SUSE CVE-2026-99283

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 "netfilter: conntrack: tcp: only close if RST matches exact sequence" keeps an established conntrack entry in ESTABLISHED when an...

SUSE CVE-2026-99284

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skbzerocopy skbzerocopy moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skbshinfofrom-flags into skbshinfoto-flags. A destination sk...

SUSE CVE-2026-74765

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encodepunycode. The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation delta += m-n h+1 has no overflow check, so...

SUSE CVE-2026-74766

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decodepunycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decodepunycode computes the...

SUSE CVE-2026-87078

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decodepunycode. The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path...

SUSE CVE-2026-87079

Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decodepunycode. The XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by scanning that buffer from the start, one character ...

SUSE CVE-2026-87080

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

SUSE CVE-2026-87081

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii. toascii punycode encodes each label and only then applies the 63-byte DNS limit. encodepunycode in both backends follows the sample...

SUSE CVE-2026-87082

Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encodepunycode. Neither backend checks that its input is well-formed UTF-8, so a string with the UTF-8 flag set over malformed bytes, as the :utf8 PerlIO layer produces from an...

SUSE CVE-2026-121008

SQL::Abstract::Tree versions before 2.00000104 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The...

SUSE CVE-2026-123158

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass related to misinterpretation of whether a string is intended to be a password hash. For some configurations of accounts, any password between 256 and 1024 characters...

SUSE CVE-2026-84008

unknown...

SUSE CVE-2026-96958

unknown...

SUSE CVE-2026-96959

unknown...

SUSE CVE-2026-96960

unknown...

SUSE CVE-2026-33379

A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots missing authorization. Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not...

SUSE CVE-2026-73471

A flaw was found in GStreamer gst-plugins-good avidemux. In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewin...

SUSE CVE-2026-73472

A flaw was found in GStreamer gst-plugins-good avidemux. In the superindex and subindex parsers, integer overflow can bypass bounds checks and cause out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient t...

SUSE CVE-2026-73473

A flaw was found in GStreamer gst-plugins-good avidemux. In the subindex parser, missing validation of the entry count can cause excessive memory allocation and denial of service. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is...

SUSE CVE-2026-77299

Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containing a large fixed-count quantifier applied to a zero-width subexpression - e.g. ?:50000000 - the match engine executes the empty loop body m-1 times, pushing two integers ont...

SUSE CVE-2026-84503

unknown...

SUSE CVE-2026-88823

unknown...

SUSE CVE-2026-105929

unknown...

SUSE CVE-2026-118042

unknown...

SUSE CVE-2026-118590

A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function arrayfromfile of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotel...

SUSE CVE-2026-121006

HTTP::Body versions before 1.2402 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines...

SUSE CVE-2026-121952

FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdpreadbitmapcachev2capabilityset rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell...

SUSE CVE-2026-121953

FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfxonclose frees without clearing. A malicious RDP server can open and close such a channel, then send ...

SUSE CVE-2026-121954

FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdpbitmapplanarcontextreset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an oversized ResetGraphics PDU, then a GFX PLANAR...

SUSE CVE-2026-121955

FreeRDP before 3.32.2 contains a use-after-free vulnerability in EmulateSCardReleaseContext that frees the emulated SCardContext before its worker thread is cancelled and joined. A malicious server can send ESTABLISHCONTEXT, a long-timeout GETSTATUSCHANGE, then RELEASECONTEXT smartcard IRPs to...

SUSE CVE-2026-121956

FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request who...

SUSE CVE-2026-121957

FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more t...

SUSE CVE-2026-121958

FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the deletesurface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTableGetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can...

SUSE CVE-2026-121959

FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocketcontextread that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS closenotify, causing a client thread to spin and consume CPU until...

SUSE CVE-2026-121960

FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPRASSERT and abort the server...

SUSE CVE-2026-121961

FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATEREQUESTPDU for an active channel id, racing front DATA handling to free a borrowed context and crash the...

SUSE CVE-2026-121962

FreeRDP before 3.32.2 contains a heap buffer overflow in transportdefaultreadpdu when handling partial Early User Authorization reads during PROTOCOLHYBRIDEX CredSSP. A malicious RDP server can split the four-byte EUA result into short reads that advance the stream pointer beyond the 16 KiB...

SUSE CVE-2026-121963

FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback threa...

SUSE CVE-2026-121964

FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpcclientrecvfragment writes BINDACK and ALTERCONTEXTRESP fragments into a persistent PDU stream after checking only total capacity rather than remaining capacity from the current stream position. A...

SUSE CVE-2026-121994

A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetchregisterusingp, which decodes a stub's register reply into an alloca-sized buffer without bounding writes b...

SUSE CVE-2026-121995

A stack buffer overflow in the GDB client's tracepoint upload handler allows an attacker-controlled debug stub to corrupt stack memory automatically during connection setup. The overflow results from GDB reading beyond the current reply boundary into a stale prior reply in the shared packet buffe...

SUSE CVE-2026-121996

A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation...

SUSE CVE-2026-121997

A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to writ...

SUSE CVE-2026-122234

jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format or formatters.annotated.format can embed script that...

SUSE CVE-2026-123037

A flaw was found in the ansible-core user module. When generatesshkey is enabled, User.sshkeygen guards the key files against symlinks but checks the /.ssh directory only with os.path.exists. An unprivileged user on a managed node who replaces their /.ssh with a symlink to an existing root-writab...

SUSE CVE-2026-123151

A flaw was found in the GNU debugger GDB. When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with...

SUSE CVE-2026-123202

libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxmlparser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attribute, DOCTYPE or entity name ending in a...

SUSE CVE-2026-123272

Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC...

SUSE CVE-2005-0109

Hyper-Threading technology, as used in FreeBSD and other operating systems that are run on Intel Pentium and other processors, allows local users to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic key...

SUSE CVE-2007-5502

The PRNG implementation for the OpenSSL FIPS Object Module 1.1.1 does not perform auto-seeding during the FIPS self-test, which generates random data that is more predictable than expected and makes it easier for attackers to bypass protection mechanisms that rely on the randomness...