RLSA-2026:57254 Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154create CVE-2024-56602 kernel: ip6gre: Use cached t-net in...

de.fu-berlin.mi.hcc.questionnaires:questionnaires_web (1.0), events.boudicca:eventcollector-client (>=0.6.0, <=0.7.0) +4 more potentially affected by CVE-2026-63490 via com.github.jknack:handlebars-springmvc (>=4.0.0, <=4.5.2)

com.github.jknack:handlebars-springmvc MAVEN version =4.0.0, =0.6.0, =0.6.0, =3.0.0, =1.1.0, =0.2.8, =0.5.0 Source cves: CVE-2026-63490 Source advisory: SNYK:JAVA-COMGITHUBJKNACK-19233596...

SUSE CVE-2026-74942

Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

SUSE CVE-2026-75874

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2...

CVE-2026-75874

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the Remote Settings Client component...

CVE-2026-75932: Missing Authorization

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth...

CVE-2026-62316: Exposure of Sensitive Information to an Unauthorized Actor

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/httpservers/linuxmcpserver.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An...

kernel security, bug fix, and enhancement update

4.18.0-553.157.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

PT-2026-79429

Name of the Vulnerable Software and Affected Versions Element Web versions prior to 1.12.22 Description The EmbeddedPage component in apps/web/src/components/structures/EmbeddedPage.tsx renders homepage content supplied by the homeserver using dangerouslySetInnerHTML without utilizing...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102021)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102021 advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has ...

Fedora 44 : openssh (2026-752aa3ff05)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-752aa3ff05 advisory. Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded Tenable has extracted the preceding description block directly from the Fedora...

Oracle Linux 9 : kernel (ELSA-2026-57252)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-57252 advisory. - smb: client: validate DFS referral PathConsumed CKI Backport Bot RHEL-237668 CVE-2026-68343 - posix-cpu-timers: Prevent UAF caused by non-leader exe...

RockyLinux 8 : kernel-rt (RLSA-2026:57254)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:57254 advisory. kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154create CVE-2024-56602 kernel: ip6gre: Use cached t-net in ip6erspanchangelink...

AlmaLinux 8 : kernel (ALSA-2026:57253)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:57253 advisory. kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154create CVE-2024-56602 kernel: ip6gre: Use cached t-net in ip6erspanchangelink...

Linux Distros Unpatched Vulnerability : CVE-2026-63481

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in...

RockyLinux 8 : kernel (RLSA-2026:57253)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:57253 advisory. kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154create CVE-2024-56602 kernel: ip6gre: Use cached t-net in ip6erspanchangelink...

Oracle Linux 10 : kernel (ELSA-2026-57251)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-57251 advisory. - udf: fix partition descriptor append bookkeeping CKI Backport Bot RHEL-179570 CVE-2026-45991 - crypto: pcrypt - Fix handling of MAYBACKLOG requests...

FreeRDP RDP Server DoS

The vulnerability of the rdpsndserverrecvformats function in the channels/rdpsnd/server/rdpsndmain.c file of the RDP client FreeRDP is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-49244

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

CVE-2026-50192 Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect

Kerberos Agent is an open source video surveillance management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom X-Kerberos-Hub-PrivateKey and X-Kerberos-Hub-PublicKey request headers to the operator-configured Hub URL config.HubURI. The...