OPENSUSE-SU-2026:21448-1 Security update for agama-web-ui

This update for agama-web-ui fixes the following issues: - CVE-2025-7783: form-data: unsafe Math.random function is used to select a boundary value for multipart form-encoded data bsc1246822. - CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames bsc1272310....

GO-2026-6084 Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL in gitea.dev

Gitea: SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL in gitea.dev...

OPENSUSE-SU-2026:21454-1 Security update for yq

This update for yq fixes the following issues: Changes in yq: - Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good bsc1267199. - update to v4.53.3 Add --ini-preserve-quotes flag for INI round-trip quote preservation. Fix: reset INI decoder state on init. Fix:...

OPENSUSE-SU-2026:21452-1 Security update for perl-YAML-Syck

This update for perl-YAML-Syck fixes the following issues: Changes in perl-YAML-Syck: - updated to 1.470.0 1.47 Security - Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load path on untrusted input with no special flags reported by Paul Johnson via CPANSec, PR 213: -...

Inefficient Algorithmic Complexity

Overview org.webjars.npm:js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the readFlowCollection function of parser.ts, which reaches exponential time when a flow sequence entry turns out to be a key...

Inefficient Algorithmic Complexity

Overview js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the readFlowCollection function of parser.ts, which reaches exponential time when a flow sequence entry turns out to be a key: value pair and...

io.javalin.community.openapi:javalin-redoc-plugin (>=5.0.0, <=5.2.0), io.javalin.community.openapi:openapi-test (>=5.0.0, <=5.0.1) +41 more potentially affected by CVE-2026-73643 via org.webjars.npm:js-yaml (>=3.1.0, <=4.3.1)

org.webjars.npm:js-yaml MAVEN version =3.1.0, =5.0.0, =5.0.0, =9.0.6, =2.0.0, =2.1.3, =0.1.3, =1.1.4, =2.1.0, =4.0.3 and more Source cves: CVE-2026-73643 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-18313071...

js-yaml: Exponential parsing time in flow collections leads to denial of service

Summary Parsing a small YAML document can take exponential time. An application that calls load or loadAll on untrusted input can be hung by a payload under 200 bytes. Details When an entry in a flow sequence turns out to be a key: value pair, the parser rewinds and parses that entry a second tim...

@adobe/aem-cli (>=16.21.1, <=16.21.6), @adobe/helix-docx2md (>=1.9.29, <=1.9.31) +105 more potentially affected by unknown CVE via js-yaml (>=5.0.0, <=5.2.1)

js-yaml NPM version =5.0.0, =16.21.1, =1.9.29, =6.29.8, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =0.0.1-alpha.0, =1.0.8, =0.1.2, =0.11.0, =5.7.5, =7.0.2 - @davidsneighbour/markdownlint-config 2026.0.5 - @depup/nestjsswagger 11.4.6-depup.1 - @devicerail/yaml-adapter 0.1.0 and more Source cves: unknown...

@adobe/aem-cli (>=16.21.1, <=16.21.6), @adobe/helix-docx2md (>=1.9.29, <=1.9.31) +105 more potentially affected by CVE-2026-73643 via js-yaml (>=5.0.0, <=5.2.1)

js-yaml NPM version =5.0.0, =16.21.1, =1.9.29, =6.29.8, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =0.0.1-alpha.0, =1.0.8, =0.1.2, =0.11.0, =5.7.5, =7.0.2 - @davidsneighbour/markdownlint-config 2026.0.5 - @depup/nestjsswagger 11.4.6-depup.1 - @devicerail/yaml-adapter 0.1.0 and more Source cves:...

GHSA-PM4M-PH32-GHV5 js-yaml: Exponential parsing time in flow collections leads to denial of service

Summary Parsing a small YAML document can take exponential time. An application that calls load or loadAll on untrusted input can be hung by a payload under 200 bytes. Details When an entry in a flow sequence turns out to be a key: value pair, the parser rewinds and parses that entry a second tim...

CVE-2026-47722

Nebula-mesh (self-hosted control plane for Slack Nebula) prior to v0.3.2 is affected by YAML injection in host advanced overrides. The root cause is that ListenHost and TunDevice are interpolated directly into a text/template used to generate the agent config.yml, and the web/advanced input has o...

CVE-2026-47722 nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/configgen/generator.go:86,108,119 interpolates the operator-supplied ListenHost and TunDevice fields raw into a text/template that produces the agent's config.yml...

PYSEC-2026-3529 PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the /api/v1/runs endpoint...

[SECURITY] Fedora 44 Update: perl-YAML-Syck-1.47-1.fc44

This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around...

Fedora 44 : perl-YAML-Syck (2026-2139aa7dce)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2139aa7dce advisory. This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load path on untrusted input with no special flags:...

Fedora 43 : perl-YAML-Syck (2026-c8484f1afb)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c8484f1afb advisory. This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load path on untrusted input with no special flags:...

[SECURITY] Fedora 43 Update: nuclei-3.11.0-1.fc43

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaborati on to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud...

[SECURITY] Fedora 44 Update: nuclei-3.11.0-1.fc44

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaborati on to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud...

Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Summary Gitea's restore-repo CLI command restores a repository from a dump directory/archive. When parsing pullrequest.yml from that dump, the Head.CloneURL field is used to add a git remote and fetch from it with no validation, because the safety check that's supposed to guard it...