35,560 results · Feed
-
Critical max 9.8openSUSE-SU-2026:22095-1 13 CVEs
Security update for go1.26
This update for go1.26 fixes the following issues: Update to go 1.26.9 (bsc#1255111): - CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766). - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization a…
first Oct 13, 2026 -
Critical max 9.8openSUSE-SU-2026:22093-1 15 CVEs
Security update for go1.27
This update for go1.27 fixes the following issues: Update to go1.27.2 (bsc#1272545): - CVE-2026-56857: os: Root.Mkdir(All) can follow junctions out of the root on Windows (bsc#1284766). - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization af…
first Oct 13, 2026 -
Critical max 9.2openSUSE-SU-2026:22090-1 5 CVEs
Security update for iperf
This update for iperf fixes the following issues: - CVE-2026-71217: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion (bsc#1284405). - CVE-2026-71218: unbounded peer-controlled allocation…
first Oct 12, 2026 -
High max 7.5openSUSE-SU-2026:22089-1 2 CVEs
Security update for podman
This update for podman fixes the following issues: Security issues fixed: - CVE-2026-55686: Podman: WORKDIR symlink traversal vulnerability (bsc#1268579). - CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables i…
first Oct 12, 2026 -
Medium max 6.5openSUSE-SU-2026:22088-1 2 CVEs
Security update for stunnel
This update for stunnel fixes the following issues: - CVE-2026-70367: incomplete IP address filtering in SOCKS proxy mode can allow localhost restriction bypasses (bsc#1274207). - CVE-2026-70368: oversized log messages in logging routines can cause stack out-…
first Oct 12, 2026 -
High max 8.5openSUSE-SU-2026:22085-1 12 CVEs
Security update for xwayland
This update for xwayland fixes the following issues: - CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213). - CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218). - CVE-2026-93516: X.Org Server XInput Passive Grab Use-…
first Oct 12, 2026 -
UnscoredopenSUSE-SU-2026:22084-1 0 CVEs
Security update for libpng16
This update for libpng16 fixes the following issue: - CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression (bsc#1283183). Changes for libpng16: - version update to 1.6.59: * Fixed CVE-2026-46675 (med…
first Oct 10, 2026 -
High max 7.0openSUSE-SU-2026:22083-1 1 CVE
Security update for gcc13
This update for gcc13 fixes the following issue: Update to GCC 13.5: - CVE-2026-102010: UAF due to improper pointer update when an application calls the `erase_if` function on a binary heap priority queue in `libstdc++` (bsc#1283123).
first Oct 9, 2026 -
Critical max 9.1openSUSE-SU-2026:22082-1 9 CVEs
Security update for unbound
This update for unbound fixes the following issues: - CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' (bsc#1280403). - CVE-2026-77955: Possible ZONEMD verification bypass window (bsc#1280404). - CVE-2026-78227: Use-after-free in DoQ stream out…
first Oct 9, 2026 -
Medium max 5.3openSUSE-SU-2026:22077-1 1 CVE
Security update for fetchmail
This update for fetchmail fixes the following issue: - CVE-2026-94184: stack-based buffer overflow in NTLM authentication can lead to remote code execution or process termination (bsc#1282055).
first Oct 9, 2026 -
Critical max 9.2openSUSE-SU-2026:22080-1 5 CVEs
Security update for squid
This update for squid fixes the following issues: - CVE-2026-32748: denial of service in ICP Request handling (bsc#1260453). - CVE-2026-33515: out of bounds read in ICP message handling (bsc#1260454). - CVE-2026-33526: denial of service in ICP Request handlin…
first Oct 9, 2026 -
Medium max 6.8openSUSE-SU-2026:22079-1 1 CVE
Security update for virtiofsd
This update for virtiofsd fixes the following issue: - CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257912). Changes for virtiofsd: * Update the time crate (bsc#1257912, CVE-2026-25727) * …
first Oct 9, 2026 -
High max 7.5openSUSE-SU-2026:22078-1 1 CVE
Security update for google-osconfig-agent
This update for google-osconfig-agent fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283672). Changes for…
first Oct 9, 2026 -
Critical max 9.8
Security update for webkit2gtk3
This update for webkit2gtk3 fixes the following issues: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (bsc#1284619): - CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via…
first Oct 9, 2026 -
Medium max 5.5openSUSE-SU-2026:22075-1 2 CVEs
Security update for agama
This update for agama fixes the following issues: Changes in agama: - Added support for the "inst.listen_on" boot parameter - The "inst.remote=0" option disables remote access (needed for CC compliant installation jsc#PED-16702) - It is possible to specify IP…
first Oct 12, 2026 -
Critical max 9.1openSUSE-SU-2026:22074-1 10 CVEs
Security update for python-PyJWT
This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint (bsc#1283060). - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTT…
first Oct 9, 2026 -
Medium max 5.9openSUSE-SU-2026:22073-1 1 CVE
Security update for python-jwcrypto
This update for python-jwcrypto fixes the following issue: - CVE-2026-92091: `JWK.import_key()` validates the `key_ops` JWK member for duplicate values using a quadratic complexity algorithm, which allows attackers to cause a denial of service via excessive r…
first Oct 9, 2026 -
High max 8.7openSUSE-SU-2026:22072-1 9 CVEs
Security update for openvpn
This update for openvpn fixes the following issues: - CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126). - CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127). - CVE-2026-12996: Potential DoS and memory leak via TLS session use-a…
first Oct 9, 2026 -
High max 8.9openSUSE-SU-2026:22071-1 3 CVEs
Security update for python-urllib3
This update for python-urllib3 fixes the following issues: - CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override (bsc#1283908). - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (b…
first Oct 9, 2026 -
Medium max 6.3openSUSE-SU-2026:22070-1 1 CVE
Security update for python-hpack
This update for python-hpack fixes the following issue: - CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime (bsc#1283035).
first Oct 9, 2026 -
High max 8.6openSUSE-SU-2026:22069-1 1 CVE
Security update for pacemaker
This update for pacemaker fixes the following issues: Security issue fixed: - CVE-2026-10649: denial of service via integer overflow in remote message decompression (bsc#1268381). Changes for pacemaker: Update to version 3.0.3+20260728.7052efa194: - cts: make…
first Oct 9, 2026 -
Critical max 9.5openSUSE-SU-2026:22068-1 7 CVEs
Security update for hawk2
This update for hawk2 fixes the following issues: - CVE-2026-42246: net-imap: MITM attacker can cause Net::IMAP#starttls to return successfully, without starting TLS (bsc#1268996). - CVE-2026-66066: unsafe image processing operations on untrusted uploads can …
first Oct 9, 2026 -
High max 7.5openSUSE-SU-2026:22067-1 6 CVEs
Security update for busybox
This update for busybox fixes the following issues: - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted `ClientKeyExchange` message (bsc#1282575). - CVE-2026…
first Oct 9, 2026 -
High max 8.8openSUSE-SU-2026:22065-1 1 CVE
Security update for pgvector
This update for pgvector fixes the following issue: - CVE-2026-103484: database users with the ability to create an IVFFlat index can write data out-of-bounds, which can lead to arbitrary code execution (bsc#1284129). Changes for pgvector: - Updated to versio…
first Oct 9, 2026 -
High max 8.7openSUSE-SU-2026:22064-1 6 CVEs
Security update for cosign
This update for cosign fixes the following issues: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272117). - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass a…
first Oct 9, 2026 -
Medium max 6.5openSUSE-SU-2026:22055-1 3 CVEs
Security update for libX11
This update for libX11 fixes the following issues: - CVE-2026-94283: out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser (bsc#1281653). - CVE-2026-94284: out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration p…
first Oct 8, 2026 -
High max 7.4openSUSE-SU-2026:22054-1 7 CVEs
Security update for libXi
This update for libXi fixes the following issues: - CVE-2026-93541: out-of-bounds read in XQueryDeviceState() (bsc#1281605). - CVE-2026-93542: out-of-bounds read in XI2 class parsing via size_classes() and copy_classes() (bsc#1281606). - CVE-2026-93543: out-o…
first Oct 8, 2026 -
UnscoredopenSUSE-SU-2026:22053-1 0 CVEs
Security update for ntfs-3g_ntfsprogs
This update for ntfs-3g_ntfsprogs fixes the following issues: - Denial-of-service in ntfs_inode_attach_all_extents() (bsc#1281758). - Heap buffer overflow in ntfs_acl_owner() (bsc#1281756). - Heap buffer overflow in ntfs_check_restart_area() (bsc#1281759). - …
first Oct 8, 2026 -
Medium max 6.1openSUSE-SU-2026:22048-1 1 CVE
Security update for swtpm
This update for swtpm fixes the following issues: Security issue fixed: - CVE-2026-75900: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch (bsc#1275653). Changes for swtpm: Update to 0.10.2: * Properly check for …
first Oct 7, 2026 -
High max 7.5openSUSE-SU-2026:22045-1 10 CVEs
Security update for php8
This update for php8 fixes the following issues: - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser (bsc#1282981). - CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing (bsc#1283216). - CVE…
first Oct 7, 2026 -
Critical max 9.8openSUSE-SU-2026:22063-1 1 CVE
Security update for ghostscript
This update for ghostscript fixes the following issue: - CVE-2026-39919: heap-based buffer overflow in the JPEG 2000 output adapter allows attackers to cause memory corruption by supplying crafted PDFs (bsc#1280620). Changes for ghostscript: - Version upgrade…
first Oct 9, 2026 -
Critical max 9.3openSUSE-SU-2026:22060-1 2 CVEs
Security update for python-anyio
This update for python-anyio fixes the following issues: - CVE-2026-63374: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing (bsc#1281476). - CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr…
first Oct 8, 2026 -
High max 7.5openSUSE-SU-2026:22059-1 3 CVEs
Security update for python-tornado6
This update for python-tornado6 fixes the following issues: - CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection (bsc#1277725). - …
first Oct 8, 2026 -
High max 7.5openSUSE-SU-2026:22057-1 3 CVEs
Security update for helm
This update for helm fixes the following issues: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642). - CVE-2026-81870: OpenTelem…
first Oct 8, 2026 -
Medium max 5.5openSUSE-SU-2026:22056-1 1 CVE
Security update for libXpm
This update for libXpm fixes the following issue: - CVE-2026-94287: denial of service via unsigned underflow in libXpm's write path (bsc#1281669).
first Oct 8, 2026 -
Low max 3.7openSUSE-SU-2026:22052-1 2 CVEs
Security update for libheif
This update for libheif fixes the following issues: - CVE-2026-84449: hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV (bsc#1281829). - AV1/libaom path allows allocation before libheif rejects mismatched coded dimensions (bsc#1281953). - Caller-configured sec…
first Oct 8, 2026 -
High max 7.8openSUSE-SU-2026:22051-1 1 CVE
Security update for librsvg
This update for librsvg fixes the following issues: - CVE-2026-96889: use-after-free when XML includes have duplicated entities (bsc#1282612). Changes for librsvg: - Update to version 2.60.3: - Dependency updates: lopdf for RUSTSEC-2026-0187, crossbeam-epoch …
first Oct 8, 2026 -
High max 7.5openSUSE-SU-2026:22050-1 11 CVEs
Security update for strongswan
This update for strongswan fixes the following issues: - CVE-2026-78123: Undefined Memory Access When Handling PKCS#7 Containers (bsc#1276533). - CVE-2026-78124: Memory Leak When Processing Certificates in PKCS#7 Containers (bsc#1276534). - CVE-2026-78126: NU…
first Oct 8, 2026 -
High max 7.5openSUSE-SU-2026:22049-1 14 CVEs
Security update for bind
This update for bind fixes the following issues: - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (bsc#1280430). - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver (bsc#1280432)…
first Oct 7, 2026 -
High max 8.8openSUSE-SU-2026:22047-1 2 CVEs
Security update for qemu
This update for qemu fixes the following issues: Security issues fixed: - CVE-2026-81627: missing writable RAM alias validation in the VAPIC setup hypercall allows a privileged guest user to bypass chipset `D_LCK` protection and injecting code into System Man…
first Oct 7, 2026