rpm package
suse/uyuni-common-libs&distro=SUSE Multi Linux Manager Tools Beta SLE-15
pkg:rpm/suse/uyuni-common-libs&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20Beta%20SLE-15
Vulnerabilities (11)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-27606 | — | < 5.2.3-159000.2.3.1 | 5.2.3-159000.2.3.1 | Feb 25, 2026 | Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine a | ||
| CVE-2026-21722 | — | < 5.2.3-159000.2.3.1 | 5.2.3-159000.2.3.1 | Feb 12, 2026 | Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did n | ||
| CVE-2026-1615 | Cri | 9.8 | < 5.2.3-159000.2.3.1 | 5.2.3-159000.2.3.1 | Feb 9, 2026 | Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. A | |
| CVE-2026-25547 | Cri | — | < 5.2.3-159000.2.3.1 | 5.2.3-159000.2.3.1 | Feb 4, 2026 | @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated nume | |
| CVE-2025-62349 | Med | 6.2 | < 5.2.3-159000.2.3.1 | 5.2.3-159000.2.3.1 | Jan 30, 2026 | Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to p | |
| CVE-2025-62348 | Hig | 7.8 | < 5.2.3-159000.2.3.1 | 5.2.3-159000.2.3.1 | Jan 30, 2026 | Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintended code execution under the context of the Salt process. | |
| CVE-2025-61140 | — | < 5.2.3-159000.2.3.1 | 5.2.3-159000.2.3.1 | Jan 28, 2026 | The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution. | ||
| CVE-2025-67726 | — | < 5.2.3-159000.2.3.1 | 5.2.3-159000.2.3.1 | Dec 12, 2025 | Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header va | ||
| CVE-2025-67725 | — | < 5.2.3-159000.2.3.1 | 5.2.3-159000.2.3.1 | Dec 12, 2025 | Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using stri | ||
| CVE-2025-67724 | — | < 5.2.3-159000.2.3.1 | 5.2.3-159000.2.3.1 | Dec 12, 2025 | Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and | ||
| CVE-2025-3415 | Med | 4.3 | < 5.2.3-159000.2.3.1 | 5.2.3-159000.2.3.1 | Jul 17, 2025 | Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+ |
- CVE-2026-27606Feb 25, 2026affected < 5.2.3-159000.2.3.1fixed 5.2.3-159000.2.3.1
Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine a
- CVE-2026-21722Feb 12, 2026affected < 5.2.3-159000.2.3.1fixed 5.2.3-159000.2.3.1
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did n
- affected < 5.2.3-159000.2.3.1fixed 5.2.3-159000.2.3.1
Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untrusted data safely. A
- affected < 5.2.3-159000.2.3.1fixed 5.2.3-159000.2.3.1
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated nume
- affected < 5.2.3-159000.2.3.1fixed 5.2.3-159000.2.3.1
Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to p
- affected < 5.2.3-159000.2.3.1fixed 5.2.3-159000.2.3.1
Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintended code execution under the context of the Salt process.
- CVE-2025-61140Jan 28, 2026affected < 5.2.3-159000.2.3.1fixed 5.2.3-159000.2.3.1
The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.
- CVE-2025-67726Dec 12, 2025affected < 5.2.3-159000.2.3.1fixed 5.2.3-159000.2.3.1
Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header va
- CVE-2025-67725Dec 12, 2025affected < 5.2.3-159000.2.3.1fixed 5.2.3-159000.2.3.1
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using stri
- CVE-2025-67724Dec 12, 2025affected < 5.2.3-159000.2.3.1fixed 5.2.3-159000.2.3.1
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and
- affected < 5.2.3-159000.2.3.1fixed 5.2.3-159000.2.3.1
Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+