RLSA-2026:66347 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS...

apr-util security update

An update is available for apr-util. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The mission of the Apache Portable Runtime APR is to provide a free library ...

freerdp security update

An update is available for freerdp. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released...

CVE-2026-89175

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values...

CVE-2026-89175

The Smart Video Intercom System developed by Kingdom Communication Associated contains a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values. The CVSS 3.1 score is 5.3 (MEDIUM)...

CVE-2026-89175 Kingdom Communication Associated｜Smart Video Intercom System - Client-Side Authentication

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values...

EUVD-2026-76002

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values...

Improper Authorization

Apache CXF is vulnerable to Improper Authorization. The vulnerability is due to the OAuth2 Dynamic Client Registration endpoint accepting and storing client-supplied scope values without validating them against an allowed scope list, which allows an attacker to self-assign privileged scopes durin...

openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side

A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability...

Important: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

BIT-TOMCAT-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, fr...

BIT-TOMCAT-2025-66614 Apache Tomcat: Client certificate verification bypass due to virtual host mapping

Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0 through 11.0.14, from 10.1.0 through 10.1.49, from 9.0.0 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions...

CLEANSTART-2026-OB74177 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5

Multiple security vulnerabilities affect the spring-boot package. Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5. See references for individual vulnerability details...

EUVD-2026-75879

Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP EPDLP service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful...

PT-2026-90354

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the setuid or setgid bits are not properly cleared on the server when a file is written to. While the Virtual File System VFS strips these bits an...

PT-2026-90213

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A buffer overflow exists in the orangefs component of the Linux kernel during the parsing of client debug masks. The orangefs prepare cdm array function calculates the size of the keywor...

PT-2026-96492

In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osd client.c:osd sparse read validates that the sparse-read data length matches the summed extent lengths, but it does not validate that each OSD-supplied extent is...

PT-2026-90350

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the SMB client within the symlink data function. The issue occurs when the ALIGN macro is used to process ErrorDataLength. If ErrorDataLength is near UINT32...

PT-2026-90347

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the CIFSTCon function incorrectly handles tree connect responses with a ByteCount of 0 or 1. In these cases, the calculation of the byte area...

CVE-2026-15710: Use of Uninitialized Resource

An information leakage vulnerability exists in the Endpoint DLP component epdlpdrv.sys of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message...