Threat database

A security update for forgejo-cli addresses an integer overflow vulnerability in the vendored bytes crate (CVE-2026-25541) that could corrupt tracked capacity and lead to out-of-bounds slices. The update also includes multiple feature additions, localization support, and various fixes unrelated to security. No known exploits are reported. The update is provided by the SUSE Product Security Team.

This security update for the kitty terminal emulator addresses multiple issues including regressions in Wayland support, memory leaks, crashes, and usability improvements. The update spans versions 0.48.0 through 0.48.2 and fixes bugs such as broken drag and drop on Plasma, a memory leak introduced in version 0.40.0, and various Wayland compositor compatibility problems. No explicit security vulnerability details or exploit information are provided in the update notes.

Multiple security issues were fixed in the redis-8.10.1-1.1 package distributed with openSUSE Tumbleweed. The vulnerabilities addressed are related to the SUSE Redis package version 8.10.1-1.1. No specific details about the nature of the vulnerabilities or affected versions are provided.

PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fix(es): * pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading (CVE-2026-5674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A security update for htop addresses an out-of-bounds access vulnerability (CVE-2024-37676) in the settings parser that could be triggered by tampered configuration files. The update improves the htoprc settings parser to prevent segmentation faults and hardens it against malformed inputs. The vulnerability is fixed by sanitizing sort keys, validating configuration invariants, and ensuring NULL safety. openSUSE is assessed as not affected by this issue.

This security update for Chromium addresses multiple use-after-free vulnerabilities in various components including V8, TabStrip, Extensions, HTML, and Blink. These issues are fixed in Chromium version 151.0.7922.137. The vulnerabilities are identified by CVE IDs CVE-2026-19556 through CVE-2026-19560 and are classified with high severity.

Multiple security issues were addressed in the kubeshark-cli package versions prior to 53.4.0-1.1 on openSUSE Tumbleweed. These vulnerabilities affect several versions of the software and have been fixed in the updated package. The issues are classified with medium severity and relate to CWE-862 (Missing Authorization).

This security update for git-cliff addresses multiple issues including two notable vulnerabilities: CVE-2026-25541, an integer overflow in the 'BytesMut:reserve' function that can cause undefined behavior and crashes, and CVE-2025-55159, an incorrect bounds check in the 'get_disjoint_mut' function that can lead to undefined behavior or potential crashes due to out-of-bounds access. The update to version 2.13.1 includes these fixes along with various feature enhancements and bug fixes.

This security update for the SUSE product addresses multiple vulnerabilities in OpenSSL, including out-of-bounds reads and writes, stack corruption, information leaks, undefined behavior, and heap buffer overflows. These issues affect various OpenSSL components such as PEM password callbacks, AES key wrapping, digest finalization, PSK and cookie trampolines, OCSP URL processing, and cipher update operations. The vulnerabilities have been assigned CVE identifiers ranging from CVE-2026-41677 to CVE-2026-45784. No specific affected versions are provided in the available data.

Important: kernel security update

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.

A security update for amazon-ecs-init addresses CVE-2026-10722, an integer overflow vulnerability in the github.com/cilium/ebpf library. This overflow occurs during BTF string offset boundary checks and can cause a crash when malformed ELF/BTF input is parsed. The update also includes various enhancements and bug fixes.

This update for ldns fixes the following issue - CVE-2026-10846: when ldns is used by applications for (stub) resolving, it does not sufficiently verify that received responses belong to a sent query (bsc#1267670).

MariaDB server versions with the wsrep_notify_cmd feature enabled are vulnerable to command injection via the name of a joiner node. This vulnerability allows remote attackers to execute arbitrary shell commands on the server, potentially leading to full system compromise. Multiple MariaDB versions are affected. A security update is available that fixes this issue. Disabling the wsrep_notify_cmd feature is a recommended workaround for those unable to upgrade immediately.

This security update for Chromium addresses multiple critical vulnerabilities including use-after-free, out-of-bounds writes, heap buffer overflows, race conditions, integer overflows, and insufficient validation of untrusted input. These issues affect various components such as WebGL, Aura, Skia, V8, GPU, and Views. The update fixes these vulnerabilities in Chromium version 151.0.7922.109. The vulnerabilities are critical due to their potential to cause memory corruption and other severe impacts.

A security update for GraphicsMagick addresses CVE-2026-56379, which involves arbitrary MVG drawing command injection via the SVG decoder when processing specially crafted SVG files. This vulnerability could allow an attacker to inject malicious drawing commands during SVG processing.

Multiple security issues were addressed in the python313-scikit-learn-1.9.0-1.1 package on the GA media of openSUSE Tumbleweed. The vulnerabilities have been fixed in this package version. No specific details about the nature of the vulnerabilities or affected versions are provided.

A Server-Side Request Forgery (SSRF) bypass vulnerability exists in stunnel versions 5.79 and earlier when configured with the non-default 'protocol = socks' setting. This flaw allows an attacker who can reach the SOCKS proxy to bypass localhost restrictions by using IPv4-mapped IPv6 or unspecified addresses, potentially accessing services bound to the local interface that should not be network-accessible. Exploitation depends on the presence and security of such local services. The vulnerability has a medium severity rating.

This security update for perl-Date-Manip addresses two vulnerabilities: CVE-2026-60074, which causes corrupted dates when processing non-ASCII decimal digits that pass numeric range checks, and CVE-2026-60075, which leads to CPU exhaustion due to quadratic backtracking in the unanchored time substitution in the _parse_time function. Both issues have been fixed in this update.