kernel security update

5.14.0-611.34.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

CVE-2026-23189

In the Linux kernel, the following vulnerability has been resolved: ceph: fix NULL pointer dereference in cephmdsauthmatch The CephFS kernel client has regression starting from 6.18-rc1. We have issue in cephmdsauthmatch if fsname == NULL: const char fsname = mdsc-fsc-mountoptions-mdsnamespace;...

CVE-2026-23189 ceph: fix NULL pointer dereference in ceph_mds_auth_match()

In the Linux kernel, the following vulnerability has been resolved: ceph: fix NULL pointer dereference in cephmdsauthmatch The CephFS kernel client has regression starting from 6.18-rc1. We have issue in cephmdsauthmatch if fsname == NULL: const char fsname = mdsc-fsc-mountoptions-mdsnamespace;...

CVE-2026-23189

In the Linux kernel, the following vulnerability has been resolved: ceph: fix NULL pointer dereference in cephmdsauthmatch The CephFS kernel client has regression starting from 6.18-rc1. We have issue in cephmdsauthmatch if fsname == NULL: const char fsname = mdsc-fsc-mountoptions-mdsnamespace;...

CVE-2026-23189

In the Linux kernel, the following vulnerability has been resolved: ceph: fix NULL pointer dereference in cephmdsauthmatch The CephFS kernel client has regression starting from 6.18-rc1. We have issue in cephmdsauthmatch if fsname == NULL: const char fsname = mdsc-fsc-mountoptions-mdsnamespace;...

AZL-77751 CVE-2026-23125 affecting package kernel for versions less than 6.6.126.1-1

In the Linux kernel, the following vulnerability has been resolved: sctp: move SCTPCMDASSOCSHKEY right after SCTPCMDPEERINIT A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails: ================================================================== KASAN:...

CVE-2026-23125

In the Linux kernel, the following vulnerability has been resolved: sctp: move SCTPCMDASSOCSHKEY right after SCTPCMDPEERINIT A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails: ================================================================== KASAN:...

CVE-2026-23125 sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT

In the Linux kernel, the following vulnerability has been resolved: sctp: move SCTPCMDASSOCSHKEY right after SCTPCMDPEERINIT A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails: ================================================================== KASAN:...

CVE-2026-23125

CVE-2026-23125 (Linux kernel SCTP) : A null-pointer dereference in the SCTP transmit path could occur when SCTP-AUTH key initialization fails during INIT_ACK processing. The issue arises because SCTP_CMD_ASSOC_SHKEY is executed after PEER_INIT and can leave asoc->shkey NULL if key setup fails,...

OESA-2026-1408 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A flaw was found in libsoup’s WebSocket frame processing when handling incoming...

OESA-2026-1410 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a...

Authorization Bypass in SearchModelVersions Allows Any Authenticated User to Enumerate All Model Versions Regardless of Permissions

Summary MLflow's SearchModelVersions REST API endpoint GET /api/2.0/mlflow/model-versions/search and GraphQL query mlflowSearchModelVersions lack per-model authorization checks when basic auth is enabled. Any authenticated user can enumerate ALL model versions across ALL registered models,...

PT-2026-25757

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.10 Description Mattermost does not properly validate a user's authentication method when processing an account authentication type switch. This allows an authenticated attacker to change an account...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues The following security issues were fixed: CVE-2025-40257: mptcp: fix a race in mptcppmdeladdtimer bsc1254842. CVE-2025-40259: scsi: sg: Do not sleep in atomic context bsc1254845. CVE-2025-68284: libceph: prevent...

SUSE-SU-2026:0471-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-40257: mptcp: fix a race in mptcppmdeladdtimer bsc1254842. - CVE-2025-40259: scsi: sg: Do not sleep in atomic context bsc1254845. - CVE-2025-68284: libceph:...

Malicious code in requests-auth-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 03bb4c04410c4e3c58d7292eb47f8f76a2fbe5265abea29826ac910e890350d0 During installation, package installs a script that listens for remote commands and executes them. The script is also added to autostart configuration and...

atlassian-jwt-auth (>=2.8.1, <=2.10.0), fallixy (0.18.1) +3 more potentially affected by CVE-2026-26007 via cryptography (1.5.3)

cryptography PYPI version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.8.1, =0.18.1, =0.9.0, =1.1.0 - teamvault 0.6.0 Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...

atlassian-jwt-auth (>=2.5.1, <=2.8.0), data-pipeline (>=0.9.5, <=0.9.12) potentially affected by CVE-2026-26007 via cryptography (1.3.4)

cryptography PYPI version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.5.1, =0.9.5, =0.9.12 Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...

atlassian-jwt-auth (1.0.9) potentially affected by CVE-2026-26007 via cryptography (0.9.1)

cryptography PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 1.0.9 Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...

atlassian-jwt-auth (2.5.0), netlib (0.16.0) +1 more potentially affected by CVE-2026-26007 via cryptography (1.2.3)

cryptography PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.5.0 - netlib 0.16.0 - signxml =0.5.0, =1.0.0 Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...