ALSA-2026:85929 Important: python3.12-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:85930 Important: python-urllib3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

RHEL 10 : openssh (RHSA-2026:85847)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85847 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files...

Alibaba Cloud Linux 3 : 0311: tomcat (ALINUX3-SA-2026:0311)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0311 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-52316: Unchecked Error Condition...

PT-2026-118479

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size...

CVE-2025-60475

A buffer overflow in the gfac4parserbs function /mediatools/avparsers.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted input...

PT-2026-118266

A malformed header in the binary file fed to QBinaryJson::fromBinaryData can cause undefined behaviour because of out-of-bounds read...

Linux Distros Unpatched Vulnerability : CVE-2026-112901

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular- expression denial of service. In XbmImageFile.open, wh...

PT-2026-118335

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML ERROR NO MEMORY until it is...

PT-2026-118239

UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service DoS condition...

CVE-2025-60496

A Floating-Point Exception FPE in the reframersendpacket function /filters/reframer.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-118647

Name of the Vulnerable Software and Affected Versions markdown-it versions 14.1.0 through 14.3.2 markdown-it versions 15.0.0 through 15.0.2 Description An algorithmic-complexity denial of service exists when processing a link reference definition with a label or title that is never closed. Using...

Linux Distros Unpatched Vulnerability : CVE-2026-112395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In...

Linux Distros Unpatched Vulnerability : CVE-2026-112895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser...

CVE-2025-60496

A Floating-Point Exception FPE in the reframersendpacket function /filters/reframer.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-60496

The GPAC Project/MP4Box software (versions before 2.5 ) contains a Floating-Point Exception (FPE) in the reframer_send_packet function located at /filters/reframer.c. An attacker can exploit this vulnerability by providing a crafted MP4 file to cause a Denial of Service (DoS) . No specific exploi...

CVE-2025-60475

A buffer overflow vulnerability exists in the gf_ac4_parser_bs function located in /media_tools/av_parsers.c within the GPAC Project/MP4Box software version before 2.5 . An attacker can exploit this flaw by supplying a crafted input to trigger a Denial of Service (DoS) . No specific remediation o...

CVE-2025-60494

The GPAC Project/MP4Box software versions before 2.5 is vulnerable to a segmentation violation within the gf_props_equal_internal function located in /filter_core/filter_props.c. An attacker can trigger a Denial of Service (DoS) by supplying a crafted data file . No specific exploit links or reme...

python3.12-urllib3 security update

1.26.19-3.2 - CVE-2026-97689 python3.12-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282261 1.26.19-3.1 - CVE-2026-97687 python3.12-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override HTTPS proxy TLS configuration...

Linux Distros Unpatched Vulnerability : CVE-2026-98612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktl...