm

Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm...

CVE-2026-48021 epa4all Security Incident: Implement keystore based on Telematik TSL, implement hostname check and certificate check for lib-vau

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic patient consent decisions, medication data,...

CVE-2026-54342

The CVE affects epa4all prior to 2026-05-20, where TLS certificate verification is disabled on CXF transport clients. A network attacker can intercept connections between epa4all and backends (ePA Aktensystem, Konnektor, IDP, TSS) by presenting a self-signed certificate. For non-VAU backends (Kon...

CVE-2026-54342 TLS Certificate Verification Disabled on CXF Transport Clients in epa4all

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend ePA Aktensystem, Konnektor, IDP, TSS can present a self-signed TLS certificate and intercept the connection. For non-VAU connections Konnektor, IDP, this allows direct read and modification of...

CVE-2026-54342 TLS Certificate Verification Disabled on CXF Transport Clients in epa4all

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend ePA Aktensystem, Konnektor, IDP, TSS can present a self-signed TLS certificate and intercept the connection. For non-VAU connections Konnektor, IDP, this allows direct read and modification of...

EUVD-2026-42617

Open WebUI: Account enumeration via observable login timing discrepancy...

GHSA-7RW5-9F7Q-XJ36 Open WebUI: Account enumeration via observable login timing discrepancy

Summary The /api/v1/auths/signin endpoint leaked whether an email address belonged to a registered account through a response-time side channel. Password verification ran bcrypt only when the email was found in the database; for a non-existent email the request returned early without hashing. The...

GHSA-5XVQ-CP9X-6P6R Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

A pre-authentication denial-of-service panic in russh 0.62.2 commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22. An unauthenticated client sends a single SSHMSGKEXECDHINIT whose QC is 32 zero bytes. russh's Curve25519 KEX does not reject the all-zero pee...

Insufficient Verification of Data Authenticity

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the authentication process. An attacker can gain persistent unauthorized access to user accounts by...

CVE-2026-64208 crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

EUVD-2026-48600

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...

CVE-2026-8789

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the eadeletemultipleconnections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated...

EUVD-2026-48509

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers ...

The vulnerability of the `django.http.HttpRequest.get_signed_cookie()` function in the Django web application framework allows a hacker to disclose protected information.

The vulnerability of the django.http.HttpRequest.getsignedcookie function in the Django web application framework is related to errors in checking the cryptographic signature. Exploiting this vulnerability could allow an attacker to disclose sensitive information that is protected by this mechani...