SUSE CVE-2026-43603

A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel crash and result in denial of service...

SUSE CVE-2026-48057

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's X.509 Distinguished Name decoder flattens the Attribute-Value Assertions in each Relative Distinguished Name and loses multi-value RDN grouping before DN name-constraint enforcement. An attacker controlling a name-constrained...

SUSE CVE-2026-54604

OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and openslidetiffreadtile to request a full-height destination for a partial bottom tile row, allowing uninitialized...

SUSE CVE-2026-59171

JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application...

SUSE CVE-2026-61813

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/httpsclient.cc sets libcurl CURLOPTSSLVERIFYHOST to 1 instead of the strict value 2L. Under...

SUSE CVE-2026-73856

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is...

SUSE CVE-2026-99271

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Clear prevfbuf on capture buffer release A KASAN slab-use-after-free read was reported in submitaudioouturb when generating an impulse test signal: BUG: KASAN: slab-use-after-free in createimpulsetestsignal...

SUSE CVE-2026-99272

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the data area in SMB2read SMB2read copies le32tocpursp-DataLength bytes from char rsp + rsp-DataOffset without checking that the range lies within the response actually received. A READ response with...

SUSE CVE-2026-99273

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in stream info smbstrtoUTF16 always writes a terminating zero UTF-16 unit after the converted characters, but getfilestreaminfo budgets only sizeofstruct smb2filestreaminfo + streaml...

SUSE CVE-2026-99274

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix fiemap wild read on empty truncated response smb3fiemap treats -E2BIG from SMB2ioctl as a truncated range blob and loops for the next chunk. If the server reports STATUSBUFFEROVERFLOW with OutputCount == 0,...

SUSE CVE-2026-99275

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short SESSIONSETUP responses smb2checkmessage accepts frames shorter than struct smb2pdu when the SMB2 status is non-zero, before the minimum-PDU check added by b4694f269e66d. A 64-byte...

SUSE CVE-2026-99276

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer connection scavenging while session locks are busy The expiration worker holds connlistlock for reading while checking for authenticated sessions. Without this change, the check can wait for conn-sessionlock or...

SUSE CVE-2026-99277

In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbdsessionunregister removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the sessi...

SUSE CVE-2026-99278

In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit sessions on each connection The pending setup limit only counts InProgress sessions. A client can complete authentication repeatedly and retain an unbounded number of Valid sessions on one connection. Reserve a...

SUSE CVE-2026-99279

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reclaim ended sessions on logoff and expiration LOGOFF and previous-session replacement leave sessions Expired with a zero credential expiry. Ended sessions can retain their memory and connection slots when no further setu...

SUSE CVE-2026-99280

In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping table references Session registration failure and connection cleanup can drop the table reference while the per-session procfs entry is still accessible. If a reader holds the...

SUSE CVE-2026-99281

In the Linux kernel, the following vulnerability has been resolved: tun: Require CAPNETADMIN to attach to an ownerless device Twenty years ago I made creating a tuntap device require CAPNETADMIN in commit ca6bb5d7ab22 "NET: Require CAPNETADMIN to create tuntap devices." The idea was to allow the...

SUSE CVE-2026-99282

In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: fix use-after-free on lower qdisc drop The issue: teqlmasterxmit tests the slave's ndostartxmit return value against NETDEVTXOK alone. A slave that consumes the skb but returns an error code rc dev and calls...

SUSE CVE-2026-100080

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix UAF when reading statistics data The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend e.g. due to illegal...

SUSE CVE-2026-100081

In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvifmcastaddrlistfree In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvifstartxmit, while adds/removes happ...

SUSE CVE-2026-100082

In the Linux kernel, the following vulnerability has been resolved: xen-blkback: Avoid UAF when reading I/O statistics Reading I/O statistics via sysfs concurrently with tearing down a frontend device might result in UAF or a NULL dereference, as the reading of the statistics data is not...

SUSE CVE-2026-100395

LXC is a userspace interface for the Linux kernel containment features used to create and manage system containers. In LXC 7.0.0 and earlier, lxc-copy and the public liblxc clone API can follow attacker-controlled symbolic links while updating /etc/hostname in a copied container root filesystem...

SUSE CVE-2026-103022

Urwid is a console user interface library for Python. Prior to 4.0.7, handleshortrequest in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can...

SUSE CVE-2026-103932

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2match match-limit errors into an ordinary no-match result instead of propagating a non-OK...

SUSE CVE-2026-104254

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. From 0.11.0 through 0.16.0, builds configured with OQSENABLESIGSTFLLMS=ON can read beyond a caller-supplied signature buffer when an untrusted truncated LMS or HSS-LMS signature...

SUSE CVE-2026-104267

Botan is a C++ cryptography library. From 2.7.0 until 3.13.0, Botan's Scrypt implementation on 32-bit platforms computes required memory with unchecked multiplication, allowing attacker-controlled Scrypt parameters to wrap the allocation size and create a buffer smaller than the algorithm...

SUSE CVE-2026-104269

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename parameter precedence used by common Go, Python, Node.js, and Java application parsers. A...

SUSE CVE-2026-104619

unknown...

SUSE CVE-2026-104620

A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges...

SUSE CVE-2026-107496

unknown...

SUSE CVE-2026-111253

A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unique sender that created the session. A local attacker can modify another user's live package-management session and replace its resolved transaction plan. I...

SUSE CVE-2026-113431

Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cowhttp2machine:headersdecode/4 in src/cowhttp2machine.erl decodes every HEADERS block with...

SUSE CVE-2026-114366

An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module...

SUSE CVE-2026-119170

There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected...

SUSE CVE-2026-120749

A flaw was found in D-Bus. With a privileged Monitoring client attached for example dbus-monitor or busctl monitor, an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient...

SUSE CVE-2026-121265

SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update. With the arraydatatypes option off, which is the default, insert, update and values treat an arrayref column value as literal SQL. Its first element goes into the SQL text...

SUSE CVE-2026-121942

ZBar through 0.23.95 contains an out-of-bounds read vulnerability in zbarsqdecode in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked...

SUSE CVE-2026-122132

go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301...

SUSE CVE-2026-122330

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2schunkgetslicebuffer in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via...

SUSE CVE-2026-123095

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

SUSE CVE-2026-123268

A security vulnerability has been detected in libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. Affected is the function libvmdkextenttablegetextentdatafilepath of the file libvmdk/libvmdkextenttable.c of the component Extent Data File Handler. The manipulation leads to memory...

SUSE CVE-2026-123269

A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdkdescriptorfilereadheader of the file libvmdk/libvmdkdescriptorfile.c of the component Descriptor File Parser. The manipulation results in out-of-bounds read. The attack must be initiated from a...

SUSE CVE-2026-123273

ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing...

SUSE CVE-2026-123784

Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme that allows attackers to execute commands via crafted style background values. Attackers can embed shell metacharacters in background pixmap paths, random directories, or gradient texture text, which...

SUSE CVE-2026-123785

Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu in src/FbTk/Menu.cc that allows attackers to hang the window manager via crafted style geometry values. Attackers can supply a style with an oversized unbounded menu.titleHeight so the column loop never terminates,...

SUSE CVE-2026-124040

CivetWeb through 1.16, when built with USEHTTP2 and enablehttp2 on, contains a use-after-free vulnerability in handlehttp2 that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influence request method or pa...

SUSE CVE-2026-124307

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability that allows attackers to corrupt memory by redefining an ALF adaptation parameter set id still referenced by slices. Attackers can supply a crafted VVC bitstream that, with multithreaded decoding, makes worker threads...

SUSE CVE-2026-124308

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more thread...

SUSE CVE-2026-124309

Fraunhofer HHI VVdeC before 3.2.1 contains a heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting that allows attackers to read past heap allocations by casting the SEI wrapper object instead of its payload. Attackers can supply a crafted VVC bitstream with a scalable...

SUSE CVE-2026-124310

Fraunhofer HHI VVdeC before 3.2.1 contains an out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying bitstreams with overlapping slice CTU coverage. Attackers can code a CTU in a second slice so a bi-predicted BDOF coding unit carries a negative reference index,...