2110428 matches found
CGA-JQ48-MG2M-XX83
Bulletin has no description...
CGA-4Q69-C6RC-FP4R
Bulletin has no description...
CGA-PVG3-JCC4-5426
Bulletin has no description...
CGA-C468-6VG7-X3PX
Bulletin has no description...
CVE-2026-96560 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel
LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pdtransmode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious pickled objects to the exposed RPyC...
OPENSUSE-SU-2026:21952-1 Security update for openSUSE-signkey-cert
This update for openSUSE-signkey-cert fixes the following issues: Adds the UEFI signing key of Leap 16.0. This needs to be imported via the MOK dialog on boot...
USN-8806-1 network-manager vulnerability
It was discovered that NetworkManager did not properly restrict the ca-path and phase2-ca-path certificate authority settings for private single-user 802.1X network connections. An attacker could use this issue to point their own private 802.1X connection profile at a directory under their contro...
CVE-2026-96512 Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...
CGA-9MPX-MF5C-XGXF
Bulletin has no description...
CGA-34XP-54H4-PJVV
Bulletin has no description...
SUSE-SU-2026:4309-1 Security update for gimp
This update for gimp fixes the following issues: Security issues fixed: - CVE-2026-59088: denial of service via signed integer overflow in FLI file processing bsc1274837. - CVE-2026-59090: arbitrary code execution in PSD plugin due to unsigned underflow bsc1274840. - CVE-2026-66757: signed intege...
SUSE-SU-2026:4308-1 Security update for apptainer
This update for apptainer fixes the following issues: - CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families bsc1278666. - CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel bsc1278666. - CVE-2026-78662:...
DEBIAN-CVE-2026-86247
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be...
DEBIAN-CVE-2026-86246
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOWCLIENTRENEGOTIATION, NOEXTENDEDMASTERSECRET, IGNOREUNEXPECTEDEOF and ALLOWNODHEKEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, fr...
DEBIAN-CVE-2026-86243
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are...
CGA-CMFG-JJM4-F346
Bulletin has no description...
CGA-HF2Q-55RH-84RX
Bulletin has no description...
CGA-QP5H-77VW-XVMC
Bulletin has no description...
CGA-8H5P-XFM7-8842
Bulletin has no description...
ECHO-088C-1462-CA4C
Bulletin has no description...
ECHO-0E64-158A-542B
Bulletin has no description...
CGA-Q4CX-MR93-QC6H
Bulletin has no description...
CGA-7FXG-8XV5-FR26
Bulletin has no description...
ECHO-5352-3F6E-0C72
Bulletin has no description...
ECHO-0C4C-8C22-BE6A
Bulletin has no description...
ECHO-8494-A0DC-6B0C
Bulletin has no description...
ECHO-EF2E-7BA4-F184
Bulletin has no description...
ECHO-94B9-8EC3-458F
Bulletin has no description...
ROOT-APP-NPM-CVE-2026-59940 CVE-2026-59940 in seroval - Patched by Root
Root has patched CVE-2026-59940 in the seroval package for Root:npm. Multiple fixed versions available...
CLSA-2026-1790166345 TuxCare security update for adm-zip (1 CVE)
TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.17-tuxcare.2...
CGA-4QRX-39WV-224R
Bulletin has no description...
DEBIAN-CVE-2026-87022
Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...
DEBIAN-CVE-2026-86248
CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to versi...
DEBIAN-CVE-2026-86350
Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from...
DEBIAN-CVE-2026-79677
Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through...
DEBIAN-CVE-2026-78383
Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1...
DEBIAN-CVE-2026-78437
Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially depends on timing cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are...
DEBIAN-CVE-2026-75973
Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...
DEBIAN-CVE-2026-76183
Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following version...
DEBIAN-CVE-2026-77756
Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...
DEBIAN-CVE-2026-77791
Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time...
DEBIAN-CVE-2026-77762
Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from...
DEBIAN-CVE-2026-73581
Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through...
CLSA-2026-1790165044 TuxCare security update for adm-zip (1 CVE)
TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.12-tuxcare.1...
ROOT-APP-MAVEN-CVE-2026-40972 CVE-2026-40972 in org.springframework.boot:spring-boot-devtools - Patched by Root
Root has patched CVE-2026-40972 in the org.springframework.boot:spring-boot-devtools package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-40976 CVE-2026-40976 in org.springframework.boot:spring-boot - Patched by Root
Root has patched CVE-2026-40976 in the org.springframework.boot:spring-boot package for Root:Maven. Multiple fixed versions available...
RUSTSEC-2026-0305 Use-after-free when XML includes have duplicated entities
Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse...
RUSTSEC-2026-0307 `uncbv`: archive extraction is vulnerable to path traversal (zip-slip)
Summary uncbv extract writes each archive entry to outputdir.joinentryfilename using the filename stored in the archive with no check for .. components or absolute paths. A malicious .cbv / .cbz archive whose entry name contains ../ or an absolute path can therefore cause files to be written...