SUSE CVE-2026-100310

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

SUSE CVE-2026-100419

gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwriteexisting enabled, attackers can craft malicious repository trees...

SUSE CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

SUSE CVE-2026-100866

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

SUSE CVE-2026-100888

A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. This affects the function dkimcanonselecthdrs of the file libopendkim/dkim-canon.c of the component DKIM Signature Header Selection. Executing a manipulation of the argument h can lead to out-of-bounds write. The atta...

SUSE CVE-2026-100889

A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkimqpdecode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor w...

SUSE CVE-2026-101043

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

SUSE CVE-2026-101044

pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...

SUSE CVE-2026-57175

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...

SUSE CVE-2026-57176

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend userid as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Ven...

SUSE CVE-2026-57177

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...

SUSE CVE-2026-57178

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...

SUSE CVE-2026-57179

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could all...

SUSE CVE-2026-63132

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...

SUSE CVE-2026-80430

Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdirdatafordrag in kitty/dnd.c...

SUSE CVE-2026-80431

Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screenhandlemulticellcommand in kitty/screen.c appends each codepoint of a grapheme cluster...

SUSE CVE-2026-80432

Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because dropenqueuerequest in kitty/dnd.c...

SUSE CVE-2026-89032

BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between getsemanticcachetenantscope and getmetadatavariablename. Attackers...

SUSE CVE-2026-94574

A local cross-user code execution vulnerability exists in GNU wget Windows builds from eternallybored.org due to a hardcoded configuration file path C:\msys64 that is writable by unprivileged users, allowing for arbitrary code execution via the useaskpass directive, potentially allowing local...

SUSE CVE-2026-95622

unknown...

SUSE CVE-2026-95834

Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because dragremotefiledata in kitty/dnd.c holds a DragRemoteItem pointer into an arra...

SUSE CVE-2026-95835

Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handleremoteaskpass in kitty/window.py opens the POSIX shared memory...

SUSE CVE-2026-96747

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

SUSE CVE-2026-96749

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

SUSE CVE-2026-98163

In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea "cgroup: Move dyingtasks cleanup from cgrouptaskrelease to cgrouptaskfree" extended the lifetime of tasks on the dyingtasks list. The iterators ha...

SUSE CVE-2023-4860

Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-2270

unknown...

SUSE CVE-2026-53493

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage before container start, causing long ContainerCreating stalls and, at larger sizes, node/runtime instability...

SUSE CVE-2026-67233

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's isauthorized/2 delegates to rabbitmgmtutil:isauthorizedmonitor/2, which accepts the monitoring tag. But allowedmethods includes DELETE, and deleteresource/2...

SUSE CVE-2026-74860

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...

SUSE CVE-2026-77797

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files...

SUSE CVE-2026-77798

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...

SUSE CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

SUSE CVE-2026-88362

MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsRisindex in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. Th...

SUSE CVE-2026-88366

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvgpathArcTo when parsing SVG arc commands. A specially crafted SVG document containing extreme arc radius values can cause intermediate arc calculations to produce a NaN delta angle. The function subsequently...

SUSE CVE-2026-88367

NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvgcurveDivs during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division...

SUSE CVE-2026-88368

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvgaddActive function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. T...

SUSE CVE-2026-88370

libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled loadinibuffer.h utility and stripinicache. The bundled utility allocates exactly inilength bytes, while stripinicache unconditionally writes a NUL terminator at inisourceinilength, requiring an additional writab...

SUSE CVE-2026-88371

ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6 function. When processing specially crafted Code 128 input, decodee can return -1 for an invalid edge pattern, and decode6 subsequently left-shifts this negative signed value while constructing the edge...

SUSE CVE-2026-88372

libsndfile 1.2.2 contains an integer overflow vulnerability in mat4readheader when parsing crafted MAT4 MATLAB v4 files...

SUSE CVE-2026-88378

QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JSReadFunctionTag...

SUSE CVE-2026-88382

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

SUSE CVE-2026-88384

OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packeddata pointer. The OpaqueAttribute constructor passes...

SUSE CVE-2026-88386

libsndfile 1.2.2 contains a misaligned memory access issue in psfbinheaderreadf while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int and perform a 4-byte store. This results in undefined behavior leading to deni...

SUSE CVE-2026-88387

LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parsetiffifd when processing TIFF tag 0x00fe NewSubfileType. A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts thi...

SUSE CVE-2026-91837

A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters special characters that can execute...

SUSE CVE-2026-93215

In the Linux kernel, the following vulnerability has been resolved: cdx: Fix double free when sysfs file creation fails In cdxcreateresattr, if sysfscreatebinfile fails, the code frees resattr but doesn't set cdxdev-resattrnum to NULL. This leaves a dangling pointer in the array. Then...

SUSE CVE-2026-93221

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

SUSE CVE-2026-93223

In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix ofnodeput on VIP parse errors tegravipchannelofparse initializes np from dev-ofnode without taking a reference, but its error paths drop one through the errnodeput label. This underflows the...

SUSE CVE-2026-93228

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdrcheckwritechunk only rejects segcount rcmaxpages, so zero passes the range check, and xdrinlinedecodestrea...