Moderate: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

Important: Red Hat Security Advisory: kpatch-patch-5_14_0-427_100_1, kpatch-patch-5_14_0-427_44_1, kpatch-patch-5_14_0-427_55_1, kpatch-patch-5_14_0-427_68_2, and kpatch-patch-5_14_0-427_84_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: go-rpm-macros security update

An update for go-rpm-macros is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 140.8.0 ESR MFSA 2026-15 bsc1258568: CVE-2026-2757: Incorrect boundary conditions in the WebRTC: Audio/Video component CVE-2026-2758: Use-after-free in the JavaScript: GC component CVE-2026-2759:...

Important: Red Hat Security Advisory: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

USN-8071-2 nss vulnerability

USN-8071-1 fixed a vulnerability in nss. This update provides the corresponding fix for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that NSS incorrectly handled memory when performing certain GHASH operations. A remote...

Important: Red Hat Security Advisory: grafana-pcp security update

An update for grafana-pcp is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Important: Red Hat Security Advisory: grafana-pcp security update

An update for grafana-pcp is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

Important: Red Hat Security Advisory: go-rpm-macros security update

An update for go-rpm-macros is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-0869

Authentication bypass in Brocade ASCG 3.4.0 Could allow an unauthorized user to perform ASCG operations related to Brocade Support LinkBSL and streaming configuration. and could even disable the ASCG application or disable use of BSL data collection on Brocade switches within the fabric...

[SECURITY] Fedora 42 Update: coturn-4.9.0-1.fc42

The Coturn TURN Server is a VoIP media traffic NAT traversal server and gatew ay. It can be used as a general-purpose network traffic TURN server/gateway, too. This implementation also includes some extra features. Supported RFCs: TURN specs: - RFC 5766 - base TURN specs - RFC 6062 - TCP relaying...

[SECURITY] Fedora 42 Update: php-zumba-json-serializer-3.2.4-1.fc42

This is a library to serialize PHP variables in JSON format. It is similar of the serialize function in PHP, but the output is a string JSON encoded. You can also unserialize the JSON generated by this tool and have you PHP content back. Autoloader: /usr/share/php/Zumba/JsonSerializer/autoload.ph...

org.jasig.cas:cas-server-support-token (>=4.2.0-rc1, <=4.2.1), org.jasig.cas:cas-server-support-token-webflow (>=4.2.0-rc1, <=4.2.1) potentially affected by CVE-2026-29000 via org.pac4j:pac4j-jwt (1.8.2)

org.pac4j:pac4j-jwt MAVEN version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-jwt and may be impacted: - org.jasig.cas:cas-server-support-token =4.2.0-rc1, =4.2.0-rc1, =4.2.1 Source cves: CVE-2026-29000 Source advisory:...

net.bookrain:example-system (0.0.1), net.bookrain:system (0.0.1) +6 more potentially affected by CVE-2026-29000 via org.pac4j:pac4j-jwt (3.4.0)

org.pac4j:pac4j-jwt MAVEN version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-jwt and may be impacted: - net.bookrain:example-system 0.0.1 - net.bookrain:system 0.0.1 - org.apereo.cas:cas-server-support-token-authentication...

ba.sake:pac4j-testkit (>=0.1.0, <=0.2.0), com.github.hiwepy:pac4j-spring-boot-starter (3.3.x.20241020.release) +2 more potentially affected by CVE-2026-29000 via org.pac4j:pac4j-jwt (>=6.0.5, <=6.2.2)

org.pac4j:pac4j-jwt MAVEN version =6.0.5, =0.1.0, =7.1.0-rc6, =7.1.0-rc6, =7.3.4 Source cves: CVE-2026-29000 Source advisory: GHSA-PM7G-W2CF-Q238...

org.jasig.cas:cas-server-support-token (>=4.2.5, <=4.2.7), org.jasig.cas:cas-server-support-token-webflow (>=4.2.5, <=4.2.7) potentially affected by CVE-2026-29000 via org.pac4j:pac4j-jwt (1.8.9)

org.pac4j:pac4j-jwt MAVEN version 1.8.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-jwt and may be impacted: - org.jasig.cas:cas-server-support-token =4.2.5, =4.2.5, =4.2.7 Source cves: CVE-2026-29000 Source advisory:...

CKEditor cross-site scripting vulnerability

CKEditor is an open-source enterprise-level WYSIWYG editor developed by CKEditor. Versions of CKEditor prior to 47.6.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from the General HTML Support feature, which allowed cross-site scripting, potentially enabling the...

osbuild-composer security update

149-5.0.1 - Add missing dependency over dracut-config-rescue for image-installer Orabug: 38587453 - Add OL10 support - Update repository URLs for baseos, appstream and UERK - Fix the label for UEKR repository - Simplify repository names JIRA: OLDIS-35893 - Ensure build on latest golang:...

CVE-2026-28343: Improper Neutralization of Input During Web Page Generation

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a cross-site scripting XSS vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially craft...

GHSA-5HWF-RC88-82XM Fickling missing RCE-capable modules in UNSAFE_IMPORTS

Assessment The modules uuid, osxsupport and aixsupport were added to the blocklist of unsafe imports https://github.com/trailofbits/fickling/commit/ffac3479dbb97a7a1592d85991888562d34dd05b. Original report Summary fickling's UNSAFEIMPORTS blocklist is missing at least 3 stdlib modules that provid...