CVE-2026-112894

A flaw was found in Pillow. When converting multi-frame images into a multi-page PDF document, the library repeatedly scans previously assigned object identifiers, resulting in quadratic processing time. A remote attacker could exploit this vulnerability by supplying a crafted image with a large...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.2: grafana13.2-13.2.4-0.1.hum1 aarch64, s390x, x8664 grafana13.2-13.2.4-0.1.hum1.src src...

CVE-2026-112392

The Pillow Python imaging library contains a NULL pointer dereference vulnerability in its rank-based filters, affecting versions prior to 13.0.0 . The issue occurs when ImagingExpand() is called on a zero-size image ; the function allocates a non-empty output but fails while attempting to replic...

CVE-2026-112392 Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

CVE-2026-112392 Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

CVE-2026-112392 Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana12.4: grafana12.4-12.4.13-0.1.hum1 aarch64, x8664 grafana12.4-12.4.13-0.1.hum1.src src...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.2: grafana13.2-13.2.3-0.3.hum1 aarch64, s390x, x8664 grafana13.2-13.2.3-0.3.hum1.src src Security Fixes: grafana13.2: CVE-2026-100347 CVE-2026-100348 CVE-2026-100349 CVE-2026-100351...

CVE-2026-112264

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...

CVE-2026-111935

NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing...

Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: openssh: openssh-10.5p1-1.3.hum1 aarch64, s390x, x8664 openssh-askpass-10.5p1-1.3.hum1 aarch64, s390x, x8664 openssh-clients-10.5p1-1.3.hum1 aarch64, s390x, x8664 openssh-keycat-10.5p1-1.3.hum1...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libXi: libXi-1.8.4-0.1.hum1 aarch64, s390x, x8664 libXi-devel-1.8.4-0.1.hum1 aarch64, s390x, x8664 libXi-1.8.4-0.1.hum1.src src...

rekall

Rekall discontinuation This project is no longer maintained. In December 2011, a new branch within the Volatility project was created to explore how to make the code base more modular, improve performance, and increase usability. This branch was later forked to become Rekall. The modularity allow...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs24: nodejs24-24.21.0-1.5.hum1 aarch64, s390x, x8664 nodejs24-bin-24.21.0-1.5.hum1 noarch nodejs24-devel-24.21.0-1.5.hum1 aarch64, s390x, x8664 nodejs24-docs-24.21.0-1.5.hum1 noarch...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: mariadb10.11: mariadb10.11-10.11.18-4.1.1.hum1 aarch64, s390x, x8664 mariadb10.11-backup-10.11.18-4.1.1.hum1 aarch64, s390x, x8664 mariadb10.11-client-utils-10.11.18-4.1.1.hum1 noarch...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: dotnet8.0: aspnetcore-runtime-8.0-8.0.32-0.1.hum1 aarch64, x8664 aspnetcore-runtime-dbg-8.0-8.0.32-0.1.hum1 aarch64, x8664 aspnetcore-targeting-pack-8.0-8.0.32-0.1.hum1 aarch64, x8664...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: mariadb11.8: mariadb11.8-11.8.9-0.1.hum1 aarch64, s390x, x8664 mariadb11.8-backup-11.8.9-0.1.hum1 aarch64, s390x, x8664 mariadb11.8-client-utils-11.8.9-0.1.hum1 noarch...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs26: nodejs26-26.11.1-0.4.hum1 aarch64, s390x, x8664 nodejs26-bin-26.11.1-0.4.hum1 noarch nodejs26-devel-26.11.1-0.4.hum1 aarch64, s390x, x8664 nodejs26-docs-26.11.1-0.4.hum1 noarch...

CVE-2026-112264: Improper Neutralization of Special Elements used in an OS Command

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...

CVE-2026-111935: External Control of File Name or Path

NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing...