An always-incorrect control flow implementation in firmware for some Intel Xeon processors may allow a local escalation of privilege by a system software adversary with a privileged user context. The attack requires high complexity and special internal knowledge, with no user interaction needed. The vulnerability can lead to high confidentiality and integrity impacts on the affected system.
A race condition in hardware logic affects some 3rd Gen Intel Xeon Scalable Processors, allowing unprivileged software to cause a denial of service. The vulnerability requires local access and an authenticated user with high attack complexity. It impacts system availability but does not affect confidentiality or integrity.
A security update for libpng16 addresses multiple issues by updating the version to 1.6.58. The update is provided by the SUSE Product Security Team. No specific details about the vulnerabilities fixed or affected versions are provided.
Multiple vulnerabilities have been identified and fixed in the libssh2_org library by the SUSE Product Security Team. These include out-of-bounds heap reads, integer overflows, heap buffer overflows, uninitialized pointer frees, double-free leading to arbitrary code execution, denial of service via integer underflow, and information disclosure. The flaws affect various functions such as sftp_symlink(), userauth_password(), and SSH negotiation components. The update addresses these critical security issues to prevent potential arbitrary code execution, denial of service, and information leaks.
Multiple security issues have been addressed in the libssh2-1-1.11.1-4.1 package available on the GA media of openSUSE Tumbleweed. These fixes pertain to vulnerabilities identified by several CVEs including CVE-2026-58050 and others. No detailed technical information or specific impacts are provided in the available data.
This security update for OpenSSH addresses multiple vulnerabilities including improper file location constraints in sftp downloads, directory traversal in scp between remote destinations, argument truncation in internal-sftp command lines, undocumented security behavior in Windows Active Directory GSSAPI, forwarding and tunneling configuration conflicts, pre-authentication denial of service via GSSAPI, authentication delay enforcement issues, and a client-side use-after-free during host key reexchange. These issues collectively pose risks such as unauthorized file placement, denial of service, and potential memory corruption.
A vulnerability in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform allows a compromised Windows worker node to escalate privileges to cluster-administrator level. The flaw involves improper validation of Certificate Signing Requests (CSRs), where additional organization values such as system:masters are not rejected, enabling privilege escalation. This affects OpenShift clusters running WMCO with Windows nodes. No mitigation or workaround is currently available, and a fix is expected in future updates.
An elevation of privilege vulnerability exists in Windows Presentation Foundation (WPF) in Microsoft .NET 8, 9, and 10 when parsing specially crafted XAML input. This vulnerability could allow an attacker to elevate privileges on the affected system. The issue is due to improper control of code generation (CWE-94). Affected package versions have been identified and patched in newer releases.
A security update for the SUSE Linux Enterprise 16.0 kernel addresses multiple security vulnerabilities across various kernel components. The update fixes issues including use-after-free, deadlocks, information leaks, infinite loops, and other bugs affecting networking, filesystems, Bluetooth, and more. These vulnerabilities have been assigned CVE identifiers and are resolved in the updated kernel version.
A denial of service vulnerability exists in the .NET HTTP client (System.Net.Http) affecting .NET versions 8, 9, and 10. The flaw allows an attacker to exploit the HTTP/2 protocol to cause an out-of-memory condition, leading to service disruption. This vulnerability is identified as CWE-770, involving allocation of resources without limits or throttling. Microsoft has released patches for affected versions to address this issue.
A denial of service vulnerability exists in Microsoft .NET TLS/SSL (System.Net.Security) affecting .NET versions 8, 9, and 10. An attacker can send a malformed TLS handshake request causing the application to crash or become unresponsive. This vulnerability is tracked as CVE-2026-50524 and has a CVSS 3.1 score of 7.5 (high severity).