OPENSUSE-SU-2026:11680-1
Vulnerability from csaf_opensuse - Published: 2026-09-04 00:00 - Updated: 2026-09-16 21:29Summary
agama-web-ui-24+0.a836cced5-52.1 on GA media
Severity
Moderate
Notes
Title of the patch: agama-web-ui-24+0.a836cced5-52.1 on GA media
Description of the patch: These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11680
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.5 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
important
7.2 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
important
4.2 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
moderate
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
low
5.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
moderate
4 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
moderate
4 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
moderate
4.8 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
important
7.5 (High)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2025-7783
Threats
Impact
moderate
References
59 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "agama-web-ui-24+0.a836cced5-52.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-11680",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11680-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-7783 page",
"url": "https://www.suse.com/security/cve/CVE-2025-7783/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-13149 page",
"url": "https://www.suse.com/security/cve/CVE-2026-13149/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-13676 page",
"url": "https://www.suse.com/security/cve/CVE-2026-13676/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33245 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33245/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-49356 page",
"url": "https://www.suse.com/security/cve/CVE-2026-49356/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53550 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53550/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-53632 page",
"url": "https://www.suse.com/security/cve/CVE-2026-53632/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-54466 page",
"url": "https://www.suse.com/security/cve/CVE-2026-54466/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-55602 page",
"url": "https://www.suse.com/security/cve/CVE-2026-55602/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-67313 page",
"url": "https://www.suse.com/security/cve/CVE-2026-67313/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-67315 page",
"url": "https://www.suse.com/security/cve/CVE-2026-67315/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-67317 page",
"url": "https://www.suse.com/security/cve/CVE-2026-67317/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-67319 page",
"url": "https://www.suse.com/security/cve/CVE-2026-67319/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-67321 page",
"url": "https://www.suse.com/security/cve/CVE-2026-67321/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-69153 page",
"url": "https://www.suse.com/security/cve/CVE-2026-69153/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-73086 page",
"url": "https://www.suse.com/security/cve/CVE-2026-73086/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-73088 page",
"url": "https://www.suse.com/security/cve/CVE-2026-73088/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-73089 page",
"url": "https://www.suse.com/security/cve/CVE-2026-73089/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-73650 page",
"url": "https://www.suse.com/security/cve/CVE-2026-73650/"
}
],
"title": "agama-web-ui-24+0.a836cced5-52.1 on GA media",
"tracking": {
"current_release_date": "2026-09-16T21:29:03Z",
"generator": {
"date": "2026-09-04T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:11680-1",
"initial_release_date": "2026-09-04T00:00:00Z",
"revision_history": [
{
"date": "2026-09-04T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-16T20:26:59Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T21:29:03Z",
"number": "3",
"summary": "unknown changes"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "agama-web-ui-24+0.a836cced5-52.1.aarch64",
"product": {
"name": "agama-web-ui-24+0.a836cced5-52.1.aarch64",
"product_id": "agama-web-ui-24+0.a836cced5-52.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/agama-web-ui@24+0.a836cced5-52.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"product": {
"name": "agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"product_id": "agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/agama-web-ui@24+0.a836cced5-52.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "agama-web-ui-24+0.a836cced5-52.1.s390x",
"product": {
"name": "agama-web-ui-24+0.a836cced5-52.1.s390x",
"product_id": "agama-web-ui-24+0.a836cced5-52.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/agama-web-ui@24+0.a836cced5-52.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "agama-web-ui-24+0.a836cced5-52.1.x86_64",
"product": {
"name": "agama-web-ui-24+0.a836cced5-52.1.x86_64",
"product_id": "agama-web-ui-24+0.a836cced5-52.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/agama-web-ui@24+0.a836cced5-52.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "agama-web-ui-24+0.a836cced5-52.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64"
},
"product_reference": "agama-web-ui-24+0.a836cced5-52.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "agama-web-ui-24+0.a836cced5-52.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le"
},
"product_reference": "agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "agama-web-ui-24+0.a836cced5-52.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x"
},
"product_reference": "agama-web-ui-24+0.a836cced5-52.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "agama-web-ui-24+0.a836cced5-52.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
},
"product_reference": "agama-web-ui-24+0.a836cced5-52.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-7783",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-7783"
}
],
"notes": [
{
"category": "general",
"text": "Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-7783",
"url": "https://www.suse.com/security/cve/CVE-2025-7783"
},
{
"category": "external",
"summary": "SUSE Bug 1246810 for CVE-2025-7783",
"url": "https://bugzilla.suse.com/1246810"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2025-7783"
},
{
"cve": "CVE-2026-13149",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-13149"
}
],
"notes": [
{
"category": "general",
"text": "brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding \u0027{}\u0027 brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-13149",
"url": "https://www.suse.com/security/cve/CVE-2026-13149"
},
{
"category": "external",
"summary": "SUSE Bug 1269911 for CVE-2026-13149",
"url": "https://bugzilla.suse.com/1269911"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-13149"
},
{
"cve": "CVE-2026-13676",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-13676"
}
],
"notes": [
{
"category": "general",
"text": "fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node\u0027s URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-13676",
"url": "https://www.suse.com/security/cve/CVE-2026-13676"
},
{
"category": "external",
"summary": "SUSE Bug 1269593 for CVE-2026-13676",
"url": "https://bugzilla.suse.com/1269593"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-13676"
},
{
"cve": "CVE-2026-33245",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33245"
}
],
"notes": [
{
"category": "general",
"text": "React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router\u0027s unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33245",
"url": "https://www.suse.com/security/cve/CVE-2026-33245"
},
{
"category": "external",
"summary": "SUSE Bug 1267499 for CVE-2026-33245",
"url": "https://bugzilla.suse.com/1267499"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-33245"
},
{
"cve": "CVE-2026-49356",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-49356"
}
],
"notes": [
{
"category": "general",
"text": "Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-49356",
"url": "https://www.suse.com/security/cve/CVE-2026-49356"
},
{
"category": "external",
"summary": "SUSE Bug 1272314 for CVE-2026-49356",
"url": "https://bugzilla.suse.com/1272314"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2026-49356"
},
{
"cve": "CVE-2026-53550",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53550"
}
],
"notes": [
{
"category": "general",
"text": "js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (\u003c\u003c) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53550",
"url": "https://www.suse.com/security/cve/CVE-2026-53550"
},
{
"category": "external",
"summary": "SUSE Bug 1268806 for CVE-2026-53550",
"url": "https://bugzilla.suse.com/1268806"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-53550"
},
{
"cve": "CVE-2026-53632",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-53632"
}
],
"notes": [
{
"category": "general",
"text": "launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user\u0027s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-53632",
"url": "https://www.suse.com/security/cve/CVE-2026-53632"
},
{
"category": "external",
"summary": "SUSE Bug 1272316 for CVE-2026-53632",
"url": "https://bugzilla.suse.com/1272316"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-53632"
},
{
"cve": "CVE-2026-54466",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-54466"
}
],
"notes": [
{
"category": "general",
"text": "websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly. This issue is fixed in version 0.7.5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-54466",
"url": "https://www.suse.com/security/cve/CVE-2026-54466"
},
{
"category": "external",
"summary": "SUSE Bug 1271573 for CVE-2026-54466",
"url": "https://bugzilla.suse.com/1271573"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-54466"
},
{
"cve": "CVE-2026-55602",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-55602"
}
],
"notes": [
{
"category": "general",
"text": "http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-55602",
"url": "https://www.suse.com/security/cve/CVE-2026-55602"
},
{
"category": "external",
"summary": "SUSE Bug 1272315 for CVE-2026-55602",
"url": "https://bugzilla.suse.com/1272315"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-55602"
},
{
"cve": "CVE-2026-67313",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-67313"
}
],
"notes": [
{
"category": "general",
"text": "axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands of nested brackets to exhaust the JavaScript call stack and trigger RangeError, causing request failure or process termination in applications that do not handle the exception.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-67313",
"url": "https://www.suse.com/security/cve/CVE-2026-67313"
},
{
"category": "external",
"summary": "SUSE Bug 1273616 for CVE-2026-67313",
"url": "https://bugzilla.suse.com/1273616"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-67313"
},
{
"cve": "CVE-2026-67315",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-67315"
}
],
"notes": [
{
"category": "general",
"text": "axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-67315",
"url": "https://www.suse.com/security/cve/CVE-2026-67315"
},
{
"category": "external",
"summary": "SUSE Bug 1273637 for CVE-2026-67315",
"url": "https://bugzilla.suse.com/1273637"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-67315"
},
{
"cve": "CVE-2026-67317",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-67317"
}
],
"notes": [
{
"category": "general",
"text": "axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-67317",
"url": "https://www.suse.com/security/cve/CVE-2026-67317"
},
{
"category": "external",
"summary": "SUSE Bug 1273660 for CVE-2026-67317",
"url": "https://bugzilla.suse.com/1273660"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-67317"
},
{
"cve": "CVE-2026-67319",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-67319"
}
],
"notes": [
{
"category": "general",
"text": "axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process\u0027s Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-67319",
"url": "https://www.suse.com/security/cve/CVE-2026-67319"
},
{
"category": "external",
"summary": "SUSE Bug 1273701 for CVE-2026-67319",
"url": "https://bugzilla.suse.com/1273701"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-67319"
},
{
"cve": "CVE-2026-67321",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-67321"
}
],
"notes": [
{
"category": "general",
"text": "axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in \u0027{}\u0027. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denial of service in the affected request path.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-67321",
"url": "https://www.suse.com/security/cve/CVE-2026-67321"
},
{
"category": "external",
"summary": "SUSE Bug 1273727 for CVE-2026-67321",
"url": "https://bugzilla.suse.com/1273727"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-67321"
},
{
"cve": "CVE-2026-69153",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-69153"
}
],
"notes": [
{
"category": "general",
"text": "PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map\u0027s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-69153",
"url": "https://www.suse.com/security/cve/CVE-2026-69153"
},
{
"category": "external",
"summary": "SUSE Bug 1276129 for CVE-2026-69153",
"url": "https://bugzilla.suse.com/1276129"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-69153"
},
{
"cve": "CVE-2026-73086",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-73086"
}
],
"notes": [
{
"category": "general",
"text": "nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-73086",
"url": "https://www.suse.com/security/cve/CVE-2026-73086"
},
{
"category": "external",
"summary": "SUSE Bug 1276035 for CVE-2026-73086",
"url": "https://bugzilla.suse.com/1276035"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-73086"
},
{
"cve": "CVE-2026-73088",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-73088"
}
],
"notes": [
{
"category": "general",
"text": "Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment, allowing inherited Object.prototype keys including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf to cause an uncaught TypeError or modify the prototype of the returned normalized object. This issue is fixed in version 4.28.7.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-73088",
"url": "https://www.suse.com/security/cve/CVE-2026-73088"
},
{
"category": "external",
"summary": "SUSE Bug 1275351 for CVE-2026-73088",
"url": "https://bugzilla.suse.com/1275351"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-73088"
},
{
"cve": "CVE-2026-73089",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-73089"
}
],
"notes": [
{
"category": "general",
"text": "Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `\u003cyear\u003e-\u003cmonth\u003e-\u003cday\u003e` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-73089",
"url": "https://www.suse.com/security/cve/CVE-2026-73089"
},
{
"category": "external",
"summary": "SUSE Bug 1275425 for CVE-2026-73089",
"url": "https://bugzilla.suse.com/1275425"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-73089"
},
{
"cve": "CVE-2026-73650",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-73650"
}
],
"notes": [
{
"category": "general",
"text": "SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because it does not remove namespaced or prefixed script elements such as \u003csvg:script\u003e and, in versions 3 and 4, matches JavaScript URIs case sensitively. Applications that process untrusted SVG input with this plugin enabled and serve the result can allow scripts to execute when another user opens the SVG, exposing local storage or cookies. This issue is fixed in versions 2.8.3, 3.3.4, and 4.0.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-73650",
"url": "https://www.suse.com/security/cve/CVE-2026-73650"
},
{
"category": "external",
"summary": "SUSE Bug 1275326 for CVE-2026-73650",
"url": "https://bugzilla.suse.com/1275326"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.aarch64",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.ppc64le",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.s390x",
"openSUSE Tumbleweed:agama-web-ui-24+0.a836cced5-52.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-04T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-73650"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…