VYPR

rpm package

opensuse/govulncheck-vulndb&distro=openSUSE Leap 16.0

pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0

Vulnerabilities (1,719)

  • CVE-2026-50192medJul 2, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    ### Summary The Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` request headers to the operator-configured Hub URL (`config.HubURI`). The HTTP client used (`&http.Client{}` in `UploadKerberosHub`

  • CVE-2026-50149modJul 2, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    contour: Contour: JWT verification bypass allows unauthorized access via HTTPProxy misconfiguration

  • CVE-2026-44935Jul 2, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.

  • CVE-2026-50139medJul 1, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    # Share-link `?token=…` redemption races past download limit **Ecosystem:** Go **Package:** `goshs.de/goshs/v2` (`github.com/patrickhener/goshs`) **Affected:** `<= v2.0.9` (every release that shipped the share-link feature) ## Summary `ShareHandler` reads the share token's `Do

  • CVE-2026-50138higJul 1, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    # WebDAV listener ignores `--read-only`, `--upload-only`, and `--no-delete` mode flags **Ecosystem:** Go **Package:** `goshs.de/goshs/v2` (`github.com/patrickhener/goshs`) **Affected:** `<= v2.0.9` (every release that ships the WebDAV handler) ## Summary When `goshs` is launch

  • CVE-2026-49826lowJul 1, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    ### Impact An attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. ### Patches This has been fixed in 8.2.3 ### Workarounds None. ###

  • CVE-2026-49835modJun 30, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    timestamp-authority: Sigstore Timestamp Authority: Denial of Service via unbounded metric label cardinality

  • CVE-2026-49478modJun 30, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    github.com/sigstore/fulcio: Fulcio: Server-Side Request Forgery and Kubernetes ServiceAccount token leakage

  • CVE-2026-49820medJun 30, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    ### Impact Probo's `saferedirect` package validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). The validator only inspected the second character of relative paths, so a URL like `/../\evil.com` pa

  • CVE-2026-41053Jun 30, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.

  • CVE-2026-41052Jun 29, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.

  • CVE-2026-46602Jun 27, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.

  • CVE-2026-46604Jun 27, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.

  • CVE-2026-49349medJun 26, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. ## Example attack A malicious registry se

  • CVE-2026-48790medJun 26, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    ### Summary `turso-cli` persists the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover t

  • CVE-2026-41262medJun 26, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    ## Summary The global policy read endpoint (`GET /api/latest/fleet/policies/{policy_id}`) performs authorization against an empty `fleet.Policy{}` struct with nil TeamID, then fetches any policy by ID from the database without verifying the fetched policy actually belongs to the

  • CVE-2026-48529Jun 26, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requ

  • CVE-2026-48702impJun 25, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    github.com/sigstore/rekor: Rekor: Denial of Service due to unbounded gzip decompression in Alpine APK parsing

  • CVE-2026-46601modJun 25, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    golang.org/x/image/webp: golang.org/x/image/webp: Denial of Service via malformed VP8 chunk in WebP images

  • CVE-2026-54250Jun 25, 2026
    affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

    K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can

Page 7 of 86