Security Bulletin: Vulnerabilities in xorg-x11-server, mod_http2, httpd, openssl, openssl-fips-provider, glibc, libxml2, kernel, sssd, krb5, expat, rsyslog, apr-util libraries affect Power HMC.

Summary The xorg-x11-server, modhttp2,httpd, openssl, openssl-fips-provider, glibc, libxml2, kernel, sssd, krb5, expat, rsyslog, apr-util libraries are used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. The applicable CVEs are as follows: CVE-2026-33999,...

CVE-2026-94185 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias

nvm resolves a requested version or alias by treating it as a filename under $NVMDIR/alias. Before 0.40.8, nvmalias concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default...

CVE-2026-94185 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias

nvm resolves a requested version or alias by treating it as a filename under $NVMDIR/alias. Before 0.40.8, nvmalias concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default...

ANT-2026-SBF8X04Q · SELinux · Type Confusion

type-confusion medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-SBF8X04Q: Type confusion in CIL sensitivity alias...

CLSA-2026-1785917589 tigervnc: Fix of 6 CVEs

CVE-2026-50256: fix stack buffer overflow in font alias resolution in the bundled xorg-x11-server source by raising XLFDMAXFONTNAMELEN to libXfont2's MAXFONTNAMELEN and rejecting over-long resolved names - CVE-2026-50257: fix use-after-free in miSyncDestroyFence in the bundled xorg-x11-server...

xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias...

RHEL 6 : tigervnc (RHSA-2026:49519)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49519 advisory. Virtual Network Computing VNC is a remote display system which allows users to view a computing desktop environment not only on the machine...

xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias...

PYSEC-2026-3031 PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code

Summary The plugin security validator in PySpector uses AST-based static analysis to prevent dangerous code from being loaded as plugins. The blocklist implemented in PluginSecurity.validateplugincode is incomplete and can be bypassed using several Python constructs that are not checked. An...

Important: Red Hat Security Advisory: xorg-x11-server-Xwayland security update

An update for xorg-x11-server-Xwayland is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias...

xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias...

TencentOS Server 3: xorg-x11-server (TSSA-2026:0598)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0598 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias...

X.Org Server Font Alias Stack-based Buffer Overflow Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within font alias resolution...

Important: xorg-x11-server security, bug fix, and enhancement update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fixes: xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution du...

AZL-89571 CVE-2026-50256 affecting package xorg-x11-server-Xwayland for versions less than 24.1.12-1

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias...

CVE-2026-50256 Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias...

CVE-2026-50256

The CVE affects the X.Org X server and Xwayland. A mismatch between the server and libXfont2 regarding maximum font name length (server-allocated 256-byte stack buffer vs libXfont2 name length up to 1024 bytes) allows a font alias name of 257–1023 bytes to overflow the stack during alias resoluti...

CVE-2026-50256: Stack-based Buffer Overflow

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias...