CVE-2026-63387 affecting package libevent for versions less than 2.1.13-1

CVE-2026-63387 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-63379 affecting package libevent for versions less than 2.1.13-1

CVE-2026-63379 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-20576

Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation...

CVE-2023-20576

Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation...

CLSA-2026-1788377477 TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 7 CVEs. Fixed in 5.1.9.RELEASE-tuxcare.5...

CLSA-2026-1788375461 TuxCare security update for postcss (2 CVEs)

TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.4.41-tuxcare.4...

CLSA-2026-1788375457 TuxCare security update for postcss (2 CVEs)

TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.4.31-tuxcare.3...

GO-2026-6334 Gitea pull request branch permission checks allow unauthorized updates and rebases in code.gitea.io/gitea

Gitea pull request branch permission checks allow unauthorized updates and rebases in code.gitea.io/gitea...

CLSA-2026-1788373419 TuxCare security update for postcss (2 CVEs)

TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.4.14-tuxcare.4...

CLSA-2026-1788373352 TuxCare security update for postcss (2 CVEs)

TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.4.5-tuxcare.3...

CLSA-2026-1788373105 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 2 CVEs. Fixed in 6.0.13-tuxcare.2...

CLSA-2026-1788372833 TuxCare security update for org.springframework (25 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 25 CVEs. Fixed in 6.0.12-tuxcare.1...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

CLSA-2026-1788372470 TuxCare security update for org.springframework (21 CVEs)

TuxCare rebuilt 23 org.springframework packages to address 21 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.4...

CVE-2026-53670 PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add silently skips offset-variable updates when the destination register carries a non-singleton typeset two or more simultaneously possible...

CVE-2026-53670

PREVAIL , a polynomial-runtime eBPF verifier using an abstract interpretation layer, is vulnerable to a verifier bypass prior to version 0.2.4 . In the EbpfTransformer::add() function, offset-variable updates are silently skipped when the destination register carries a non-singleton typeset (two ...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers. "The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily...

CVE-2026-84677

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values plugin names, descriptions, and version metadata on plugin download index pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to provide a plugin for hosting...

CVE-2026-84650

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, the impact depending on how those fields are used...