SUSE CVE-2026-54158

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view database cell renderer genAVValueHTML interpolates cell content raw in four of its branches: text, url, phone, and mAsset. A cell value like or " breaks out of its surrounding tag and runs arbitrary...

SUSE CVE-2026-54890

Integer Underflow Wrap or Wraparound vulnerability in erlang otp erlang/otp erts modules, erlang otp erts erts modules allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BITBINARYEX...

SUSE CVE-2026-62431

The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a DE fault...

CVE-2026-9322

CVE-2026-9322 affects IBM WebSphere Application Server (WAS) 9.0, WAS 8.5, and WAS Liberty 17.0.0.3 through 26.0.0.7, which are vulnerable to a denial of service via a crafted HTTP request. The root cause is an Uncontrolled Resource Consumption vulnerability in WAS/Liberty handling certain HTTP r...

CVE-2026-23985 Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser

A Regular Expression Denial of Service ReDoS vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements in the sqlparse library integration. The affected regular...

CVE-2026-23981 Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs dashboards to associate the char...

JLSEC-2026-923 ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash

Summary Passing a geometry string containing only a colon ":" to montage -geometry leads GetGeometry to set width/height to 0. Later, ThumbnailImage divides by these zero dimensions, triggering a crash SIGFPE/abort, resulting in a denial of service. Details Root Cause 1. montage -geometry ":"...

JLSEC-2026-877

A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability...

JLSEC-2026-949 ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash

A logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks and trigger a division-by-zero during image loading, resulting in a reliable denial-of-service. coders/yuv.c:210:47: runtime error: division by zero AddressSanitizer:DEADLYSIGNAL...

CVE-2026-10842

CVE-2026-10842 – Affects IBM WebSphere Application Server (Traditional) 8.5, 9.0 and WebSphere Application Server Liberty 17.0.0.3–26.0.0.7. The vulnerability is a remote attacker bypass of security constraints (authentication bypass, CWE-289). Reported base CVSS v3.1 score is 7.5 (NONE user inte...

CVE-2026-14522

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters...

WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.9.0 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Nox Axter in WordPress Plugin Admin and Site Enhancements ASE Pro versions = 8.9.0...

SUSE-SU-2026:3423-1 Security update for xen

This update for xen fixes the following issues - CVE-2026-42493: x86 shadow paging is deprecated bsc1271528. - CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling bsc1271530. - CVE-2026-62426,CVE-2026-62427: sysctl and...

org.apache.camel/camel-mail: Apache Camel Mail Component: Credential exposure and information disclosure via improper input validation of mail headers

A flaw was found in the Apache Camel Mail Component. This vulnerability, due to improper input validation, allows a remote attacker to exploit routes that channel untrusted input into the mail producer without proper header stripping. Before version 4.19.0, this could lead to the redirection of...

CLEANSTART-2026-NL91750 Security fixes in argo-workflows 4.0.3-r0

Package argo-workflows version 4.0.3-r0 fixes 1 vulnerabilities: CVE-2026-33186...

CLEANSTART-2026-OH83140 Security fixes in trust-manager-fips 0.20.3-r0

Package trust-manager-fips version 0.20.3-r0 fixes 6 vulnerabilities: CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2025-61730, CVE-2025-61726...

CLEANSTART-2026-BI40968 Security fixes in grafana-rollout-operator 0.35.0-r0

Package grafana-rollout-operator version 0.35.0-r0 fixes 7 vulnerabilities: CVE-2026-25679, ghsa-p77j-4mvh-x3m3, CVE-2026-27138, CVE-2026-27137, CVE-2026-27142...

CLEANSTART-2026-EQ36568 Security fixes in minio-operator-fips 6.0.4-r10

Package minio-operator-fips version 6.0.4-r10 fixes 4 vulnerabilities: CVE-2026-33810, CVE-2026-32283, CVE-2026-32281, CVE-2026-32280...

CLEANSTART-2026-CX37919 Security fixes in prometheus-mysqld-exporter-fips 0.19.0-r0

Package prometheus-mysqld-exporter-fips version 0.19.0-r0 fixes 1 vulnerabilities: CVE-2026-26958...

CLEANSTART-2026-SC64306 Security fixes in prom-mysqld-exporter-fips 0.18.0-r3

Package prom-mysqld-exporter-fips version 0.18.0-r3 fixes 10 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288...