mod_auth_openidc security update

2.4.16.11-1.1 - Resolves: RHEL-248048 - CVE-2026-54789 out-of-bounds read/write in oidcstatecookiescleanexpired when a state-prefixed cookie token contains no '=' separator...

tftp security update

5.2-40.1 - fix buffer overflow in remap genmatchstring with inverse rules CVE-2026-85234 RHEL-260629...

flatpak security update

1.12.9-7 - Use gsize for OCI delta sizes and harden delta parser CVE-2026-96280 Resolves: RHEL-271507 1.12.9-6 - Avoid symlink path traversal in revokefs writer CVE-2026-96808 Resolves: RHEL-267897 - Prevent arbitrary write as root via extra-data extraction CVE-2026-96275 Resolves: RHEL-267425...

emacs security update

1:27.2-18.el98.2 - Fix integer overflow in pbmload image validation RHEL-248067 1:27.2-18.el98.1 - Restrict Tramp user name to fix CVE-2026-79992 RHEL-248552...

libxml2 security update

2.9.7-21.10 - Fix CVE-2026-86144 RHEL-269184...

python313-asyncpg-0.31.0-1.4 on GA media (moderate)

python313-asyncpg-0.31.0-1.4 on GA media Announcement ID: openSUSE-SU-2026:11998-1 Rating: moderate Cross-References: CVE-2020-17446 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

compat-openssl11 security update

1:1.1.1k-5.6 - Fixes CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset Resolves: RHEL-265517 1:1.1.1k-5.5 - Fixes CVE-2026-63072: Heap buffer overflow in CMS key unwrapping Resolves: RHEL-246280...

jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

jackson-core 2.21.6-1 - Rebase to version 2.21.6 - Resolves: RHEL-259227 jackson-databind 2.21.6-1 - Rebase to version 2.21.6 - Resolves: RHEL-259227 jackson-jaxrs-providers 2.21.6-1 - Rebase to version 2.21.6 - Resolves: RHEL-259227 jackson-modules-base 2.21.6-1 - Rebase to version 2.21.6 -...

nginx-module-cache-purge -- symlink traversal when walking cache trees

The ngxcachepurge developers report: Fixed a symlink traversal vulnerability during cache tree traversal. An attacker with the ability to create symbolic links inside the cache directory could potentially cause cache purge operations to delete arbitrary files accessible to the NGINX worker proces...

proxychains

README de ProxyChains ver. 4.3.0 ProxyChains es un programa UNIX que engancha las funciones de libc relacionadas con la red en programas enlazados dinámicamente mediante una DLL precargada y redirige las conexiones a través de proxies SOCKS4a/5 o HTTP. ADVERTENCIA: este programa solo funciona con...

[SECURITY] [DSA 6551-1] tor security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6551-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 10, 2026 https://www.debian.org/security/faq -...

CVE-2026-108546

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

CVE-2026-108553

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

CVE-2013-10076

ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call avextend av, len-1 . On an empty list, this undeflows, and avextend will allocate an array with 2^32 slots, leading to memory exhaustion...

CVE-2026-107794

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call avextend av, len-1 . On an empty list, this undeflows, and avextend will allocate an array with 2^32 slots, leading to memory exhaustion. Note that a similar issue was...

CVE-2026-107373

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl TSTDSTRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string SvPVnolen$arg, SvCUR$arg However, evaluation order for C++ arguments is not specified, and some compilers may produce code...

CVE-2026-107794

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call avextend av, len-1 . On an empty list, this undeflows, and avextend will allocate an array with 2^32 slots, leading to memory exhaustion. Note that a similar issue was...

CVE-2013-10076

ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call avextend av, len-1 . On an empty list, this undeflows, and avextend will allocate an array with 2^32 slots, leading to memory exhaustion...

CVE-2026-107373

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl TSTDSTRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string SvPVnolen$arg, SvCUR$arg However, evaluation order for C++ arguments is not specified, and some compilers may produce code...

cjose security update

An update is available for cjose. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list CJose is C library implementing the Javascript Object Signing and Encryption...