openssh security update

8.0p1-30.0.1 - Update upstream references Orabug: 36587718 8.0p1-30 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-185775 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX...

CVE-2026-53586

Unknown description...

CVE-2026-53584

Unknown description...

CVE-2026-53587

Unknown description...

CVE-2026-53585

Unknown description...

CVE-2026-54715

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. In version 1.10.2, parsebrowser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Age...

GHSA-X445-F3H2-J279 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse, langfuse-fips...

GHSA-XMF8-CVQR-RFGJ vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse, langfuse-fips...

GHSA-7RQJ-J65F-68WH vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse, langfuse-fips...

GHSA-XMF8-CVQR-RFGJ vulnerabilities

Vulnerabilities for packages: langfuse, jitsucom-jitsu...

GHSA-7RQJ-J65F-68WH vulnerabilities

Vulnerabilities for packages: langfuse, jitsucom-jitsu...

GHSA-X445-F3H2-J279 vulnerabilities

Vulnerabilities for packages: langfuse, jitsucom-jitsu...

GHSA-R28C-9Q8G-F849 vulnerabilities

Vulnerabilities for packages: nextcloud-server, langfuse, vitess, jitsucom-jitsu...

CVE-2026-68499

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in lib/match.cc, causing an infinite loop and unbounded nati...

CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

openjdk: Enhance AWT ImagingLib (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries correctly. This can lead to the application attempting to access invalid memory or dereference a null pointer, which may cause the application to unexpectedly terminate...

CVE-2026-59881

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory...

SUSE CVE-2026-17823

Insufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17827

Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17829

Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...