CLSA-2026-1780534258 TuxCare security update for 8 packages (2 CVEs)

TuxCare rebuilt 8 packages to address 2 CVEs. Fixed in 28.1.0-tuxcare.1...

CLSA-2026-1780274969 TuxCare security update for 7 packages (2 CVEs)

TuxCare rebuilt 7 packages to address 2 CVEs. Fixed in 25.0.0-tuxcare.1...

CLSA-2026-1776904638 TuxCare security update for lodash (2 CVEs)

TuxCare rebuilt lodash to address 2 CVEs. Fixed in 4.17.15-tuxcare.7...

CLSA-2026-1774743847 TuxCare security update for org.xerial.snappy:snappy-java (1 CVE)

TuxCare rebuilt org.xerial.snappy:snappy-java to address 1 CVE. Fixed in 1.1.2-tuxcare.1...

CLSA-2026-1773620203 TuxCare security update for jspdf (1 CVE)

TuxCare rebuilt jspdf to address 1 CVE. Fixed in 2.5.2-tuxcare.1...

CLSA-2025-1756253594 TuxCare security update for aiohttp (1 CVE)

TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.1.post1+tuxcare...

xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel XkbNumKbdGroups but CheckKeyTypes does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift...

OPENSUSE-SU-2026:21351-1 Security update for grafana

This update for grafana fixes the following issues: Changes in grafana: - Add UI web assets as additional source tarball - Update to version 12.4.5 jscPED-16512: Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid - Update to version 12.4.4: Security a...

ALSA-2026:36639 Important: nginx:1.26 security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Bug Fixes...

postgresql:18 security update

pgaudit 18.0-1 - Update to 18.0 - Initial import for postgresql18 pgrepack 1.5.3-1 - Update to 1.5.3 - Initial import for postgresql18 1.5.1-1 - Update to v1.5.1 1.4.8-2 - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604 pgvector 0.8.1-1 - Update to 0.8.1 - Initial...

Security update 5.1.4 for Multi-Linux Manager Client Tools and Salt Bundle

Description: This update fixes the following issues: golang-github-QubitProducts-exporterexporter: Security issues fixed: CVE-2022-21698: Fixed prometheus/clientgolang possible denial of service using InstrumentHandlerCounter bsc1248699 golang-github-prometheus-nodeexporter updated to version...

podman security update

5.8.2-3.0.1 - Rework CNI/Netavark detection logic JIRA: EVG-3769 - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117404 6:5.8.2-3 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167685 6:5.8.2-2 - Rebui...

postgresql:15 security update

pgaudit 1.7.0-1 - Initial import for postgresql 15 module - Update to 1.7.0 - Support postgresql 15 - Related: 2128410 pgrepack 1.4.8-2 - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47350 1.4.8-1 - Update to version 1.4.8 - Postgresql 15 is supported - Related: 212841...

postgresql:16 security update

pgaudit 16.0-1 - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3636 pgrepack 1.5.1-1 - Update to 1.5.1 postgres-decoderbufs 2.4.0-1.Final - Initial import for postgresql 16 stream - Related: RHEL-3636 postgresql 16.14-1 - Update to 16.14 - Fix...

Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected

Summary Capsule v0.13.2 webhook rules contain namespace/finalize singular instead of namespaces/finalize plural. K8s requires plural. The finalize defense from CVE-2026-30963 fix is absent. Details PUT to /api/v1/namespaces//finalize has resource=namespaces plural. The singular rule never matches...

SUSE-SU-2026:22133-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: Update to version 20260430.00: Update dependencies and go version to 1.26.2 607 bsc1265762, CVE-2026-33814 Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 604 bsc1260264, CVE-2026-33186 Backport oslogin changes for sles16 to...

CVE-2026-46160 btrfs: fix missing last_unlink_trans update when removing a directory

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix missing lastunlinktrans update when removing a directory When removing a directory we are not updating its lastunlinktrans field, which can result in incorrect fsync behaviour in case some one fsyncs the directory afte...

CLSA-2026-1777454193 pcre2: Fix of 2 CVEs

CVE-2022-1586: fix out-of-bounds read in JIT compilexclassmatchingpath - CVE-2022-41409: diagnose negative repeat value in pcre2test...

openSUSE 16 Security Update : libsodium (openSUSE-SU-2026:20642-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20642-1 advisory. Security fixes: - CVE-2025-15444: Cryptographic bypass via improper elliptic curve point validation bsc1256070. - CVE-2025-69277: incorrect...

Security update 5.1.3 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-lusitaniae-apacheexporter: Internal changes to fix build issues with no impact for customers spacecmd: Version 5.1.13-0 Updated translation strings uyuni-tools: Version 5.1.26-0 Fixed applying PTF with images from RPMs bsc1252548 Ssl Key file...