PT-2026-65615

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.63.0 Description A server-side request forgery SSRF exists due to a time-of-check/time-of-use TOCTOU gap during DNS resolution. The software validates the resolved IP of a fetch target to block...

PT-2026-65541

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5...

PT-2026-65536

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header...

PT-2026-66343

These are all security issues fixed in the freerdp-3.30.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-65634

Summary Using Databasecreate function or Databasedefine function to define the same function name more than once with different numbers of arguments "arity" or text encodings will result in a invalid memory read and a segmentation fault. Mitigation Upgrade to sqlite3 gem v2.9.5 or later. As a...

CVE-2026-51266

CVE-2026-51266 is rejected/not used and does not represent an active vulnerability entry.

PT-2026-65503

WordPress Coding Standards is a set of PHP CodeSniffer rules sniffs that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff active in the WordPress and WordPress-Extra rulesets reconstructed the $ver argument passed to functions such a...

PT-2026-65606

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.14.1 through 0.60.1 Description Code injection is possible when the --extra-template-data file contains a comment value with a carriage return r. The software renders this comment variable into Python commen...

pipewire security update

1.4.11-1 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164823 1.4-6-1 - Update version to 1.4.6 Resolves: DESKTOP-1857 1.2.7-1 - Update version to 1.2.7 - Resolves: RHEL-76017 1.2.6-3 - Enable libcamera support in RHEL-10 - Resolves: RHEL-64753 1.2.6-2 - Bump release for October...

OPENSUSE-SU-2026:11386-1 helm-4.2.3-4.1 on GA media

These are all security issues fixed in the helm-4.2.3-4.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11393-1 logcli-3.7.4-1.1 on GA media

These are all security issues fixed in the logcli-3.7.4-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11403-1 traefik2-2.11.53-1.1 on GA media

These are all security issues fixed in the traefik2-2.11.53-1.1 package on the GA media of openSUSE Tumbleweed...

Elasticsearch 8.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-64 / ESA-2026-68 / ESA-2026-74)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.19, or 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-64, ESA-2026-68, and ESA-2026-74 advisories. - Reachable Assertion CWE-617 in...

Apache Tomcat 11.0.0.M20 < 11.0.25

The version of Tomcat installed on the remote host is prior to 11.0.25. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat11.0.25security-11 advisory. - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affect...

CVE-2026-51267

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

PT-2026-65478

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, ...

PT-2026-66342

These are all security issues fixed in the freerdp-3.30.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-65513

wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...

OPENSUSE-SU-2026:11387-1 helm3-3.21.3-4.1 on GA media

These are all security issues fixed in the helm3-3.21.3-4.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-65515

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the...