Important: kernel-livepatch-6.12.92-122.168

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600...

Important: kernel-livepatch-6.18.25-57.109

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600...

Critical: php8.5

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Attacker-provided inputs to bccomp could lea...

Important: kernel-livepatch-6.12.94-123.176

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600...

Important: kernel-livepatch-6.18.36-69.138

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600...

Important: kernel-livepatch-6.12.83-113.160

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600...

Important: kernel-livepatch-6.12.88-119.160

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600...

Important: kernel-livepatch-6.1.175-219.357

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600...

Important: gimp

Issue Overview: A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscannergettoken function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory...

Important: gstreamer1-plugins-bad-free

Issue Overview: A heap buffer overflow vulnerability was found in GStreamer's librfb RFB/VNC client. The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker...

Amazon Linux 2 : java-17-amazon-corretto, --advisory ALAS2-2026-3842 (ALAS-2026-3842)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.20+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3842 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product...

Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2026-015 (ALASNGINX1-2026-015)

The version of nginx installed on the remote host is prior to 1.30.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NGINX1-2026-015 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string...

Amazon Linux 2023 : python3.13, python3.13-devel, python3.13-freethreading (ALAS2023-2026-1997)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1997 advisory. The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated unterminated markup declarations whenprocessing uncontrolled data. CVE-2026-15308 In the...

Amazon Linux 2023 : perl-DBI, perl-DBI-tests (ALAS2023-2026-2006)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2006 advisory. DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some...

Amazon Linux 2 : java-11-amazon-corretto, --advisory ALAS2-2026-3841 (ALAS-2026-3841)

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.32+9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3841 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product...

Amazon Linux 2 : gstreamer1-plugins-bad-free, --advisory ALAS2-2026-3833 (ALAS-2026-3833)

The version of gstreamer1-plugins-bad-free installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3833 advisory. A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264...

Amazon Linux 2 : java-1.8.0-openjdk, --advisory ALAS2-2026-3848 (ALAS-2026-3848)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.502.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3848 advisory. Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java S...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3829 (ALAS-2026-3829)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3829 advisory. Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents ...

Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-2042)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2042 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...

Amazon Linux 2023 : cifs-utils, cifs-utils-devel, cifs-utils-info (ALAS2023-2026-2030)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2030 advisory. A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low...