OPENSUSE-SU-2026:20892-1
Vulnerability from csaf_opensuse - Published: 2026-06-02 17:45 - Updated: 2026-09-17 17:34Summary
Security update for yq
Severity
Important
Notes
Title of the patch: Security update for yq
Description of the patch: This update for yq fixes the following issues:
Changes in yq:
- Fix multiple CVEs:
* CVE-2026-27136 (GO-2026-5030)
CVE-2026-25681 (GO-2026-5029)
CVE-2026-25680 (GO-2026-5028)
CVE-2026-42502 (GO-2026-5027)
CVE-2026-42506 (GO-2026-5025) (bsc#1267053)
CVE-2026-39821 (GO-2026-5026) (bsc#1267199)
- update to v4.53.2
* Add system(command; args) operator (disabled by default).
* TOML encoder: prefer readable table sections over inline tables.
* Fix TOML encoder to quote keys containing special characters.
* Add string slicing support.
* Fix findInArray misuse on MappingNodes in equality and contains.
* Fix panic on negative slice indices that underflow after adjustment.
* Fix stack overflow from circular alias in traverse.
* Fix panic and OOM in repeatString for large repeat counts.
- update to v4.52.5
* Fix: reset TOML decoder state between files.
* Fix: preserve original filename when using --front-matter.
- Integrate vulnchecker support into %check stage (optional: set `%%_with_vulncheck 1`).
- Fix CVE-2026-33814 (bsc#1266248):
* update golang.org/x/net to v0.53.0.
- update to 4.52.4:
* Dropping windows/arm - no longer supported in cross-compile
* Fixing comments in TOML arrays
* Bumped dependencies
- update to 4.52.2:
* Fixed bad instructions file breaking go-install (#2587)
Thanks @theyoprst
* Fixed TOML table scope after comments (#2588) Thanks @tomers
* Multiply uses a readonly context
* Fixed merge globbing wildcards in keys
* Fixing TOML subarray parsing issue
- update to 4.52.1:
* TOML encoder support - you can now roundtrip! #1364
* Parent now supports negative indices, and added a 'root'
command for referencing the top level document
* Fixed scalar encoding for HCL
* Add --yaml-compact-seq-indent / -c flag for compact sequence
indentation (#2583) Thanks @jfenal
* Add symlink check to file rename util (#2576) Thanks @Elias-
elastisys
* Powershell fixed default command used for __completeNoDesc
alias (#2568) Thanks @teejaded
* Unwrap scalars in shell output mode. (#2548) Thanks
@flintwinters
* Added K8S KYAML output format support (#2560) Thanks @robbat2
- update to 4.50.1:
* Added HCL Support - First cut - hopefully it works well!
* Fixing handling of CRLF #2352
- update to 4.49.2:
* Fixing escape character bugs :sweat: #2517
* Fixing snap release pipeline #2518 Thanks @aalexjo
- update to 4.49.1:
* Added `--security` flags to disable env and file ops #2515
* Fixing TOML ArrayTable parsing issues #1758
* Fixing parsing of escaped characters #2506
- update to 4.48.2:
* Strip whitespace when decoding base64 #2507
* Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet)
* Add linux/loong64 to release target (thanks @znley)
* Added --shell-key-separator flag for customizable shell
output format #2497 (thanks @rsleedbx)
- update to 4.48.1:
* Added 'parents' operator, to return a list of all the
hierarchical parents of a node
* Added 'first(exp)' operator, to return the first entry
matching an expression in an array
* Fixed xml namespace prefixes #1730 (thanks @baodrate)
* Fixed out of range panic in yaml decoder #2460 (thanks
@n471d)
* Fixes CVE-2025-58190 (GO-2026-4441) (bsc#1251540)
CVE-2025-47911 (GO-2026-4440) (bsc#1251339) by
updating golang.org/x/net to v0.46.0.
- update to 4.47.2:
* Conversion from TOML to JSON no longer omits empty tables
#2459 (thanks @louislouislouislouis)
- update to 4.47.1:
* Fixed merge anchor behaviour (`<<`); #2404, #2110, #2386,
#2178 Huge thanks to @stevenwdv!
- Fix zsh completion location
- update to 4.46.1:
* Added INI support
* Fixed 'add' operator when piped in with no data #2378, #2383,
#2384
* Fixed delete after slice problem (bad node path) #2387 Thanks
@antoinedeschenes
* Fixed yq small build Thanks @imzue
* Switched to YAML org supported go-yaml!
- update to 4.45.4:
* Fixing wrong map() behaviour on empty map #2359
- update to 4.45.3:
* Fixing regression (#2353, #2359, #2325) introduced with in
4.45.2 with #2325 fix
- update to 4.45.2:
* Added windows arm builds (Thanks @albertocavalcante,
@ShukantPal)
* Added s390x platform support (Thanks @ashokpariya0)
* Additionally push docker images to ghcr.io (Thanks @reegnz)
* Fixing add when there is no node match #2325
* sort_by works on maps
* Fixed CVE-2025-22872 (GO-2025-3595) (bsc#1241719) by
updating golang.org/x/net to 0.39.0.
- update to 4.45.1:
* Create parent directories when --split-exp is used, Thanks
@rudo-thomas
- Updated to 4.44.6:
* Fixed deleting items in array bug #2027, #2172; Thanks @jandubois
* Docker image for armv7 / raspberry pi3, Thanks @brianegge
* Fixed no-colors regression #2218
* Fixed various panic scenarios #2211
* Bumped dependencies
- Changes from 4.44.5 (4.44.4 was skipped)
* Format comments with a gray foreground (Thanks @gabe565)
* Fixed handling of nulls with sort_by expressions #2164
* Force no color output when NO_COLOR env presents (Thanks @narqo)
* Fixed array subtraction update bug #2159
* Fixed index out of range error
* Can traverse straight from parent operator (parent.blah)
* Bumped dependencies
- Bumped x/net to 0.33.0 to fix CVE-2024-45338
Patchnames: openSUSE-Leap-16.0-packagehub-294
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.9 (Medium)
Affected products
Recommended
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
7 products, the same list as for
CVE-2024-45338
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
7 products, the same list as for
CVE-2024-45338
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
7 products, the same list as for
CVE-2024-45338
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
7 products, the same list as for
CVE-2024-45338
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
7 products, the same list as for
CVE-2024-45338
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
7 products, the same list as for
CVE-2024-45338
Threats
Impact
important
7.5 (High)
Affected products
Recommended
7 products, the same list as for
CVE-2024-45338
Threats
Impact
important
7.4 (High)
Affected products
Recommended
7 products, the same list as for
CVE-2024-45338
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
7 products, the same list as for
CVE-2024-45338
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
7 products, the same list as for
CVE-2024-45338
Threats
Impact
important
References
45 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for yq",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for yq fixes the following issues:\n\nChanges in yq:\n\n- Fix multiple CVEs:\n * CVE-2026-27136 (GO-2026-5030)\n CVE-2026-25681 (GO-2026-5029)\n CVE-2026-25680 (GO-2026-5028)\n CVE-2026-42502 (GO-2026-5027)\n CVE-2026-42506 (GO-2026-5025) (bsc#1267053)\n CVE-2026-39821 (GO-2026-5026) (bsc#1267199)\n\n- update to v4.53.2\n * Add system(command; args) operator (disabled by default).\n * TOML encoder: prefer readable table sections over inline tables.\n * Fix TOML encoder to quote keys containing special characters.\n * Add string slicing support.\n * Fix findInArray misuse on MappingNodes in equality and contains.\n * Fix panic on negative slice indices that underflow after adjustment.\n * Fix stack overflow from circular alias in traverse.\n * Fix panic and OOM in repeatString for large repeat counts.\n\n- update to v4.52.5\n * Fix: reset TOML decoder state between files.\n * Fix: preserve original filename when using --front-matter.\n\n- Integrate vulnchecker support into %check stage (optional: set `%%_with_vulncheck 1`).\n- Fix CVE-2026-33814 (bsc#1266248):\n * update golang.org/x/net to v0.53.0.\n\n- update to 4.52.4:\n * Dropping windows/arm - no longer supported in cross-compile\n * Fixing comments in TOML arrays\n * Bumped dependencies\n\n- update to 4.52.2:\n * Fixed bad instructions file breaking go-install (#2587)\n Thanks @theyoprst\n * Fixed TOML table scope after comments (#2588) Thanks @tomers\n * Multiply uses a readonly context\n * Fixed merge globbing wildcards in keys\n * Fixing TOML subarray parsing issue\n\n- update to 4.52.1:\n * TOML encoder support - you can now roundtrip! #1364\n * Parent now supports negative indices, and added a \u0027root\u0027\n command for referencing the top level document\n * Fixed scalar encoding for HCL\n * Add --yaml-compact-seq-indent / -c flag for compact sequence\n indentation (#2583) Thanks @jfenal\n * Add symlink check to file rename util (#2576) Thanks @Elias-\n elastisys\n * Powershell fixed default command used for __completeNoDesc\n alias (#2568) Thanks @teejaded\n * Unwrap scalars in shell output mode. (#2548) Thanks\n @flintwinters\n * Added K8S KYAML output format support (#2560) Thanks @robbat2\n\n- update to 4.50.1:\n * Added HCL Support - First cut - hopefully it works well!\n * Fixing handling of CRLF #2352\n\n- update to 4.49.2:\n * Fixing escape character bugs :sweat: #2517\n * Fixing snap release pipeline #2518 Thanks @aalexjo\n\n- update to 4.49.1:\n * Added `--security` flags to disable env and file ops #2515\n * Fixing TOML ArrayTable parsing issues #1758\n * Fixing parsing of escaped characters #2506\n\n- update to 4.48.2:\n * Strip whitespace when decoding base64 #2507\n * Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet)\n * Add linux/loong64 to release target (thanks @znley)\n * Added --shell-key-separator flag for customizable shell\n output format #2497 (thanks @rsleedbx)\n\n- update to 4.48.1:\n * Added \u0027parents\u0027 operator, to return a list of all the\n hierarchical parents of a node\n * Added \u0027first(exp)\u0027 operator, to return the first entry\n matching an expression in an array\n * Fixed xml namespace prefixes #1730 (thanks @baodrate)\n * Fixed out of range panic in yaml decoder #2460 (thanks\n @n471d)\n * Fixes CVE-2025-58190 (GO-2026-4441) (bsc#1251540)\n CVE-2025-47911 (GO-2026-4440) (bsc#1251339) by\n updating golang.org/x/net to v0.46.0.\n\n- update to 4.47.2:\n * Conversion from TOML to JSON no longer omits empty tables\n #2459 (thanks @louislouislouislouis)\n\n- update to 4.47.1:\n * Fixed merge anchor behaviour (`\u003c\u003c`); #2404, #2110, #2386,\n #2178 Huge thanks to @stevenwdv!\n\n- Fix zsh completion location\n\n- update to 4.46.1:\n * Added INI support\n * Fixed \u0027add\u0027 operator when piped in with no data #2378, #2383,\n #2384\n * Fixed delete after slice problem (bad node path) #2387 Thanks\n @antoinedeschenes\n * Fixed yq small build Thanks @imzue\n * Switched to YAML org supported go-yaml!\n\n- update to 4.45.4:\n * Fixing wrong map() behaviour on empty map #2359\n\n- update to 4.45.3:\n * Fixing regression (#2353, #2359, #2325) introduced with in\n 4.45.2 with #2325 fix\n\n- update to 4.45.2:\n * Added windows arm builds (Thanks @albertocavalcante,\n @ShukantPal)\n * Added s390x platform support (Thanks @ashokpariya0)\n * Additionally push docker images to ghcr.io (Thanks @reegnz)\n * Fixing add when there is no node match #2325\n * sort_by works on maps\n * Fixed CVE-2025-22872 (GO-2025-3595) (bsc#1241719) by\n updating golang.org/x/net to 0.39.0.\n\n- update to 4.45.1:\n * Create parent directories when --split-exp is used, Thanks\n @rudo-thomas\n\n- Updated to 4.44.6:\n * Fixed deleting items in array bug #2027, #2172; Thanks @jandubois\n * Docker image for armv7 / raspberry pi3, Thanks @brianegge\n * Fixed no-colors regression #2218\n * Fixed various panic scenarios #2211\n * Bumped dependencies\n\n- Changes from 4.44.5 (4.44.4 was skipped)\n * Format comments with a gray foreground (Thanks @gabe565)\n * Fixed handling of nulls with sort_by expressions #2164\n * Force no color output when NO_COLOR env presents (Thanks @narqo)\n * Fixed array subtraction update bug #2159\n * Fixed index out of range error\n * Can traverse straight from parent operator (parent.blah)\n * Bumped dependencies\n\n- Bumped x/net to 0.33.0 to fix CVE-2024-45338\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-packagehub-294",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20892-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1241719",
"url": "https://bugzilla.suse.com/1241719"
},
{
"category": "self",
"summary": "SUSE Bug 1251339",
"url": "https://bugzilla.suse.com/1251339"
},
{
"category": "self",
"summary": "SUSE Bug 1251540",
"url": "https://bugzilla.suse.com/1251540"
},
{
"category": "self",
"summary": "SUSE Bug 1266248",
"url": "https://bugzilla.suse.com/1266248"
},
{
"category": "self",
"summary": "SUSE Bug 1267053",
"url": "https://bugzilla.suse.com/1267053"
},
{
"category": "self",
"summary": "SUSE Bug 1267199",
"url": "https://bugzilla.suse.com/1267199"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45338 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45338/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22872 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22872/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58190 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58190/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25680 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25680/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-25681 page",
"url": "https://www.suse.com/security/cve/CVE-2026-25681/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-27136 page",
"url": "https://www.suse.com/security/cve/CVE-2026-27136/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42502 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42502/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42506/"
}
],
"title": "Security update for yq",
"tracking": {
"current_release_date": "2026-09-17T17:34:10Z",
"generator": {
"date": "2026-06-02T17:45:41Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:20892-1",
"initial_release_date": "2026-06-02T17:45:41Z",
"revision_history": [
{
"date": "2026-06-02T17:45:41Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-16T20:36:39Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T21:39:25Z",
"number": "3",
"summary": "unknown changes"
},
{
"date": "2026-09-17T17:34:10Z",
"number": "4",
"summary": "unknown changes"
}
],
"status": "final",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "yq-0:4.53.2-bp160.1.1.aarch64",
"product": {
"name": "yq-0:4.53.2-bp160.1.1.aarch64",
"product_id": "yq-0:4.53.2-bp160.1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/yq@4.53.2-bp160.1.1?arch=aarch64\u0026upstream=yq-0:4.53.2-bp160.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"product": {
"name": "yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"product_id": "yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/yq-bash-completion@4.53.2-bp160.1.1?arch=noarch\u0026upstream=yq-0:4.53.2-bp160.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"product": {
"name": "yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"product_id": "yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/yq-fish-completion@4.53.2-bp160.1.1?arch=noarch\u0026upstream=yq-0:4.53.2-bp160.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "yq-zsh-completion-0:4.53.2-bp160.1.1.noarch",
"product": {
"name": "yq-zsh-completion-0:4.53.2-bp160.1.1.noarch",
"product_id": "yq-zsh-completion-0:4.53.2-bp160.1.1.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/suse/yq-zsh-completion@4.53.2-bp160.1.1?arch=noarch\u0026upstream=yq-0:4.53.2-bp160.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "yq-0:4.53.2-bp160.1.1.ppc64le",
"product": {
"name": "yq-0:4.53.2-bp160.1.1.ppc64le",
"product_id": "yq-0:4.53.2-bp160.1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/yq@4.53.2-bp160.1.1?arch=ppc64le\u0026upstream=yq-0:4.53.2-bp160.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "yq-0:4.53.2-bp160.1.1.s390x",
"product": {
"name": "yq-0:4.53.2-bp160.1.1.s390x",
"product_id": "yq-0:4.53.2-bp160.1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/yq@4.53.2-bp160.1.1?arch=s390x\u0026upstream=yq-0:4.53.2-bp160.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "yq-0:4.53.2-bp160.1.1.x86_64",
"product": {
"name": "yq-0:4.53.2-bp160.1.1.x86_64",
"product_id": "yq-0:4.53.2-bp160.1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/yq@4.53.2-bp160.1.1?arch=x86_64\u0026upstream=yq-0:4.53.2-bp160.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "yq-0:4.53.2-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64"
},
"product_reference": "yq-0:4.53.2-bp160.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "yq-0:4.53.2-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le"
},
"product_reference": "yq-0:4.53.2-bp160.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "yq-0:4.53.2-bp160.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x"
},
"product_reference": "yq-0:4.53.2-bp160.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "yq-0:4.53.2-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64"
},
"product_reference": "yq-0:4.53.2-bp160.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "yq-bash-completion-0:4.53.2-bp160.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch"
},
"product_reference": "yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "yq-fish-completion-0:4.53.2-bp160.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch"
},
"product_reference": "yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "yq-zsh-completion-0:4.53.2-bp160.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
},
"product_reference": "yq-zsh-completion-0:4.53.2-bp160.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-45338",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45338"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45338",
"url": "https://www.suse.com/security/cve/CVE-2024-45338"
},
{
"category": "external",
"summary": "SUSE Bug 1234794 for CVE-2024-45338",
"url": "https://bugzilla.suse.com/1234794"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-02T17:45:41Z",
"details": "moderate"
}
],
"title": "CVE-2024-45338"
},
{
"cve": "CVE-2025-22872",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22872"
}
],
"notes": [
{
"category": "general",
"text": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22872",
"url": "https://www.suse.com/security/cve/CVE-2025-22872"
},
{
"category": "external",
"summary": "SUSE Bug 1241710 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1241710"
},
{
"category": "external",
"summary": "SUSE Bug 1265255 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1265255"
},
{
"category": "external",
"summary": "SUSE Bug 1265256 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1265256"
},
{
"category": "external",
"summary": "SUSE Bug 1265259 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1265259"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-02T17:45:41Z",
"details": "moderate"
}
],
"title": "CVE-2025-22872"
},
{
"cve": "CVE-2025-47911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47911"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47911",
"url": "https://www.suse.com/security/cve/CVE-2025-47911"
},
{
"category": "external",
"summary": "SUSE Bug 1251308 for CVE-2025-47911",
"url": "https://bugzilla.suse.com/1251308"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-02T17:45:41Z",
"details": "moderate"
}
],
"title": "CVE-2025-47911"
},
{
"cve": "CVE-2025-58190",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58190"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58190",
"url": "https://www.suse.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "SUSE Bug 1251309 for CVE-2025-58190",
"url": "https://bugzilla.suse.com/1251309"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-02T17:45:41Z",
"details": "moderate"
}
],
"title": "CVE-2025-58190"
},
{
"cve": "CVE-2026-25680",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25680"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25680",
"url": "https://www.suse.com/security/cve/CVE-2026-25680"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25680",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-02T17:45:41Z",
"details": "important"
}
],
"title": "CVE-2026-25680"
},
{
"cve": "CVE-2026-25681",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-25681"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-25681",
"url": "https://www.suse.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-25681",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-02T17:45:41Z",
"details": "important"
}
],
"title": "CVE-2026-25681"
},
{
"cve": "CVE-2026-27136",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-27136"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-27136",
"url": "https://www.suse.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-27136",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-02T17:45:41Z",
"details": "important"
}
],
"title": "CVE-2026-27136"
},
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
},
{
"category": "external",
"summary": "SUSE Bug 1268758 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1268758"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-02T17:45:41Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-02T17:45:41Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-42502",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42502"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42502",
"url": "https://www.suse.com/security/cve/CVE-2026-42502"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42502",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-02T17:45:41Z",
"details": "important"
}
],
"title": "CVE-2026-42502"
},
{
"cve": "CVE-2026-42506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42506"
}
],
"notes": [
{
"category": "general",
"text": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42506",
"url": "https://www.suse.com/security/cve/CVE-2026-42506"
},
{
"category": "external",
"summary": "SUSE Bug 1267044 for CVE-2026-42506",
"url": "https://bugzilla.suse.com/1267044"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.aarch64",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.s390x",
"openSUSE Leap 16.0:yq-0:4.53.2-bp160.1.1.x86_64",
"openSUSE Leap 16.0:yq-bash-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-fish-completion-0:4.53.2-bp160.1.1.noarch",
"openSUSE Leap 16.0:yq-zsh-completion-0:4.53.2-bp160.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-02T17:45:41Z",
"details": "important"
}
],
"title": "CVE-2026-42506"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…