openSUSE-SU-2026:11306-1: moderate: kbfs-6.6.3-3.1 on GA media
openSUSE-SU-2026:11305-1: moderate: containerized-data-importer1.65-api-1.65.0-2.1 on GA media
openSUSE-SU-2026:11304-1: moderate: system-user-zabbix-7.0.28-1.1 on GA media
openSUSE-SU-2026:11307-1: moderate: kubevirt1.8-container-disk-1.8.4-1.1 on GA media
openSUSE-SU-2026:11298-1: moderate: perl-DBI-1.651.0-1.1 on GA media
openSUSE-SU-2026:11300-1: moderate: php-composer2-2.10.2-2.1 on GA media
openSUSE-SU-2026:11303-1: moderate: wget-1.25.0-4.1 on GA media
openSUSE-SU-2026:0251-1: moderate: Security update for python-weasyprint
openSUSE-SU-2026:0254-1: important: Security update for chromium
openSUSE-SU-2026:0252-1: important: Security update for python-django-haystack
openSUSE-SU-2026:11306-1: moderate: kbfs-6.6.3-3.1 on GA media
# kbfs-6.6.3-3.1 on GA media
Announcement ID: openSUSE-SU-2026:11306-1
Rating: moderate
Cross-References:
* CVE-2026-39824
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the kbfs-6.6.3-3.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* kbfs 6.6.3-3.1
* kbfs-git 6.6.3-3.1
* kbfs-tool 6.6.3-3.1
* keybase-client 6.6.3-3.1
## References:
* https://www.suse.com/security/cve/CVE-2026-39824.html
openSUSE-SU-2026:11305-1: moderate: containerized-data-importer1.65-api-1.65.0-2.1 on GA media
# containerized-data-importer1.65-api-1.65.0-2.1 on GA media
Announcement ID: openSUSE-SU-2026:11305-1
Rating: moderate
Cross-References:
* CVE-2025-22870
* CVE-2025-22872
* CVE-2025-58058
* CVE-2025-58190
* CVE-2026-27136
* CVE-2026-33186
* CVE-2026-34986
* CVE-2026-35469
* CVE-2026-39821
* CVE-2026-39827
* CVE-2026-39828
* CVE-2026-39832
* CVE-2026-42508
CVSS scores:
* CVE-2025-22870 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
* CVE-2025-22870 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-22872 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
* CVE-2025-22872 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
* CVE-2025-58058 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-58058 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-58190 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-58190 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-27136 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-27136 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
* CVE-2026-33186 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-33186 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-34986 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-34986 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-35469 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-35469 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-39821 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-39821 ( SUSE ): 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-39827 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-39827 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-39828 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-39828 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-39832 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
* CVE-2026-39832 ( SUSE ): 6.2 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
* CVE-2026-42508 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-42508 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves 13 vulnerabilities can now be installed.
## Description:
These are all security issues fixed in the containerized-data-importer1.65-api-1.65.0-2.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* containerized-data-importer1.65-api 1.65.0-2.1
* containerized-data-importer1.65-cloner 1.65.0-2.1
* containerized-data-importer1.65-controller 1.65.0-2.1
* containerized-data-importer1.65-importer 1.65.0-2.1
* containerized-data-importer1.65-manifests 1.65.0-2.1
* containerized-data-importer1.65-operator 1.65.0-2.1
* containerized-data-importer1.65-tests 1.65.0-2.1
* containerized-data-importer1.65-uploadproxy 1.65.0-2.1
* containerized-data-importer1.65-uploadserver 1.65.0-2.1
* obs-service-cdi1.65_containers_meta 1.65.0-2.1
## References:
* https://www.suse.com/security/cve/CVE-2025-22870.html
* https://www.suse.com/security/cve/CVE-2025-22872.html
* https://www.suse.com/security/cve/CVE-2025-58058.html
* https://www.suse.com/security/cve/CVE-2025-58190.html
* https://www.suse.com/security/cve/CVE-2026-27136.html
* https://www.suse.com/security/cve/CVE-2026-33186.html
* https://www.suse.com/security/cve/CVE-2026-34986.html
* https://www.suse.com/security/cve/CVE-2026-35469.html
* https://www.suse.com/security/cve/CVE-2026-39821.html
* https://www.suse.com/security/cve/CVE-2026-39827.html
* https://www.suse.com/security/cve/CVE-2026-39828.html
* https://www.suse.com/security/cve/CVE-2026-39832.html
* https://www.suse.com/security/cve/CVE-2026-42508.html
openSUSE-SU-2026:11304-1: moderate: system-user-zabbix-7.0.28-1.1 on GA media
# system-user-zabbix-7.0.28-1.1 on GA media
Announcement ID: openSUSE-SU-2026:11304-1
Rating: moderate
Cross-References:
* CVE-2026-25680
* CVE-2026-42502
CVSS scores:
* CVE-2026-25680 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-25680 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-42502 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-42502 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves 2 vulnerabilities can now be installed.
## Description:
These are all security issues fixed in the system-user-zabbix-7.0.28-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* system-user-zabbix 7.0.28-1.1
* zabbix-agent 7.0.28-1.1
* zabbix-agent2 7.0.28-1.1
* zabbix-java-gateway 7.0.28-1.1
* zabbix-proxy 7.0.28-1.1
* zabbix-proxy-mysql 7.0.28-1.1
* zabbix-proxy-postgresql 7.0.28-1.1
* zabbix-proxy-sqlite 7.0.28-1.1
* zabbix-server 7.0.28-1.1
* zabbix-server-mysql 7.0.28-1.1
* zabbix-server-postgresql 7.0.28-1.1
* zabbix-ui 7.0.28-1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-25680.html
* https://www.suse.com/security/cve/CVE-2026-42502.html
openSUSE-SU-2026:11307-1: moderate: kubevirt1.8-container-disk-1.8.4-1.1 on GA media
# kubevirt1.8-container-disk-1.8.4-1.1 on GA media
Announcement ID: openSUSE-SU-2026:11307-1
Rating: moderate
Cross-References:
* CVE-2026-35469
CVSS scores:
* CVE-2026-35469 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-35469 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* kubevirt1.8-container-disk 1.8.4-1.1
* kubevirt1.8-manifests 1.8.4-1.1
* kubevirt1.8-pr-helper-conf 1.8.4-1.1
* kubevirt1.8-sidecar-shim 1.8.4-1.1
* kubevirt1.8-tests 1.8.4-1.1
* kubevirt1.8-virt-api 1.8.4-1.1
* kubevirt1.8-virt-controller 1.8.4-1.1
* kubevirt1.8-virt-exportproxy 1.8.4-1.1
* kubevirt1.8-virt-exportserver 1.8.4-1.1
* kubevirt1.8-virt-handler 1.8.4-1.1
* kubevirt1.8-virt-launcher 1.8.4-1.1
* kubevirt1.8-virt-operator 1.8.4-1.1
* kubevirt1.8-virt-synchronization-controller 1.8.4-1.1
* kubevirt1.8-virtctl 1.8.4-1.1
* obs-service-kubevirt1.8_containers_meta 1.8.4-1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-35469.html
openSUSE-SU-2026:11298-1: moderate: perl-DBI-1.651.0-1.1 on GA media
# perl-DBI-1.651.0-1.1 on GA media
Announcement ID: openSUSE-SU-2026:11298-1
Rating: moderate
Cross-References:
* CVE-2026-15043
* CVE-2026-15392
* CVE-2026-60081
* CVE-2026-60082
CVSS scores:
* CVE-2026-15043 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-15043 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-15392 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-60081 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-60082 ( SUSE ): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products:
* openSUSE Tumbleweed
An update that solves 4 vulnerabilities can now be installed.
## Description:
These are all security issues fixed in the perl-DBI-1.651.0-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* perl-DBI 1.651.0-1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-15043.html
* https://www.suse.com/security/cve/CVE-2026-15392.html
* https://www.suse.com/security/cve/CVE-2026-60081.html
* https://www.suse.com/security/cve/CVE-2026-60082.html
openSUSE-SU-2026:11300-1: moderate: php-composer2-2.10.2-2.1 on GA media
# php-composer2-2.10.2-2.1 on GA media
Announcement ID: openSUSE-SU-2026:11300-1
Rating: moderate
Cross-References:
* CVE-2026-45793
CVSS scores:
* CVE-2026-45793 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the php-composer2-2.10.2-2.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* php-composer2 2.10.2-2.1
## References:
* https://www.suse.com/security/cve/CVE-2026-45793.html
openSUSE-SU-2026:11303-1: moderate: wget-1.25.0-4.1 on GA media
# wget-1.25.0-4.1 on GA media
Announcement ID: openSUSE-SU-2026:11303-1
Rating: moderate
Cross-References:
* CVE-2026-15146
CVSS scores:
* CVE-2026-15146 ( SUSE ): 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-15146 ( SUSE ): 5.1 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the wget-1.25.0-4.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* wget 1.25.0-4.1
* wget-lang 1.25.0-4.1
## References:
* https://www.suse.com/security/cve/CVE-2026-15146.html
openSUSE-SU-2026:0251-1: moderate: Security update for python-weasyprint
openSUSE Security Update: Security update for python-weasyprint
_______________________________
Announcement ID: openSUSE-SU-2026:0251-1
Rating: moderate
References: #1270401
Cross-References: CVE-2026-49452
CVSS scores:
CVE-2026-49452 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products:
openSUSE Backports SLE-15-SP7
_______________________________
An update that fixes one vulnerability is now available.
Description:
This update for python-weasyprint fixes the following issues:
- CVE-2026-49452: CSS Injection via Presentational Hints (boo#1270401)
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP7:
zypper in -t patch openSUSE-2026-251=1
Package List:
- openSUSE Backports SLE-15-SP7 (noarch):
python311-weasyprint-60.2-bp157.2.6.1
References:
https://www.suse.com/security/cve/CVE-2026-49452.html
https://bugzilla.suse.com/1270401
openSUSE-SU-2026:0254-1: important: Security update for chromium
openSUSE Security Update: Security update for chromium
_______________________________
Announcement ID: openSUSE-SU-2026:0254-1
Rating: important
References: #1271656
Cross-References: CVE-2026-15899 CVE-2026-15900 CVE-2026-15901
CVE-2026-15902 CVE-2026-15903 CVE-2026-15904
CVE-2026-15905
Affected Products:
openSUSE Backports SLE-15-SP7
_______________________________
An update that fixes 7 vulnerabilities is now available.
Description:
This update for chromium fixes the following issues:
- Chromium 150.0.7871.128 (boo#1271656):
* CVE-2026-15899: Use after free in CameraCapture
* CVE-2026-15900: Use after free in GPU
* CVE-2026-15901: Use after free in Network
* CVE-2026-15902: Use after free in Cast
* CVE-2026-15903: Out of bounds read and write in V8
* CVE-2026-15904: Use after free in Ozone
* CVE-2026-15905: Use after free in Aura
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP7:
zypper in -t patch openSUSE-2026-254=1
Package List:
- openSUSE Backports SLE-15-SP7 (aarch64 ppc64le x86_64):
chromedriver-150.0.7871.128-bp157.2.190.1
chromium-150.0.7871.128-bp157.2.190.1
References:
https://www.suse.com/security/cve/CVE-2026-15899.html
https://www.suse.com/security/cve/CVE-2026-15900.html
https://www.suse.com/security/cve/CVE-2026-15901.html
https://www.suse.com/security/cve/CVE-2026-15902.html
https://www.suse.com/security/cve/CVE-2026-15903.html
https://www.suse.com/security/cve/CVE-2026-15904.html
https://www.suse.com/security/cve/CVE-2026-15905.html
https://bugzilla.suse.com/1271656
openSUSE-SU-2026:0252-1: important: Security update for python-django-haystack
openSUSE Security Update: Security update for python-django-haystack
_______________________________
Announcement ID: openSUSE-SU-2026:0252-1
Rating: important
References: #1271593
Affected Products:
openSUSE Backports SLE-15-SP7
_______________________________
An update that contains security fixes can now be installed.
Description:
This update for python-django-haystack fixes the following issues:
- Remote Code Execution via `eval()` in Elasticsearch Result
Deserialization (boo#1271593)
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP7:
zypper in -t patch openSUSE-2026-252=1
Package List:
- openSUSE Backports SLE-15-SP7 (noarch):
python311-django-haystack-3.2.1-bp157.2.3.1
References:
https://bugzilla.suse.com/1271593
