rpm package
opensuse/govulncheck-vulndb&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
Vulnerabilities (1,722)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-8781 | Med | 4.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 18, 2026 | A security flaw has been discovered in omec-project amf up to 2.1.3-dev. The impacted element is the function RANConfiguration of the file ngap/handler.go. The manipulation results in null pointer dereference. The attack may be launched remotely. The exploit has been released to | |
| CVE-2026-8780 | Med | 4.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 18, 2026 | A vulnerability was identified in omec-project amf up to 2.1.3-dev. The affected element is an unknown function of the file ngap/dispatcher.go of the component NGAP Message Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit is | |
| CVE-2026-8779 | Med | 4.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 18, 2026 | A vulnerability was determined in omec-project amf up to 2.1.3-dev. Impacted is the function NGSetupRequest of the file ngap/handler.go. Executing a manipulation of the argument InformationElement can lead to memory corruption. The attack can be launched remotely. The exploit has | |
| CVE-2026-4054 | Med | 4.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 15, 2026 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under a non-SVG Content-Type header | |
| CVE-2026-4053 | Low | 3.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 15, 2026 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API | |
| CVE-2026-44774 | Cri | 9.9 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 15, 2026 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gat | |
| CVE-2026-44310 | Med | 5.4 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 15, 2026 | Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length. A CMS/PK | |
| CVE-2026-44309 | Med | 5.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 15, 2026 | Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying agains | |
| CVE-2026-45803 | Low | 3.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 15, 2026 | `gh` is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-faile | |
| CVE-2026-44671 | Hig | 7.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 14, 2026 | ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search f | |
| CVE-2026-44428 | Med | 4.7 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 14, 2026 | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client sid | |
| CVE-2026-44427 | Non | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 14, 2026 | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path (e.g | |
| CVE-2026-45781 | Low | 3.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 14, 2026 | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github./* nam | |
| CVE-2026-44430 | Med | 4.0 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 14, 2026 | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification (POST /v0/auth/http, POST /v0.1/auth/http) uses safeDialContext (internal/api/handlers/v0/auth/http.go:67-110) to | |
| CVE-2026-44429 | Med | 5.4 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 14, 2026 | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/handlers/v0/ui_index.html) is vulnerable to stored cross-site scripting via the server.websiteUrl field | |
| CVE-2026-8634 | Cri | 9.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 14, 2026 | Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attac | |
| CVE-2026-46356 | Hig | 7.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 14, 2026 | Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force login attempts or other abuse against Fl | |
| CVE-2026-26191 | Cri | 9.8 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 14, 2026 | Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall i | |
| CVE-2026-26062 | Med | 6.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 14, 2026 | Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service (DoS) issue in the gRPC Launcher `PublishLogs` endpoint. In affected versions, certain unexpected input values were not handled gracefully, which could cause the Fleet se | |
| CVE-2026-24899 | Hig | 7.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 14, 2026 | Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authentication tokens from any Azure AD tenant to be accepted. Because Fleet validates JWT signatures using Microsoft's multi-tenant JWKS endpoi |
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
A security flaw has been discovered in omec-project amf up to 2.1.3-dev. The impacted element is the function RANConfiguration of the file ngap/handler.go. The manipulation results in null pointer dereference. The attack may be launched remotely. The exploit has been released to
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
A vulnerability was identified in omec-project amf up to 2.1.3-dev. The affected element is an unknown function of the file ngap/dispatcher.go of the component NGAP Message Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit is
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
A vulnerability was determined in omec-project amf up to 2.1.3-dev. Impacted is the function NGSetupRequest of the file ngap/handler.go. Executing a manipulation of the argument InformationElement can lead to memory corruption. The attack can be launched remotely. The exploit has
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under a non-SVG Content-Type header
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gat
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length. A CMS/PK
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying agains
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
`gh` is GitHub’s official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-faile
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames before incorporating them into LDAP search f
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client sid
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path (e.g
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github./* nam
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification (POST /v0/auth/http, POST /v0.1/auth/http) uses safeDialContext (internal/api/handlers/v0/auth/http.go:67-110) to
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/handlers/v0/ui_index.html) is vulnerable to stored cross-site scripting via the server.websiteUrl field
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attac
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force login attempts or other abuse against Fl
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall i
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service (DoS) issue in the gRPC Launcher `PublishLogs` endpoint. In affected versions, certain unexpected input values were not handled gracefully, which could cause the Fleet se
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authentication tokens from any Azure AD tenant to be accepted. Because Fleet validates JWT signatures using Microsoft's multi-tenant JWKS endpoi
Page 26 of 87