CVE-2026-18973

A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...

SUSE CVE-2026-66140

Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled...

SUSE CVE-2026-67182

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters 0x0A into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers...

SUSE CVE-2026-67318

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

Security Bulletin: IBM Engineering Lifecycle Management - DOORS Next is impacted by vulnerability in Apache PDFBox

Summary Vulnerability have been identified in Apache PDFBox, which is used in IBM Engineering Lifecycle Management - DOORS Next. Vulnerability Details CVEID:CVE-2021-27807 DESCRIPTION: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFB...

EUVD-2026-53677

A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegmentencode validates only the standalone segment length via FileSegmentGetMaxDataSize and does not verify the residual capacity of the current ASDU frame befo...

EUVD-2026-53678

The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap...

EUVD-2026-53670

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the Alarm/Conditions wrapper when processing PublishResponse EventNotificationList data...

DEBIAN-CVE-2026-67869

Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the ServiceCall validates input arguments against runtime-resolved InputArguments metadata...

CVE-2026-67689

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...

OPENSUSE-SU-2026:11462-1 gleam-1.18.1-1.1 on GA media

These are all security issues fixed in the gleam-1.18.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-67687

The ICS-Park Smart Park Management System v2.0 contains an Insecure Permissions vulnerability allowing an authenticated low-privileged user to perform vertical privilege escalation. The root cause is a lack of authorization checks in the RoleController.save() method (missing @HasPermissions annot...

OPENSUSE-SU-2026:11471-1 tekton-cli-0.46.0-1.1 on GA media

These are all security issues fixed in the tekton-cli-0.46.0-1.1 package on the GA media of openSUSE Tumbleweed...

VulnCheck KEV: CVE-2018-14013

Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients...

EulerOS 2.0 SP13 : haproxy (EulerOS-SA-2026-2968)

According to the versions of the haproxy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced...

SUSE SLED15: libwireshark19 / libwiretap16 / libwsutil17 / wireshark / etc (SUSE-SU-2026:3501-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3501-1 advisory. Update to version 4.6.7: - CVE-2026-5299: ICMPv6 dissector crash bsc1263757. - CVE-2026-5401: AFP dissector...

Oracle Linux 10 : gpsd (ELSA-2026-51075)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-51075 advisory. 3.26.1-3.0.1.el102.1 - Replace upstream reference Orabug: 37033219 1:3.26.1-3.el102.1 - fix command injection in gpsprof CVE-2026-58459 Tenable has extracted...

EulerOS 2.0 SP13 : python-paramiko (EulerOS-SA-2026-2991)

According to the versions of the python-paramiko packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.CVE-2026-44405 Tenable has extracted the preceding...

Google Chrome < 151.0.7922.108 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 151.0.7922.108. It is, therefore, affected by multiple vulnerabilities as referenced in the 202608stable-channel-update-for-desktop01193673229 advisory. - Use after free in Skia. CVE-2026-19154, CVE-2026-19176 - Use after...

EulerOS 2.0 SP13 : haveged (EulerOS-SA-2026-2969)

According to the versions of the haveged packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In src/havegecmd.c, the sockethandler function performs a credential check on the abstract UNIX socket \0/sys/entropy/haveged. However, while it...