CVE-2026-85181

CAT (dianping/cat) through 3.1.0 is vulnerable to session cookie forgery due to using Java String.hashCode as the sole integrity check without a server-side secret key. An attacker can compute valid checksums offline and, by setting the x-forwarded-for header, bypass IP-binding validation to crea...

EUVD-2026-70485

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...

Security update for terraform-provider-susepubliccloud

This update for terraform-provider-susepubliccloud fixes the following issue: CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of truncated/invalid UTF-8 input can lead to infinite loop bsc1271995. Patch Instructions: To install this SUSE update use the SUSE recommended...

SUSE-SU-2026:3962-1 Security update for terraform-provider-susepubliccloud

This update for terraform-provider-susepubliccloud fixes the following issue: - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of truncated/invalid UTF-8 input can lead to infinite loop bsc1271995...

CVE-2026-82180

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload the authentication field of MqttRequestTemplate and treats its Subject...

AZL-99081 CVE-2026-76642 affecting package util-linux for versions less than 2.40.2-6

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with...

CVE-2026-82918

XG VisionTerminal and XG-X VisionTerminal provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the sensitive information stored in the system where XG VisionTerminal or XG-X VisionTerminal is installed may be disclos...

EUVD-2026-70455

XG VisionTerminal and XG-X VisionTerminal provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the sensitive information stored in the system where XG VisionTerminal or XG-X VisionTerminal is installed may be disclos...

util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...

util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to opentree with ATSYMLINKNOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with...

util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks

When an external mount. helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode...

CVE-2026-76642 util-linux libmount Privilege Escalation via Failed Mount Helper

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with...

EUVD-2026-70382

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with...

CVE-2026-76642

util-linux (libmount component) versions through 2.41.5 and 2.42.2 fail to check the exit status of an external mount helper before executing privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry using the user option combined with X-mount.idmap or X-mount.owner/group/mo...

CVE-2026-76642

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

PT-2026-90896

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with...

PT-2026-85023

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload the authentication field of MqttRequestTemplate and treats its Subject...