opensuse/govulncheck-vulndb&distro=openSUSE Leap 16.0

Vulnerabilities (1,722)

• CVE-2026-33066CriMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the backend renderREADME function uses lute.New() without calling SetSanitize(true), allowing raw HTML embedded in Markdown to pass through unmodified. The frontend then assigns the rendered HTML to in

• CVE-2026-33191HigMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte injection in URL path parameters. A remote attacker can inject null bytes (URL-encoded as %00) into the supi path parameter of the

• CVE-2026-33065MedMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500 Internal Server Error when handling DELETE requests with an empty supi path

• CVE-2026-33064HigMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to procedure panic caused by Nil Pointer Dereference in the /sdm-subscriptions endpoint. A remote attacker can cause the UDM service to panic an

• CVE-2026-33022MedMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can creat

• CVE-2026-32768CriMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can pivot from an instance to any Pod out of the origin namespace. This breaks the security-by-default prop

• CVE-2026-32953MedMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Tillitis TKey Client package is a Go package for a TKey client. Versions 1.2.0 and below contain a critical bug in the tkeyclient Go module which causes 1 out of every 256 User Supplied Secrets (USS) to be silently ignored, producing the same Compound Device Identifier (CDI)—and

• CVE-2026-32941MedMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Sliver is a command and control framework that uses a custom Wireguard netstack. Versions 1.7.3 and below contain a Remote OOM (Out-of-Memory) vulnerability in the Sliver C2 server's mTLS and WireGuard C2 transport layer. The socketReadEnvelope and socketWGReadEnvelope functions

• CVE-2026-32940CriMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  SiYuan is a personal knowledge management system. In versions 3.6.0 and below, SanitizeSVG has an incomplete blocklist — it blocks data:text/html and data:image/svg+xml in href attributes but misses data:text/xml and data:application/xml, both of which can render SVG with JavaScr

• CVE-2026-32938CriMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file:// links in pasted HTML into the workspace assets directory without validating paths against a sensitive-path list. Toge

• CVE-2026-33063HigMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  free5GC is an open source 5G core network. free5GC AUSF prior to version 1.4.2 has is an Improper Null Check vulnerability leading to Denial of Service. All deployments of free5GC v4.0.1 using the AUSF UE authentication service (`/nausf-auth/v1/ue-authentications` endpoint) are a

• CVE-2026-33062HigMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  free5GC is an open source 5G core network. free5GC NRF prior to version 1.4.2 has an Improper Input Validation vulnerability leading to Denial of Service. All deployments of free5GC using the NRF discovery service are affected. The `EncodeGroupId` function attempts to access arra

• CVE-2026-32937MedMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  free5GC is an open source 5G core network. free5GC CHF prior to version 1.2.2 has an out-of-bounds slice access vulnerability in the CHF `nchf-convergedcharging` service. A valid authenticated request to PUT `/nchf-convergedcharging/v3/recharging/:ueId?ratingGroup=...` can trigge

• CVE-2026-32811HigMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. When using Heimdall in envoy gRPC decision API mode with versions 0.7.0-alpha through 0.17.10, wrong encoding of the query URL string allows rules with non-wildcard path expressions to be bypasse

• CVE-2026-32828MedMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 through 1.8.11, and 1.9.0-rc.1 through 1.9.4, the http and http-download promotion steps allow Server-Side Request Forgery (SSRF) against link-lo

• CVE-2026-32771CriMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). In versions prior to 0.2.2, the sanitizeArchivePath function in pkg/extract/extract.go (lines 248–254) is vulnerable to Path Trave

• CVE-2026-32769CriMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Fullchain is an umbrella project for deploying a ready-to-use CTF platform. In versions prior to 0.1.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from a subverted application to any Pod out of the origin namespace. The flawed inter-ns NetworkPolicy breaks t

• CVE-2026-32767CriMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextSearchBlock endpoint. When the method parameter is set to 2, the endpoint passes user-supplied input directly as a raw SQL statement

• CVE-2026-32761MedMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.0 and below contain a permission enforcement bypass which allows users who are denied download privileges (perm.download = false)

• CVE-2026-32760CriMar 20, 2026
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions 2.61.2 and below, any unauthenticated visitor can register a full administrator account when self-registration (signup = true) is e