Security update for docker (important)

openSUSE security update: security update for docker ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22158-1 Rating: important References: bsc1073877 bsc1099277 bsc1262346 bsc1265782 bsc1266176 bsc1266625 bsc1267827 bsc1268280 bsc1268359 bsc1271209...

Important: pcre2

Issue Overview: A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code...

Important: xorg-x11-server

Issue Overview: CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but does not NULL the pointer. When the error path continues, XkbClearDoodad is called during cleanup and frees the same pointer again, resulting in a double free. An authenticated X client can trigger this by sending a...

Important: xorg-x11-server-Xwayland

Issue Overview: CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but does not NULL the pointer. When the error path continues, XkbClearDoodad is called during cleanup and frees the same pointer again, resulting in a double free. An authenticated X client can trigger this by sending a...

Important: tigervnc

Issue Overview: CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but does not NULL the pointer. When the error path continues, XkbClearDoodad is called during cleanup and frees the same pointer again, resulting in a double free. An authenticated X client can trigger this by sending a...

Rocky Linux 9.6 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792819460)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792819460 advisory. - xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow CVE-2026-93517 -...

Rocky Linux 10.2 [CIQ] Security Update: pgvector / pgvector-debuginfo / postgresql16-pgvector-debugsource (crlsa-2026_88359)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202688359 advisory. pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (crlsa-2026_88164)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202688164 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

Amazon Linux 2 : perl-YAML (ALAS-2026-4035)

The version of perl-YAML installed on the remote host is prior to 0.84-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4035 advisory. YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A...

MiracleLinux 8 : xorg-x11-server-Xwayland-21.1.3-20.el8_10.4 (AXSA:2026-2137:09)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2137:09 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server:...

Debian dla-4856 : xdg-dbus-proxy - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4856 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4856-1 [email protected] https://www.debian.org/lts/security/...

Linux Distros Unpatched Vulnerability : CVE-2026-110264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3...

AlmaLinux 9.6 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792819460)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792819460 advisory. - xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow CVE-2026-93517 -...

Important: perl-YAML

Issue Overview: YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY do...

Important: tigervnc

Issue Overview: CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but does not NULL the pointer. When the error path continues, XkbClearDoodad is called during cleanup and frees the same pointer again, resulting in a double free. An authenticated X client can trigger this by sending a...

Important: xorg-x11-server

Issue Overview: CheckSetDoodad in xkb/xkb.c frees doodad-text.text on error but does not NULL the pointer. When the error path continues, XkbClearDoodad is called during cleanup and frees the same pointer again, resulting in a double free. An authenticated X client can trigger this by sending a...

PHP 8.5.12 Session Upload Progress Serializer Confusion

PHP version 8.5.12 contains a session upload progress serializer confusion issue when an application changes the session serializer at runtime, allowing unauthenticated object injection and remote code execution where a suitable gadget is present. https://packetstorm.news/download/237404...

mariadb: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections

A flaw was found in MariaDB. An authenticated remote attacker with low privileges can cause memory corruption and potentially achieve arbitrary code execution by submitting specially crafted Geographic Information System GIS objects. This issue is caused by an out-of-bounds write in the STAsText...

CVE-2026-89861

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs in the qla24xxreportidacquisition function where a virtual port reference is not properly maintained. A local attacker could exploit this timing issue, allowing a concurrent operation to free the virtual port...

CVE-2026-89864

A flaw was found in the qla2xxx SCSI driver in the Linux kernel. This vulnerability allows a local attacker, with CAPSYSRAWIO capabilities, to cause heap and kernel stack corruption due to unbounded length fields in I2C bsg handlers. Successful exploitation could lead to privilege escalation or...