35,560 results · Feed
-
Critical max 9.8SUSE-SU-2026:23677-1 6 CVEs
Security update for the Linux Kernel RT (Live Patch 1 for SUSE Linux Enterprise 16)
This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.6.1 fixes various security issues: The following security issues were fixed: - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267388). - CVE-2026-53360: KVM: SEV: Require …
first Sep 12, 2026 -
Critical max 9.8SUSE-SU-2026:23673-1 6 CVEs
Security update for the Linux Kernel RT (Live Patch 13 for SUSE Linux Enterprise 16)
This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.34.1 fixes various security issues: The following security issues were fixed: - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267388). - CVE-2026-53360: KVM: SEV: Require…
first Sep 12, 2026 -
Critical max 9.8SUSE-SU-2026:23672-1 6 CVEs
Security update for the Linux Kernel RT (Live Patch 12 for SUSE Linux Enterprise 16)
This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.33.1 fixes various security issues: The following security issues were fixed: - CVE-2026-46150: fanotify: fix false positive on permission events (bsc#1267388). - CVE-2026-53360: KVM: SEV: Require…
first Sep 12, 2026 -
Medium max 6.8SUSE-SU-2026:23671-1 2 CVEs
Security update for jq
This update for jq fixes the following issues: - CVE-2026-43895: embedded NUL bytes in import paths can lead to policy bypass and sensitive information disclosure (bsc#1265071). - CVE-2026-47770: stack overflow in deep structural equality (bsc#1269221).
first Sep 11, 2026 -
High max 7.1SUSE-SU-2026:23670-1 3 CVEs
Security update for acl, attr
This update for acl, attr fixes the following issue: - CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr, getfacl/setfacl/chacl, libacl (bsc#1268867). Changes for acl: - Update to 2.4.0 (jsc#PED-16501):…
first Sep 11, 2026 -
UnscoredSUSE-SU-2026:23662-1 0 CVEs
Security update for multipath-tools
This update for multipath-tools fixes the following issues: - Heap Out-of-Bounds Read in Custom Format String Parser via Trailing `%` (bsc#1277205). - Path traversal in device-mapper-multipath failed_wwids management (bsc#1277210). - SCSI PRIN READ FULL STATU…
first Sep 7, 2026 -
High max 7.2SUSE-SU-2026:23659-1 3 CVEs
Security update for aws-nitro-enclaves-cli
This update for aws-nitro-enclaves-cli fixes the following issues: - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274300). - CVE-2026-25727: time: parsing of user-provided input by the RFC 2822…
first Sep 7, 2026 -
High max 7.1SUSE-SU-2026:23656-1 2 CVEs
Security update for NetworkManager
This update for NetworkManager fixes the following issues: - CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696). - CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Ent…
first Sep 6, 2026 -
UnscoredSUSE-SU-2026:23646-1 0 CVEs
Security update for multipath-tools
This update for multipath-tools fixes the following issues: - Heap Out-of-Bounds Read in Custom Format String Parser via Trailing `%` (bsc#1277205). - Path traversal in device-mapper-multipath failed_wwids management (bsc#1277210). - SCSI PRIN READ FULL STATU…
first Sep 7, 2026 -
Medium max 6.2SUSE-SU-2026:23644-1 2 CVEs
Security update for libusb-1_0
This update for libusb-1_0 fixes the following issues: - CVE-2026-23679: NULL pointer dereference in `parse_interface()` allows attackers to crash applications by supplying a malformed USB configuration descriptor (bsc#1266664). - CVE-2026-47104: one-byte out…
first Sep 7, 2026 -
High max 7.2SUSE-SU-2026:23643-1 3 CVEs
Security update for aws-nitro-enclaves-cli
This update for aws-nitro-enclaves-cli fixes the following issues: - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274300). - CVE-2026-25727: time: parsing of user-provided input by the RFC 2822…
first Sep 7, 2026 -
High max 7.1SUSE-SU-2026:23639-1 2 CVEs
Security update for NetworkManager
This update for NetworkManager fixes the following issues: - CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696). - CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Ent…
first Sep 6, 2026 -
Critical max 9.1SUSE-SU-2026:23638-1 6 CVEs
Security update for curl
This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633). - CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440). - CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412). - CVE-20…
first Sep 6, 2026 -
Medium max 6.8SUSE-SU-2026:23636-1 2 CVEs
Security update for mcphost
This update for mcphost fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276612). - CVE-2026-81092: github.com/mark3labs/mcp-go/serv…
first Sep 6, 2026 -
High max 7.7SUSE-SU-2026:23635-1 1 CVE
Security update for php-composer2
This update for php-composer2 fixes the following issue: - CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL (bsc#1278257).
first Sep 6, 2026 -
Medium max 5.1SUSE-SU-2026:23634-1 1 CVE
Security update for python-sqlparse
This update for python-sqlparse fixes the following issue: - CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption (bsc#1278097).
first Sep 6, 2026 -
Medium max 6.5SUSE-SU-2026:23633-1 1 CVE
Security update for perl-URI
This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization in `nameprep` (bsc#1277886).
first Sep 6, 2026 -
Medium max 5.3SUSE-SU-2026:23630-1 1 CVE
Security update for msgpack-c
This update for msgpack-c fixes the following issue: Update to release 7.0.2: - CVE-2026-72854: Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation (bsc#1275911).
first Sep 6, 2026 -
High max 8.8SUSE-SU-2026:23579-1 24 CVEs
Security update for postgresql15
This update for postgresql15 fixes the following issues: - CVE-2026-6464: `psql` `COPY FROM STDIN` early failure processes data lines as `psql` commands (bsc#1275046). - CVE-2026-6469: `ALTER TABLE ALTER TYPE` resets extended statistics ownership (bsc#1275044…
first Aug 30, 2026 -
High max 8.8SUSE-SU-2026:23578-1 24 CVEs
Security update for postgresql14
This update for postgresql14 fixes the following issues: - CVE-2026-6464: `psql` `COPY FROM STDIN` early failure processes data lines as `psql` commands (bsc#1275046). - CVE-2026-6469: `ALTER TABLE ALTER TYPE` resets extended statistics ownership (bsc#1275044…
first Aug 30, 2026 -
High max 8.8SUSE-SU-2026:23577-1 28 CVEs
Security update for postgresql18
This update for postgresql18 fixes the following issues: - CVE-2026-6464: `psql` `COPY FROM STDIN` early failure processes data lines as `psql` commands (bsc#1275046). - CVE-2026-6469: `ALTER TABLE ALTER TYPE` resets extended statistics ownership (bsc#1275044…
first Aug 30, 2026 -
Critical max 9.6SUSE-SU-2026:23576-1 9 CVEs
Security update for go1.26-openssl
This update for go1.26-openssl fixes the following issues: Update to version 1.26.7 cut from the go1.25-fips-release branch at the revision tagged go1.26.7-1-openssl-fips. Security issues fixed: - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing d…
first Aug 30, 2026 -
High max 7.8SUSE-SU-2026:23575-1 1 CVE
Security update for udisks2
This update for udisks2 fixes the following issue: - CVE-2026-7867: insufficient authorization checks on the `as-user` option in the `org.freedesktop.UDisks2.Filesystem.Mount()` D-Bus method can lead to local privilege escalation (bsc#1274430).
first Aug 30, 2026 -
High max 8.8SUSE-SU-2026:23574-1 14 CVEs
Security update for 389-ds
This update for 389-ds fixes the following issues: Update to version 3.0.6~git382.7a51ea5f5. Security issues fixed: - CVE-2026-11610: heap buffer overflow in the SASL I/O layer via a crafted oversized LDAP UNBIND packet (bsc#1270695). - CVE-2026-11611: unboun…
first Aug 30, 2026 -
Critical max 9.6SUSE-SU-2026:23573-1 9 CVEs
Security update for go1.25-openssl
This update for go1.25-openssl fixes the following issues: Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips. Security issues fixed: - CVE-2026-33818: encoding/asn1: stack exhaustion when parsing…
first Aug 30, 2026 -
Medium max 6.9SUSE-SU-2026:23572-1 6 CVEs
Security update for gstreamer-devtools
This update for gstreamer-devtools fixes the following issues: - CVE-2025-4574: crossbeam-channel: internal `Channel` type's `Drop` method has a race condition that can lead to a double-free and memory corruption (bsc#1243178). - CVE-2025-58160: tracing-subsc…
first Aug 30, 2026 -
High max 7.1SUSE-SU-2026:23571-1 3 CVEs
Security update for python-aiohttp
This update for python-aiohttp fixes the following issues: - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate (bsc#1273125). - CVE-2026-69243: HTTP request smuggling via t…
first Aug 30, 2026 -
High max 8.7SUSE-SU-2026:23570-1 3 CVEs
Security update for python-cryptography
This update for python-cryptography fixes the following issues: - CVE-2026-69247: PKCS#7 `EnvelopedData` decryption exposes a Bleichenbacher oracle through distinguishable errors and timing (bsc#1273551). - CVE-2026-69248: verifier accepts wildcard DNS names …
first Aug 30, 2026 -
Low max 2.3SUSE-SU-2026:23567-1 1 CVE
Security update for rav1e
This update for rav1e fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted log input can allow ANSI escape sequence injection and terminal manipulation (bsc#1249016). Changes for rav1e: - Update cargo dependencies.
first Aug 30, 2026 -
Medium max 6.8SUSE-SU-2026:23564-1 1 CVE
Security update for librest
This update for librest fixes the following issue: - CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-random number generator (bsc#1272399).
first Aug 30, 2026 -
Medium max 5.3SUSE-SU-2026:23563-1 1 CVE
Security update for python-h2
This update for python-h2 fixes the following issue: - CVE-2026-71554: duplicate `Host` headers are accepted and forwarded to consuming applications, which can lead to request smuggling (bsc#1274386).
first Aug 30, 2026 -
High max 8.8SUSE-SU-2026:23562-1 4 CVEs
Security update for dhcpcd
This update for dhcpcd fixes the following issues: Update to 10.5.0. Security issues fixed: - CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980). - CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte sta…
first Aug 30, 2026 -
High max 8.7SUSE-SU-2026:23561-1 4 CVEs
Security update for python-sqlparse
This update for python-sqlparse fixes the following issues: - CVE-2026-54284: high algorithm complexity when parsing SQL payloads with hundreds of nesting levels can lead to denial of service via excessive resource consumption (bsc#1275459). - CVE-2026-59893:…
first Aug 30, 2026 -
High max 8.6SUSE-SU-2026:23552-1 8 CVEs
Security update for vim
This update for vim fixes the following issues: Updated to version 9.2.0957. Security issues fixed: - CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018). - CVE-2026-73071: use-after-free in JSON decoding can…
first Aug 28, 2026 -
Critical max 9.1SUSE-SU-2026:23551-1 5 CVEs
Security update for apr-util
This update for apr-util fixes the following issues: - CVE-2025-49506: hash/password content leak via side channel timing attack against `apr_password_validate()` (bsc#1274237). - CVE-2026-32327: XML stack recursion crash (bsc#1274235). - CVE-2026-34191: SQL …
first Aug 28, 2026 -
Medium max 6.9SUSE-SU-2026:23550-1 1 CVE
Security update for gzip
This update for gzip fixes the following issues: - CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state between different decompression formats within a single execution (bsc#1269623, bsc#1272554).
first Aug 27, 2026 -
Critical max 9.6SUSE-SU-2026:23548-1 5 CVEs
Security update for google-osconfig-agent
This update for google-osconfig-agent fixes the following issues: This update for google-osconfig-agent fixes the following issues: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118). - CVE-2026-8430…
first Sep 10, 2026 -
UnscoredSUSE-SU-2026:23547-1 0 CVEs
Security update for libzypp, zypper
This update for libzypp, zypper fixes the following issues: Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state [LIBZYPP-LEGACY-CACHE-01] (bsc#1274625). - hasCredentials() requires both username AND password to be non-empty (bs…
first Sep 9, 2026 -
High max 8.7SUSE-SU-2026:23546-1 3 CVEs
Security update for helm
This update for helm fixes the following issues: - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278270). - CVE-2026-84304: …
first Sep 9, 2026 -
Critical max 9.8SUSE-SU-2026:4380-1 6 CVEs
Security update for 389-ds
This update for 389-ds fixes the following issues: - CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133). - CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denia…
first Sep 28, 2026