expat security update

2.5.0-2.2 - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Resolves: RHEL-221012 2.5.0-2.1 - Fix CVE-2026-50219 - Resolves: RHEL-220979...

PT-2026-87129

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

PT-2026-88600

Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

Oracle Linux 10 : ELSA-2026-64810-0: / expat (ELSA-2026-648100)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-648100 advisory. - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Fix CVE-2026-50219: forbid XMLParserFree/Reset from handlers - expat:...

NewStart CGSL MAIN 7.02 : rsync Vulnerability (NS-SA-2026-0113)

The remote NewStart CGSL host, running version MAIN 7.02, has rsync packages installed that are affected by a vulnerability: - A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious...

ROOT-APP-PYPI-CVE-2023-50782 CVE-2023-50782 in cryptography - Patched by Root

Root has patched CVE-2023-50782 in the cryptography package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-26130 CVE-2024-26130 in cryptography - Patched by Root

Root has patched CVE-2024-26130 in the cryptography package for Root:PyPI. Multiple fixed versions available...

CVE-2026-75104

A flaw was found in Hugging Face Transformers. Attackers can exploit this by supplying malicious checkpoint index files with parent-directory references or absolute paths that are not properly validated. This vulnerability allows for reading arbitrary files outside the model directory, leading to...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053333)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053333 advisory. In the Linux kernel, the following vulnerability has been resolved: block: Fix handling of offline queues in blkmqallocrequesthctx This patch prevents that test...

ALPINE-CVE-2026-0799

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to tr...

AZL-99744 CVE-2026-0799 affecting package libpcap for versions less than 1.10.7-1

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to tr...

AZL-99933 CVE-2026-0799 affecting package nmap 7.95-5

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to tr...

CVE-2026-0799 OOBR and OOBW in libpcap before 1.10.7

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to tr...

SUSE CVE-2026-80812

In the Linux kernel, the following vulnerability has been resolved: ALSA: dummy: Check card index validity at probe snddummyprobe blindly trusts that the given devptr-id value is within the proper card index range. It's OK for the devices the driver itself creates at the module probe time, but if...

PT-2026-86440

Name of the Vulnerable Software and Affected Versions libpcap versions prior to 1.10.7 Description The BPF interpreter fails to validate the register index when loading or storing values from or to a scratch memory register. While the index is an unsigned 32-bit integer that should not exceed 15,...

Linux Distros Unpatched Vulnerability : CVE-2026-0799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpc...

CVE-2026-80812

In the Linux kernel, the following vulnerability has been resolved: ALSA: dummy: Check card index validity at probe snddummyprobe blindly trusts that the given devptr-id value is within the proper card index range. It's OK for the devices the driver itself creates at the module probe time, but if...

AZL-99675 CVE-2026-80812 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: dummy: Check card index validity at probe snddummyprobe blindly trusts that the given devptr-id value is within the proper card index range. It's OK for the devices the driver itself creates at the module probe time, but if...

CVE-2026-85664

Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters maxneighbors, efconstruction, and efsearch in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction...

CVE-2026-80812

CVE-2026-80812 affects the Linux kernel 's ALSA dummy driver. The function snd_dummy_probe() does not validate the devptr->id (card index) value, assuming it is always within range. While this is safe for devices created at module probe time, a device manually bound via the sysfs interface can...