Moderate: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.12 bug fix and security update

Red Hat OpenShift Container Platform release 4.20.12 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

AZL-75470 CVE-2026-24809 affecting package ntopng for versions less than 5.2.1-4

An issue from the component luaGrunerror in dependencies/lua/src/ldebug.c in praydog/REFramework version before 1.5.5 leads to a heap-buffer overflow when a recursive error occurs...

CVE-2026-24793

Out-of-bounds Write, Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in azerothcore azerothcore-wotlk deps/zlib modules. This vulnerability is associated with program files inflate.C. This issue affects azerothcore-wotlk: through v4.0.0...

SUSE CVE-2026-22990

In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUGON in osdmapapplyincremental If the osdmap is maliciously corrupted such that the incremental osdmap epoch is different from what is expected, there is no need to BUG. Instead, just declare the...

PT-2026-4995

Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, inefficiency in http1 headers parsing can lead to slowdown over multiple packets. Version 8.0.3 patches the issue. No known workarounds are available...

PT-2026-4996

Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free condition when generating excessive amounts of alerts for a single packet. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, do not run...

PT-2026-4914

Name of the Vulnerable Software and Affected Versions askbot versions prior to 0.12.2 Description An authenticated attacker with normal user permissions can modify the profile picture of other application users. Recommendations Update to a version later than 0.12.2...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005114)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005114 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: handle inconsistent state in nilfsbtnodecreateblock Syzbot reported that a buffer state...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005137)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005137 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: avoid OOB when system.data xattr changes underneath the filesystem When looking up for an...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005141)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005141 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4extinsertextent As Ojaswin mentioned in Link, in...

curl security update

7.76.1-35.el97.3 - http: fix crash in rate-limited upload RHEL-129493 7.76.1-35.el97.2 - openssl: respect system crypto policy for TLS max version RHEL-128921 7.76.1-35.el97.1 - rebuild for rhel-9.7.0 z-stream RHEL-121659 7.76.1-35 - cookie: don't treat the leading slash as trailing CVE-2025-9086...

YDB security vulnerabilities

YDB is an open-source distributed SQL database developed by the YDB Platform. Versions of YDB prior to 24.4.4.2 contained security vulnerabilities. These vulnerabilities stemmed from the program file yailtree.C failing to release memory after a valid lifecycle was completed...

Cross-dashboard privilege escalation via permission management

Grafana is an open-source platform for monitoring and observability. The platform supports creating dashboards, which collate various visualisation panels onto one plane. These can have per-user permissions. If a user has permission management rights on one dashboard, they could edit the...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005006)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005006 advisory. In the Linux kernel, the following vulnerability has been resolved: block, bfq: don't move oombfqq Our test report a UAF: 2073.019181...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005047)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005047 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: validate user input for expected length I got multiple syzbot reports showing old bugs...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005063)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005063 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential kernel bug due to lack of writeback flag waiting Destructive writes to a...

Security update for avahi (moderate)

openSUSE security update: security update for avahi ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20110-1 Rating: moderate References: bsc1256498 bsc1256499 bsc1256500 Cross-References: CVE-2025-68276 CVE-2025-68468 CVE-2025-68471 CVSS scores:...

gcc-toolset-15-binutils security update

2.44-3.1 - Fix a potential illegal memory access when linking a corrupt input file. RHEL-130674...

UBUNTU-CVE-2025-69418

Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof 16 bytes can leave the final partial block unencrypted and unauthenticated.Impact summary: The trailing 1-15 bytes of a message may be exposed...