rpm package
opensuse/govulncheck-vulndb&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
Vulnerabilities (1,719)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-50192 | med | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jul 2, 2026 | ### Summary The Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` request headers to the operator-configured Hub URL (`config.HubURI`). The HTTP client used (`&http.Client{}` in `UploadKerberosHub` | |
| CVE-2026-50149 | mod | 6.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jul 2, 2026 | contour: Contour: JWT verification bypass allows unauthorized access via HTTPProxy misconfiguration | |
| CVE-2026-44935 | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jul 2, 2026 | Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants. | ||
| CVE-2026-50139 | med | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jul 1, 2026 | # Share-link `?token=…` redemption races past download limit **Ecosystem:** Go **Package:** `goshs.de/goshs/v2` (`github.com/patrickhener/goshs`) **Affected:** `<= v2.0.9` (every release that shipped the share-link feature) ## Summary `ShareHandler` reads the share token's `Do | |
| CVE-2026-50138 | hig | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jul 1, 2026 | # WebDAV listener ignores `--read-only`, `--upload-only`, and `--no-delete` mode flags **Ecosystem:** Go **Package:** `goshs.de/goshs/v2` (`github.com/patrickhener/goshs`) **Affected:** `<= v2.0.9` (every release that ships the WebDAV handler) ## Summary When `goshs` is launch | |
| CVE-2026-49826 | low | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jul 1, 2026 | ### Impact An attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. ### Patches This has been fixed in 8.2.3 ### Workarounds None. ### | |
| CVE-2026-49835 | mod | 5.9 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 30, 2026 | timestamp-authority: Sigstore Timestamp Authority: Denial of Service via unbounded metric label cardinality | |
| CVE-2026-49478 | mod | 6.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 30, 2026 | github.com/sigstore/fulcio: Fulcio: Server-Side Request Forgery and Kubernetes ServiceAccount token leakage | |
| CVE-2026-49820 | med | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 30, 2026 | ### Impact Probo's `saferedirect` package validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). The validator only inspected the second character of relative paths, so a URL like `/../\evil.com` pa | |
| CVE-2026-41053 | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 30, 2026 | Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2. | ||
| CVE-2026-41052 | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 29, 2026 | Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10. | ||
| CVE-2026-46602 | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 27, 2026 | The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption. | ||
| CVE-2026-46604 | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 27, 2026 | The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset. | ||
| CVE-2026-49349 | med | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 26, 2026 | Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. ## Example attack A malicious registry se | |
| CVE-2026-48790 | med | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 26, 2026 | ### Summary `turso-cli` persists the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover t | |
| CVE-2026-41262 | med | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 26, 2026 | ## Summary The global policy read endpoint (`GET /api/latest/fleet/policies/{policy_id}`) performs authorization against an empty `fleet.Policy{}` struct with nil TeamID, then fetches any policy by ID from the database without verifying the fetched policy actually belongs to the | |
| CVE-2026-48529 | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 26, 2026 | GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requ | ||
| CVE-2026-48702 | imp | 7.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 25, 2026 | github.com/sigstore/rekor: Rekor: Denial of Service due to unbounded gzip decompression in Alpine APK parsing | |
| CVE-2026-46601 | mod | 6.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 25, 2026 | golang.org/x/image/webp: golang.org/x/image/webp: Denial of Service via malformed VP8 chunk in WebP images | |
| CVE-2026-54250 | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 25, 2026 | K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can |
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
### Summary The Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` request headers to the operator-configured Hub URL (`config.HubURI`). The HTTP client used (`&http.Client{}` in `UploadKerberosHub`
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
contour: Contour: JWT verification bypass allows unauthorized access via HTTPProxy misconfiguration
- CVE-2026-44935Jul 2, 2026affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
# Share-link `?token=…` redemption races past download limit **Ecosystem:** Go **Package:** `goshs.de/goshs/v2` (`github.com/patrickhener/goshs`) **Affected:** `<= v2.0.9` (every release that shipped the share-link feature) ## Summary `ShareHandler` reads the share token's `Do
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
# WebDAV listener ignores `--read-only`, `--upload-only`, and `--no-delete` mode flags **Ecosystem:** Go **Package:** `goshs.de/goshs/v2` (`github.com/patrickhener/goshs`) **Affected:** `<= v2.0.9` (every release that ships the WebDAV handler) ## Summary When `goshs` is launch
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
### Impact An attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. ### Patches This has been fixed in 8.2.3 ### Workarounds None. ###
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
timestamp-authority: Sigstore Timestamp Authority: Denial of Service via unbounded metric label cardinality
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
github.com/sigstore/fulcio: Fulcio: Server-Side Request Forgery and Kubernetes ServiceAccount token leakage
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
### Impact Probo's `saferedirect` package validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). The validator only inspected the second character of relative paths, so a URL like `/../\evil.com` pa
- CVE-2026-41053Jun 30, 2026affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.
- CVE-2026-41052Jun 29, 2026affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.
- CVE-2026-46602Jun 27, 2026affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.
- CVE-2026-46604Jun 27, 2026affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. ## Example attack A malicious registry se
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
### Summary `turso-cli` persists the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover t
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
## Summary The global policy read endpoint (`GET /api/latest/fleet/policies/{policy_id}`) performs authorization against an empty `fleet.Policy{}` struct with nil TeamID, then fetches any policy by ID from the database without verifying the fetched policy actually belongs to the
- CVE-2026-48529Jun 26, 2026affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requ
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
github.com/sigstore/rekor: Rekor: Denial of Service due to unbounded gzip decompression in Alpine APK parsing
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
golang.org/x/image/webp: golang.org/x/image/webp: Denial of Service via malformed VP8 chunk in WebP images
- CVE-2026-54250Jun 25, 2026affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can
Page 7 of 86