GHSA-RJ75-HQRM-R3GF vulnerabilities

Vulnerabilities for packages: pulumi, langfuse, vitess, npm, jupyter-base-notebook, renovate...

GHSA-65R4-943X-97JJ vulnerabilities

Vulnerabilities for packages: opensearch, apache-tika, nextflow, spdx-tools-java...

CVE-2026-75140 vulnerabilities

Vulnerabilities for packages: opensearch, apache-tika, nextflow, spdx-tools-java...

GHSA-6W6G-HM98-MHGM vulnerabilities

Vulnerabilities for packages: ntpd-rs, shadowsocks-rust, vector, linkerd2-proxy, sccache...

GHSA-5J98-2G5X-46V6 vulnerabilities

Vulnerabilities for packages: ntpd-rs, shadowsocks-rust, vector, linkerd2-proxy, sccache...

GHSA-6F2X-V7Q7-M7M5 vulnerabilities

Vulnerabilities for packages: ntpd-rs, shadowsocks-rust, vector, linkerd2-proxy, sccache...

CVE-2026-84897

src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSHMSGKEXDHGEXGROUP 31 and SSHMSGKEXDHGEXREPLY 33 when a server receives them from an unauthenticated client. IsMessageAllowedServer applies no direction check to the key exchange...

CVE-2026-81535

In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an...

CVE-2026-16516

wolfSSH does not validate that the ECDSA curve identifier in a KEXDHREPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey src/internal.c, the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated...

CVE-2026-106061

A flaw was found in GIMP’s X cursor XMC thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subseque...

openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy

A flaw was found in OpenSSH, a widely used tool for secure remote access. When a user attempts to copy files between two different remote systems using the scp command, the file might be incorrectly placed in a directory above the intended destination. This unintended file placement could lead to...

openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack ca...

openssh: OpenSSH: sftp client allows attacker to control downloaded file location

A flaw was found in OpenSSH. The sftp client, when used to download files from a malicious server with the 'sftp server:/path .' command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or...

openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side

A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability...

[SECURITY] Fedora 44 Update: python3-docs-3.14.8-1.fc44

The python3-docs package contains documentation on the Python 3 programming language and interpreter...

[SECURITY] Fedora 44 Update: python3.14-3.14.8-1.fc44

Python 3.14 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries...

[SECURITY] Fedora 44 Update: musescore-4.7.5-3.fc44

MuseScore is a free cross platform WYSIWYG music notation program. Some highlights: WYSIWYG, notes are entered on a "virtual note sheet" Unlimited number of staves Up to four voices per staff Easy and fast note entry with mouse, keyboard or MIDI Integrated sequencer and FluidSynth software...

[SECURITY] Fedora 44 Update: golang-x-mod-0.28.0-5.fc44

This packages holds packages for writing tools that work directly with Go mod ule mechanics. That is, it is for direct manipulation of Go modules themselves...

[SECURITY] Fedora 44 Update: libical-3.0.20-8.fc44

Reference implementation of the iCalendar data type and serialization format used in dozens of calendaring and scheduling products...

curl: libcurl: Improper certificate validation due to cached TLS settings reuse

A flaw was found in libcurl. When handling secure connections TLS and reusing connection settings, libcurl could incorrectly apply a cached security setting related to certificate chain validation. This could allow libcurl to accept a server's security certificate that it should have otherwise...