SUSE CVE-2026-89162

In PCRE2 before 10.48, pcre2serializeencode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe...

SUSE CVE-2026-89258

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place - or who convinces a site author to place - a symlink inside a mount...

SUSE CVE-2026-89259

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS - included in the default security.exec.allow list - requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

SUSE CVE-2026-11573

Uncontrolled recursion CWE-674 in the QDomDocument/QDomNode serialization path of the Qt XML module QtXml, qtbase. QDomElementPrivate::save and QDomNodePrivate::save recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error...

SUSE CVE-2026-16118

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in xdgmimemagicparsemagicline in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location e.g., in the $XDGDATAHOME/mime/magic path is parsed by an...

SUSE CVE-2026-19201

An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of service DoS. The WinEvents.readELAMAggregation function recurses for every nested elamAggregation sub-event without...

SUSE CVE-2026-19546

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546...

SUSE CVE-2026-19583

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...

SUSE CVE-2026-19584

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOKEDITOR permission to plant a VQL que...

SUSE CVE-2026-19843

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...

SUSE CVE-2026-19872

HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages,...

SUSE CVE-2026-38998

A use-after-free in the SocketDescriptor::tcpReadHandler1 function liveMedia/RTPInterface.cpp of LIVE555 Streaming Media version 2026.02.26 allows attackers to cause a Denial of Service DoS via sending a series of crafted RTSP and HTTP requests to the server...

SUSE CVE-2026-45747

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic...

SUSE CVE-2026-45763

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when Lua rule execution is enabled, the Lua sandbox memory limit was not consistently enforced for new allocations. Certain L...

SUSE CVE-2026-46387

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

SUSE CVE-2026-53495

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or lifecycle hooks...

SUSE CVE-2026-60122

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites.used field, which is inserted unsanitize...

SUSE CVE-2026-78133

libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling...

SUSE CVE-2026-78254

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the...

SUSE CVE-2026-55073

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...

SUSE CVE-2026-59172

unknown...

SUSE CVE-2026-61908

An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H-, which could read past the end of the internal blobheaders array during download, exposing...

SUSE CVE-2026-61909

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...

SUSE CVE-2026-61910

An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared...

SUSE CVE-2026-61911

An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired...

SUSE CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...

SUSE CVE-2026-67279

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...

SUSE CVE-2026-79515

An out-of-bounds read in the stbttGetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service DoS via sending a crafted TTF file...

SUSE CVE-2026-79516

An out-of-bounds read in the stbspvsnprintf function stbsprintf.h of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service DoS via sending a crafted input...

SUSE CVE-2026-80915

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix DPT allocation paths. Remove the fallback for VRAM to system memory, I tested it and that doesn't work at all, only a black screen with pipe fault errors were observed. On systems with media GT, extra latency is added...

SUSE CVE-2026-83530

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

SUSE CVE-2026-84042

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking krun.usepasst, crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun = 1.29...

SUSE CVE-2026-84450

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an ispe width or height greater than INT32MAX + 1 can reach crop calculations through heifimagehandlegetimagetiling. Boxclap::leftrounded or Boxclap::toprounde...

SUSE CVE-2026-84451

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile gr...

SUSE CVE-2026-86137

In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp...

SUSE CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

SUSE CVE-2026-86139

In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow...

SUSE CVE-2026-86140

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow...

SUSE CVE-2026-86141

xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking...

SUSE CVE-2026-86142

In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation...

SUSE CVE-2026-86143

In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a...

SUSE CVE-2026-86144

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

SUSE CVE-2026-86564

A flaw was found in DPDK lib/vhost. Missing length validation before reading commanddata in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash...

SUSE CVE-2026-87823

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MINVALUE to read unmapped memory, causing JVM...

SUSE CVE-2026-87824

zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause...

SUSE CVE-2026-87825

zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causi...

SUSE CVE-2026-87853

A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf function compares the OIDC subject identifier using strncmp with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix...

SUSE CVE-2026-87875

The cupsUTF32ToUTF8 function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content...

SUSE CVE-2026-87876

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

SUSE CVE-2026-87877

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...