SUSE CVE-2026-39972

Mercure is a protocol for pushing data updates to web browsers and other HTTP clients in a battery-efficient way. Prior to 0.22.0, a cache key collision vulnerability in TopicSelectorStore allows an attacker to poison the match result cache, potentially causing private updates to be delivered to...

SUSE CVE-2026-40090

Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are constructed by joining a...

SUSE CVE-2026-41135

free5GC UDR is the Policy Control Function PCF for free5GC, an an open-source project for 5th generation 5G mobile core networks. A memory leak vulnerability in versions prior to 1.4.3 allows any unauthenticated attacker with network access to the PCF SBI interface to cause uncontrolled memory...

SUSE CVE-2026-41136

free5GC AMF provides Access & Mobility Management Function AMF for free5GC, an an open-source project for 5th generation 5G mobile core networks. Prior to version 1.4.3, the HTTPUEContextTransfer handler in internal/sbi/apicommunication.go does not include a default case in the Content-Type switc...

SUSE CVE-2026-41646

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require function, bypassing the default local file acce...

SUSE CVE-2026-42596

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as...

SUSE CVE-2026-44981

CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/apiserver/controllers/controller.go, causing /v1/watchers and /v1/watchers/login to decompress unauthenticated gzip-compressed...

SUSE CVE-2026-46354

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, azureidentity.Validate verifies that the PKCS7 signer certificate chains to a trusted Azure CA but never verifies the PKCS7 signature...

SUSE CVE-2026-46410

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions 1.3.2-stable and 1.4.1-beta fix the issue. No known workarounds are available...

SUSE CVE-2026-46695

Boxlite is a sandbox service that allows users to create lightweight virtual machines Boxes and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite does not restrict the kernel capabilities available inside the container, malicious code can remount the directo...

SUSE CVE-2026-47268

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.10, an authenticated Nezha dashboard user can create or update a DDNS profile with provider webhook and configure an arbitrary webhookurl, HTTP method, request...

SUSE CVE-2026-50013

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the AddDiff function writes to the shared responsesDiff map without any synchronization no mutex. When multiple proxy requests are processed concurrently the normal case for any proxy,...

SUSE CVE-2026-52796

Gogs is an open source self-hosted Git service. Prior to 0.14.3, specially crafted issue index pattern can cause a panic when rendering, resulting in denial of service. In internal/markup/markup.go, RenderIssueIndexPattern renders the issue index pattern to a link using com.Expand, which is not...

SUSE CVE-2026-53521

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/id accepts and persists nonexistent ddnsprofiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those...

SUSE CVE-2026-53523

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero...

SUSE CVE-2026-53935

Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, enabling hijacking traffic to Services in any namespa...

SUSE CVE-2026-54562

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or...

SUSE CVE-2026-55077

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the PUT /api/v2/users/user/password endpoint authorized only ActionUpdatePersonal and did not prevent a user-admin from resetting an owner account's passwor...

SUSE CVE-2026-55430

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from httpapi.RequestHost which prefers the X-Forwarded-Host header over the real Host header. No middleware...

SUSE CVE-2026-56847

A flaw in Node.js Permission Model enforcement allows traceevents.createTracing.enable Writes Trace Logs Outside --allow-fs-write. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and...

SUSE CVE-2026-58422

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts...

SUSE CVE-2026-42495

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:...

SUSE CVE-2026-43871

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

SUSE CVE-2026-62427

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in paralle...

SUSE CVE-2026-64537

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccmtxworkexpired re-arms itself via queuedelayedwork using the configured expinterval converted by intervaltous. When expinterval is BRCFMCCMINTERVALNONE or out of...

SUSE CVE-2026-64544

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - fix OOB read in pefiledigestpecontents pefiledigestpecontents computes the trailing-data hash length as pelen - hashedbytes + certssize. A crafted PE can make the addition exceed pelen, causing the unsign...

SUSE CVE-2026-64545

In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdpmasterredirect xdpmasterredirect dereferences the result of netdevmasterupperdevgetrcu without a NULL check, but that helper returns NULL when the receiving device has no upper-master...

SUSE CVE-2026-66036

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vfhqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the...

SUSE CVE-2026-52863

In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure...

SUSE CVE-2026-56416

In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dnamevaliddatstart, ...' and passes it straight to 'querydnametolower'...

SUSE CVE-2026-64530

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle tcfclassify can return TCACTCONSUMED while the skb is held by the defragmentation engine e.g. actct on out-of-order fragments. When that happens the skb is no longer owne...

SUSE CVE-2026-64267

In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSENOTIFYPRUNE validates the nodeid payload length with: size - sizeofoutarg != outarg.count sizeofu64 On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count...

SUSE CVE-2026-64277

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmif3ainitialize takes the GPIO count from the device query register f3a-gpiocount = buf & RMIF3AGPIOCOUNT, range 0..127. rmif3amapgpios then allocates gpiokeymap wit...

SUSE CVE-2026-64281

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svcrdmasqwait on scsqticketwait or scsendwait can hang indefinitely in TASKUNINTERRUPTIBLE state across transport teardown, pinning svcxprt references and...

SUSE CVE-2026-64307

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCONFIG Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

SUSE CVE-2026-64311

In the Linux kernel, the following vulnerability has been resolved: crypto: loongson - Remove broken and unused loongson-rng The loongson-rng rngalg has several vulnerabilities, including not providing forward security, and a use-after-free bug due to the use of waitforcompletioninterruptible...

SUSE CVE-2026-64322

In the Linux kernel, the following vulnerability has been resolved: udf: validate sparing table length as an entry count, not a byte count udfloadsparablemap accepts a sparing table when sizeofst + le16tocpust-reallocationTableLen sb-sblocksize is false, i.e. it treats reallocationTableLen as a...

SUSE CVE-2026-64329

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove The threaded IRQ handler ccgirqhandler calls ucsinotifycommon, which on a connector-change event calls ucsiconnectorchange and schedules connector work. In ucsiccgremove...

SUSE CVE-2026-64379

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

SUSE CVE-2026-64391

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LSM policy using the...

SUSE CVE-2026-64397

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERYDIRECTORY requests per file smb2querydir stores a pointer to its stack-allocated private data in the ksmbdfile readdirdata. Concurrent QUERYDIRECTORY requests using the same file handle can overwrite this...

SUSE CVE-2026-64405

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix null ptr deref in hciabortconn hciabortconn read hciskbeventhdev-sentcmd when a connection was pending, but hdev-sentcmd can be NULL while reqstatus is still HCIREQPEND, leading to a NULL pointer dereferen...

SUSE CVE-2026-64431

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls postwritemstfixup when ntfsibwrite returns an error, intending to restore the buffer after a failed write. However, ntfsibwrite returns an erro...

SUSE CVE-2026-64449

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: bound slave read/write to the kernbuf size The SLAVE-path helpers buffertouser and bufferfromuser copy 'count' bytes into/out of the fixed-size kernbuf sizebuf == PCIBUFSIZE == 0x20000, 128 KiB using ppos as the...

SUSE CVE-2026-64450

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATEMSG can carry a Gap ACK blocks record in its data area. tipcgetgapackblks only verifies that the record's len field is self-consistent with its...

SUSE CVE-2026-64454

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3gadgetsuspend takes dwc-lock with IRQs disabled and then calls dwc3disconnectgadget. For async callbacks that helper only uses plain spinunlock/spinlock, so the...

SUSE CVE-2026-64506

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: correct drop logic for malformed AMPDU frames The previous commit aims to fix issue caused by malformed AMPDU frames. But the drop logic fails to deal with the first AMPDU packet paired with certain range of sequence...

SUSE CVE-2026-64520

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index...

SUSE CVE-2026-64227

In the Linux kernel, the following vulnerability has been resolved: ACPI: driver: Check ACPICOMPANION against NULL during probe Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, platform drivers that rely on...

SUSE CVE-2026-64235

In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIGCALLDEPTHTRACKING enabled on an x86 retbleed-affected platform eg: Skylake, with retbleed=stuff, registering a dynamic ftrace trampoline crashes on...