rpm package
opensuse/govulncheck-vulndb&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
Vulnerabilities (1,722)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-42297 | Hig | 8.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 9, 2026 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operat | |
| CVE-2026-42296 | Hig | 8.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 9, 2026 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, | |
| CVE-2026-42295 | Med | 4.9 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 9, 2026 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azur | |
| CVE-2026-42294 | Hig | 7.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 9, 2026 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. Thi | |
| CVE-2026-42183 | Med | 6.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 9, 2026 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization() causes a panic (denial of service) for SSO users | |
| CVE-2026-42339 | Hig | 7.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 8, 2026 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. In versions 0.11.9-alpha.1 and prior, the SSRF protection introduced in v0.9.0.5 (CVE-2025-59146) and hardened in v0.9.6 (CVE-2025-62155) does not block the unspecified addres | |
| CVE-2026-41520 | Hig | 7.9 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 8, 2026 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled. Thi | |
| CVE-2026-41432 | Hig | 7.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 8, 2026 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to th | |
| CVE-2026-42072 | Cri | 9.8 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 8, 2026 | Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but | |
| CVE-2026-41889 | Cri | 9.8 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 8, 2026 | pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placehol | |
| CVE-2026-41070 | Cri | 10.0 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 8, 2026 | openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by Ope | |
| CVE-2026-41574 | Cri | 9.8 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 8, 2026 | Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incoming OAuth identity to an existing Nhost account when the email addresses match. This is only safe when the email has been verified by the OAuth provider. Nhost's | |
| CVE-2026-41491 | Hig | 8.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 8, 2026 | Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found in Dapr that allows bypassing access contr | |
| CVE-2026-42275 | Hig | 8.7 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 8, 2026 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared Dri | |
| CVE-2026-42274 | Hig | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 8, 2026 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. | |
| CVE-2026-42273 | Hig | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 8, 2026 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failing to match a rule fo | |
| CVE-2026-42272 | Hig | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 8, 2026 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (% | |
| CVE-2026-41646 | Med | 5.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 8, 2026 | Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the defa | |
| CVE-2026-41645 | Med | 5.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 8, 2026 | Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens w | |
| CVE-2026-42880 | Cri | 9.6 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | May 7, 2026 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to ex |
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zero authorization checks on all CRUD operat
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts,
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azur
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. Thi
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization() causes a panic (denial of service) for SSO users
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. In versions 0.11.9-alpha.1 and prior, the SSRF protection introduced in v0.9.0.5 (CVE-2025-59146) and hardened in v0.9.6 (CVE-2025-62155) does not block the unspecified addres
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled. Thi
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to th
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed through to the HTTP server correctly but
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placehol
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by Ope
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incoming OAuth identity to an existing Nhost account when the email addresses match. This is only safe when the email has been verified by the OAuth provider. Nhost's
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before 1.17.5, a vulnerability has been found in Dapr that allows bypassing access contr
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. When a symbolic link inside the shared Dri
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failing to match a rule fo
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (%
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the defa
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute supported DSL expressions. This happens w
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to ex
Page 30 of 87