SUSE CVE-2026-122054

Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang...

SUSE CVE-2026-122135

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with a signed commit makes git log execute...

SUSE CVE-2026-122299

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default fo...

SUSE CVE-2026-122302

Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeti...

SUSE CVE-2026-122303

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target wit...

SUSE CVE-2026-122304

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall or globalReference...

SUSE CVE-2026-122305

Kyverno before 1.19.2 contains a denial of service vulnerability in substituteVariablesIfAny that allows low-privileged users to hang the admission webhook via self-referential variable templates. Attackers can create resources whose annotations re-introduce the embedded policy variable, causing...

SUSE CVE-2026-122306

Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict,...

SUSE CVE-2026-122307

Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the --enablePolicyException, --exceptionNamespace, and policy kind gates. Users with namespaced create...

SUSE CVE-2026-122308

Kyverno before 1.19.2 contains an authorization bypass vulnerability in the Generation Handler that allows users with create/update permissions to trigger synchronized generate policies by spoofing internal generate.kyverno.io labels. Attackers can label a ConfigMap as managed-by kyverno with...

SUSE CVE-2026-122309

Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory by submitting CEL expressions evaluated without runtime cost limits. Attackers can create a NamespacedValidatingPolicy or NamespacedDeletingPolicy with nested map...

SUSE CVE-2026-122310

Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query the Kubernetes client discards. A namespace-scoped user who can create a Policy can hide ../ segments behind or ? to reach cluster-scoped endpoints...

SUSE CVE-2026-122311

Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get and resource.post, allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster...

SUSE CVE-2026-122312

Kyverno from 1.19.1 before 1.19.2 contains a namespace isolation bypass in APICall Fetch in pkg/engine/apicall/apiCall.go because path.Clean treats '?' as a path character, letting the namespace regex match segments inside the query string. Users who can create namespaced policies can supply a...

SUSE CVE-2026-122313

Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other namespaces through NamespacedMutatingPolicy targetMatchConstraints.expression CEL output lacking namespace checks. Attackers can emit a literal target...

SUSE CVE-2026-122314

Kyverno before 1.19.2 contains an unchecked type assertion in its variable-substitution engine that allows users who can submit resources to crash the policy engine. Attackers can submit resources with non-string fields referenced by - variable shallow substitution in policies, causing a panic th...

SUSE CVE-2026-122315

Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allows unauthenticated attackers to crash the policy engine via crafted attestation statements. Attackers can push an OCI referrer manifest with a non-string type field to bypass image verification under...

SUSE CVE-2026-122316

Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to modify resources outside their namespace. Attackers can create a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace...

SUSE CVE-2026-122318

Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set th...

SUSE CVE-2026-122319

Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn operators that allows attackers to crash the policy engine via an unchecked type assertion. Attackers can submit resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types,...

SUSE CVE-2026-122320

Kyverno before 1.19.2 contains a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namespaces by templating generate.clone or cloneList namespace values. Attackers can annotate a triggering ConfigMap so the background-controller copies a victim...

SUSE CVE-2026-122321

Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string such as a tag rather than bound to the verified digest, so cache hits skip signature and attestation checks. An attacker who can submit...

SUSE CVE-2026-122322

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push gzip predicate layers exceeding...

SUSE CVE-2026-122323

Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can publish small gzip layers that...

SUSE CVE-2026-123036

A flaw was found in ansible-core. When a task marked nolog: true fails, the task result is censored before being emitted, but the exception field is retained because it is present in the PRESERVE allow-list in lib/ansible/internal/task.py, and the default stdout callback prints it through...

SUSE CVE-2026-123042

unknown...

SUSE CVE-2026-75466

libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12 or tj3LoadImage16 using the default pixel format, the application may trigger a division-by-zero in allocsarray,...

SUSE CVE-2026-78661

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...

SUSE CVE-2026-84243

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid ATSECURE. An attacker who can set LANGUAGE in the environment of a program that uses gettext c...

SUSE CVE-2026-93164

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Move optimized uprobe from nop5 to nop10 Andrii reported an issue with optimized uprobes 1 that can clobber redzone area with call instruction storing return address on stack where user code may keep temporary data...

SUSE CVE-2026-97045

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...

SUSE CVE-2026-112257

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash...

SUSE CVE-2026-112258

A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code...

SUSE CVE-2026-112260

A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service...

SUSE CVE-2026-112261

A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution...

SUSE CVE-2026-99244

In the Linux kernel, the following vulnerability has been resolved: pidnamespace: prevent TIFNOTIFYSIGNAL from interrupting the reaper Since commit 7fea700e04bd "zappidnsprocesses: clear TIFNOTIFYSIGNAL along with TIFSIGPENDING" zappidnsprocesses clears TIFNOTIFYSIGNAL before every kernelwait4...

SUSE CVE-2026-99245

In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix keyrejectandlink race with keyring restriction The restrictlink check in keyrejectandlink is done before taking the keyring semaphore, racing with a concurrent keyringrestrict that installs the restriction while holding...

SUSE CVE-2026-99246

In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipcnoderesetlinks trace event asks tipcnodedump to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock...

SUSE CVE-2026-99247

In the Linux kernel, the following vulnerability has been resolved: tracing: Do not initialize tracefs work if tracing is disabled If trace buffer allocation fails during early boot e.g. in earlytraceinit - allocatetracebuffers, tracingdisabled is left set to 1 and the global trace array events...

SUSE CVE-2026-99248

In the Linux kernel, the following vulnerability has been resolved: i2c: xiic: restore non-managed runtime PM to fix clk WARN flood The devres conversion replaced manual pmruntimeenable/disable with devmpmruntimesetactiveenabled and dropped the remove-time runtime PM teardown. The managed release...

SUSE CVE-2026-110944

Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server...

SUSE CVE-2026-111426

unknown...

SUSE CVE-2026-114550

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific...

SUSE CVE-2026-120642

CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some pathinfo and scriptname values, Accept results, and the name lists from urlparam and cookie are returned without the taint flag, as is a cookie named expires fr...

SUSE CVE-2026-120643

CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and selfurl. Both pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query parameter escaping produces, so an apostroph...

SUSE CVE-2026-120644

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request...

SUSE CVE-2026-120645

CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrollinglist. When rendering option groups, scrollinglist marks the selected options by interpolating each selected value, by default taken from the request parameters,...

SUSE CVE-2026-120646

CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo. uploadInfo dereferences its argument and calls its filename method without checking that it is an upload filehandle. A plain string naming a defined global...

SUSE CVE-2026-120647

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header-attachment = $name writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passe...

SUSE CVE-2026-120648

CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing -- closes the comment early. An application that passes request data to comment can be made to inject HTML into the page...