gzip security update

An update is available for gzip. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The gzip packages contain the gzip GNU zip data compression utility. gzip is us...

CVE-2026-53682

An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles security domain topology and participating subsystems, without requiring a principal, client certificate, or...

CVE-2026-80649

A flaw was found in the Linux kernel's System Control and Management Interface SCMI power management. The scmipowernameget function fails to validate the domain number provided by an external caller. This oversight can lead to an out-of-bounds access, potentially allowing an attacker to read or...

CVE-2026-80607

A flaw was found in the Linux kernel's tracing/probes component. A local user could trigger a kernel warning WARNONONCE by adding a kprobe event based on a raw address with a BTF BPF Type Format parameter. This could lead to minor information disclosure through kernel log messages...

CVE-2026-82662

A flaw was found in Nodemailer where it disables Transport Layer Security TLS certificate verification. A remote attacker, positioned between the user and the server a machine-in-the-middle attack, could exploit this by intercepting OAuth2 token requests. This allows the attacker to capture...

CVE-2026-82660

A flaw was found in Nodemailer, a module for sending emails. The jsonTransport component, responsible for handling message data, does not correctly enforce security options designed to prevent unauthorized file and URL access. A remote attacker could exploit this by sending specially crafted...

CVE-2026-82556

A flaw was found in Forgejo. A remote attacker could exploit a server-side request forgery SSRF vulnerability by manipulating the net.LookupIP function within the Repository Migration Handler. This could allow the attacker to force the server to make requests to arbitrary network resources,...

CVE-2026-80717

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could exploit this by sending a specially crafted SCTP INIT message containing a malformed Adaptation Layer Indication parameter. The vulnerability causes the kernel to read beyond t...

CVE-2026-18654

A flaw was found in AWS CLI. This vulnerability, located in the Elastic MapReduce EMR Secure Shell SSH helper commands, involves a lack of entity authentication during key exchange. A remote attacker, positioned between the client and the EMR cluster, could exploit this to intercept SSH sessions...

CVE-2026-19952

creationtimestamp| type| source ---|---|--- 2026-09-01 10:01:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muh5zrq7ee2i 2026-09-22 07:00:09+00:00| seen| Telegram/Bq15RX4hLps3YxF9UScb9XcGJp6cilOG7wedbwLQyx-TtQ 2026-09-22 07:00:10+00:00| seen|...

Security Bulletin: Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition (CVE-2026-61308, CVE-2026-71054, CVE-2026-70907, CVE-2026-60589)

Summary This bulletin for IBM SDK, Java Technology Edition covers all applicable Java SE CVEs published by Oracle as part of their August 2026 Critical Security Patch Update. For more information please refer to Oracle's August 2026 CSPU Advisory and the CVE links referenced below. Vulnerability...

CVE-2026-40203

A flaw was found in dovecot where, when IMAP compression is enabled, the system reuses the same compression state across responses within a session. This allows a remote attacker, who can send mail to a user and monitor the sizes of their IMAP traffic, to potentially deduce the content of small...

kernel: mm/huge_memory: update file PMD counter before folio_put()

A flaw was found in the Linux kernel's memory management, specifically within the huge page mechanism. When a huge page is split, the system updates a counter after releasing a reference to the memory. This timing issue can lead to the system attempting to read from memory that has already been...

kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count

A flaw was found in the Linux kernel's synaptics-rmi4 input driver. This vulnerability occurs because the driver incorrectly allocates memory for a keymap, leading to an out-of-bounds memory access. A local user with access to a specially crafted input device could exploit this to read or write t...

kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability

An attacker executing code on affected system could inject an interrupt at a precise moment to disrupt "Safe RET", the default Linux mitigation for speculative Return Overflow SRSO, which could potentially weaken that protection and may result in information disclosure...

kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memor...

kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count

A flaw was found in the Linux kernel's synaptics-rmi4 input driver. The rmif3amapgpios function incorrectly allocates memory for the gpiokeymap, making it smaller than required. This allows a device reporting a specific gpiocount value to trigger an out-of-bounds read, leading to information...

kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()

A flaw was found in the Linux kernel's nfnetlinkcthelper component. This vulnerability, an out-of-bounds read, occurs in the nfnlcthelperdumptable function when a network connection tracking helper is removed during a dump operation, leading to a bypassed bounds check. A local attacker could...

CVE-2026-80708

A flaw was found in the Linux kernel's s390/zcrypt module. During the clear key to secure key token import process, an internal buffer used by the ipcprbhelper function was not properly scrubbed after use. This oversight could leave sensitive clear key material in memory. A local attacker could...

CVE-2026-13611

The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...