A buffer overflow vulnerability exists in the cryptography library when non-contiguous Python buffers are passed to certain APIs such as Hash.update(). This flaw affects versions from 45.0.0 up to but not including 46.0.7 and can cause reading past the end of the buffer in Python versions greater than 3.11. The vulnerability has a critical severity with a CVSS score of 9.8. A patch is available in version 46.0.7.
This security update for libpng16 addresses two vulnerabilities: CVE-2026-33416, a use-after-free issue via pointer aliasing in png_set_tRNS and png_set_PLTE that can lead to arbitrary code execution, and CVE-2026-33636, an out-of-bounds read/write in palette expansion on ARM Neon that can cause information leaks and crashes.
A vulnerability in the cbor2 library used by Red Hat AI Inference Server allows information disclosure when a CBORDecoder instance is reused across multiple decode operations involving untrusted data. This flaw causes sensitive data from previously decoded messages to persist in memory and be accessible to attacker-controlled messages. The issue affects Red Hat AI Inference Server, Red Hat Enterprise Linux AI, and Red Hat OpenShift AI when processing untrusted CBOR data with reused decoders. No official fix is currently available, and mitigation involves avoiding reuse of CBORDecoder instances across trust boundaries.
A path traversal vulnerability in onnx prior to version 1.21.0 allows an attacker to bypass symlink checks and read arbitrary files outside the intended model or user directory. This occurs because the symlink check uses std::filesystem::is_regular_file, which follows symlinks and thus can be bypassed. An attacker can craft a model with external data referencing a symlink to sensitive files, leading to unauthorized file reads when the model is loaded.
Traefik's Basic and Digest authentication middlewares are vulnerable to identity spoofing when the 'headerField' is configured with a non-canonical HTTP header name. An authenticated attacker with valid credentials can inject a canonical header version to impersonate any user identity to backend services. This occurs because Traefik writes the authenticated username using a non-canonical header key, creating a separate header entry that does not overwrite the attacker-injected canonical header. The vulnerability enables privilege escalation if backends rely on this header for authorization decisions. Patches fixing this issue are available in Traefik versions 2.11.42, 3.6.12, and 3.7.0-ea.3.
NLTK's downloader component suffers from a path traversal vulnerability due to improper validation of XML index attributes. This flaw allows an attacker controlling a remote XML index server to specify malicious paths with traversal sequences, leading to arbitrary directory creation and file overwrite on the victim's file system, including critical system files. The vulnerability affects NLTK versions prior to 3.9.4. A patch is available in version 3.9.4.
This security update for libpng16 addresses multiple vulnerabilities including a heap buffer overflow (CVE-2026-25646) and memory leaks (CVE-2025-28162 and CVE-2025-28164) related to the png_set_dither/png_set_quantize functions and the pngimage utility. These issues were fixed by the SUSE Product Security Team.
Multiple security issues were addressed in the giflib-devel-32bit-5.2.2-3.1 package on the GA media of openSUSE Tumbleweed. The update fixes vulnerabilities present in prior versions of this package.
NLTK versions up to and including 3.9.2 contain a path traversal vulnerability in multiple CorpusReader classes, allowing attackers to read arbitrary files on the server. This occurs due to improper sanitization of file paths in classes such as WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. Exploitation can lead to unauthorized access to sensitive files and potentially escalate to remote code execution when combined with other vulnerabilities. A fix is available in version 3.9.3.
This security update for python-urllib3 addresses multiple vulnerabilities related to excessive resource consumption and resource exhaustion during data decompression in various scenarios, including the Streaming API, decompression chains, and HTTP redirect responses.
A security update for libpng12 addresses a heap buffer overflow vulnerability in the png_set_dither and png_set_quantize functions. This flaw is identified as CVE-2026-25646 and was reported by the SUSE Product Security Team. The vulnerability could lead to memory corruption issues if exploited.
Apache Tomcat and Tomcat Native contain an improper input validation vulnerability in their OCSP response handling. This flaw allows bypassing certificate revocation checks because Tomcat Native and Tomcat's FFM port did not complete verification or freshness checks on OCSP responses. The vulnerability affects multiple versions of Apache Tomcat Native and Apache Tomcat. Fixed versions have been released to address this issue.