Security update for alloy

This update for alloy fixes the following issues CVE-2026-10722: github.com/cilium/ebpf: BTF string offset boundary check can lead to crash when parsing malformed ELF/BTF input bsc1267811. CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple...

Security update for go1.25

This update for go1.25 fixes the following issues Update to version go1.25.12 bsc1244485. CVE-2026-25679: net/url: reject IPv6 literal not at start of host bsc1259264. CVE-2026-27139: os: FileInfo can escape from a Root bsc1259268. CVE-2026-27142: html/template: URLs in meta content attribute...

CVE-2026-42486

Summary: CVE-2026-42486 is documented as a RBAC-related vulnerability in XAPI. Several CVEs describe over-permissive admin roles; specifically, CVE-2026-42486 states that a vm-admin can set VM.platform:hvm_serial, a setting that should be pool-admin restricted, and this can allow arbitrary dom0 f...

CVE-2026-23560

Summary: The CVE-2026-23560 issue is described in multiple sources as a RBAC-related vulnerability in XAPI for XenServer/XCP-ng where a vm-admin can modify VM.other-config:is_system_domain to mark a VM as a system domain. This can cause system domains to be ignored or hidden during certain host/p...

CVE-2026-23559

CVE-2026-23559 (and related RBAC issues 23560–23562, 42486) affect XAPI in XenServer/XCP-ng where a vm-admin can abuse RBAC to gain higher privileges, including arbitrary read/modify of dom0 files via VBD.other_config, alter system-domain status, disrupt PBD/storage-domain mappings, and potential...

PT-2026-57234

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.74.4 Description When using the -l/--links flag, the software serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target. This allows an attacker-controlle...

PT-2026-57242

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.74.4 Description The archive extract function allows the creation or overwriting of sibling objects within the same bucket or path scope. This occurs when extracting a specially crafted archive containing parent path...

openSUSE 16 Security Update : go1.26-openssl (openSUSE-SU-2026:21254-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21254-1 advisory. Update to go1.26.4 bsc1255111. Security issues fixed: - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG bsc1261653. -...

OPENSUSE-SU-2026:11238-1 python313-pypdf-6.14.2-1.1 on GA media

These are all security issues fixed in the python313-pypdf-6.14.2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11230-1 curl-8.21.0-1.1 on GA media

These are all security issues fixed in the curl-8.21.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11232-1 go1.26-1.26.5-1.1 on GA media

These are all security issues fixed in the go1.26-1.26.5-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11237-1 python313-maturin-1.14.1-1.1 on GA media

These are all security issues fixed in the python313-maturin-1.14.1-1.1 package on the GA media of openSUSE Tumbleweed...

AlmaLinux 10 : kernel (ALSA-2026:36541)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:36541 advisory. kernel: eventpoll: defer struct eventpoll free to RCU grace period CVE-2026-43074 kernel: net: mana: Fix double destroyworkqueue on service rescan PCI...

RHEL 8 : httpd:2.4 (RHSA-2026:36846)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36846 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP...

OPENSUSE-SU-2026:11241-1 rclone-1.74.4-1.1 on GA media

These are all security issues fixed in the rclone-1.74.4-1.1 package on the GA media of openSUSE Tumbleweed...

Oracle Linux 9 : gstreamer1-plugins-ugly-free (ELSA-2026-36674)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-36674 advisory. - Fix CVE-2026-53704: multiple rmdemux security issues Tenable has extracted the preceding description block directly from the Oracle Linux security...

OPENSUSE-SU-2026:11242-1 spectre-meltdown-checker-26.36.0602723-1.1 on GA media

These are all security issues fixed in the spectre-meltdown-checker-26.36.0602723-1.1 package on the GA media of openSUSE Tumbleweed...

Important: Red Hat Security Advisory: httpd:2.4 security update

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Commo...

OPENSUSE-SU-2026:21277-1 Security update for go-sendxmpp

This update for go-sendxmpp fixes the following issues: Changes in go-sendxmpp: - Update to 0.16.0: Added: Add Ox support to http-upload. Add Ox support for private group chats. Show error cause if joining MUCs failedi requires go-xmpp = v0.3.5. Changed: Fix --ox-delete-nodes. Fix receiving of 1-...

CVE-2026-59879

Immutable.js List contains a 32-bit trie overflow in List.js setListBounds that, prior to versions 4.3.9 and 5.1.8, can mishandle an index or size in the 2^30–2^31 range, leading to an uncatchable infinite loop for empty Lists, unbounded allocation for populated Lists, or silent wrap of large set...