Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rust: cargo-1.95.0-2.hum1 aarch64, x8664 clippy-1.95.0-2.hum1 aarch64, x8664 rust-1.95.0-2.hum1 aarch64, x8664 rust-analyzer-1.95.0-2.hum1 aarch64, x8664 rust-debugger-common-1.95.0-2.hum1 noarch...

GHSA-XGP8-3HG3-C2MH vulnerabilities

Vulnerabilities for packages: lychee, berg, sqlx, ztunnel, zellij, zola, deno, sccache, tealdeer, wasmcloud, xh, buck2, rye, cargo-audit, wasmtime, wasm-pack, uv, sdp-k8s-injector, qdrant, pixi, parseable, linkerd-extension-init, linkerd2-proxy, shadowsocks-rust, linkerd2, ntpd-rs, samply, atuin,...

GHSA-965H-392X-2MH5 vulnerabilities

Vulnerabilities for packages: lychee, berg, sqlx, ztunnel, zellij, zola, deno, sccache, tealdeer, wasmcloud, xh, buck2, rye, cargo-audit, wasmtime, wasm-pack, uv, sdp-k8s-injector, qdrant, pixi, parseable, linkerd-extension-init, linkerd2-proxy, shadowsocks-rust, linkerd2, ntpd-rs, samply, atuin,...

GHSA-965H-392X-2MH5 vulnerabilities

Vulnerabilities for packages: zola, sentry-cli, sqlx, wasmcloud, garage, asciinema, berg, linkerd-extension-init, uv, sccache, deno, cargo-audit, ntpd-rs, samply, linkerd2-proxy, atuin, shadowsocks-rust, xh, parseable, kdash, buck2, ztunnel-fips, linkerd2-cni-plugin, fnm, pixi, rustup, ztunnel,...

GHSA-XGP8-3HG3-C2MH vulnerabilities

Vulnerabilities for packages: zola, sentry-cli, sqlx, wasmcloud, garage, asciinema, berg, linkerd-extension-init, uv, sccache, deno, cargo-audit, ntpd-rs, samply, linkerd2-proxy, atuin, shadowsocks-rust, xh, parseable, kdash, buck2, ztunnel-fips, linkerd2-cni-plugin, fnm, pixi, rustup, ztunnel,...

GHSA-CQ8V-F236-94QC vulnerabilities

Vulnerabilities for packages: rav1e, wadm, lychee, berg, sqlx, zellij, zola, mountpoint-s3, just, biome, deno, sccache, zed, fish, wasmcloud, xh, yara-x, buck2, cargo-audit, rye, wasmtime, cargo-c, uv, sdp-k8s-injector, qdrant, pgcat, parseable, pixi, mdbook, linkerd2-proxy, efs-utils,...

GHSA-CQ8V-F236-94QC vulnerabilities

Vulnerabilities for packages: wadm, uutils, ruff, zola, sentry-cli, sqlx, wasmcloud, yara-x, garage, asciinema, berg, vector, uv, sccache, deno, just, cargo-audit, ntpd-rs, chaos-tproxy, hurl, atuin, linkerd2-proxy, samply, shadowsocks-rust, cargo-c, parseable, xh, mountpoint-s3, wizer, yazi,...

charms-client (>=0.4.1, <=0.9.2), charms-lib (>=0.9.0, <=0.9.2) +82 more potentially affected by unknown CVE via p3-symmetric (>=0.1.0, <=0.4.3-succinct)

p3-symmetric CARGO version =0.1.0, =0.4.1, =0.9.0, =0.3.0-dev, =0.2.3-sp1-4.0.0, =0.20.0, =0.11.0, =5.2.2, =5.2.5, =5.2.2, =0.1.0, =0.4.0, =0.1.0, =0.4.0, =0.1.0, =0.1.0, =0.4.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-3G92-F9CH-QJCM...

a11ywatch_cli (>=0.0.26, <=0.7.16), aap (>=0.4.0, <=0.4.1) +3743 more potentially affected by unknown CVE via rustls-webpki (>=0.101.7, <=0.102.8)

rustls-webpki CARGO version =0.101.7, =0.0.26, =0.4.0, =0.1.0, =0.21.0-alpha.1, =0.1.11, =0.12.1, =0.2.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-XGP8-3HG3-C2MH...

a11ywatch_cli (>=0.0.26, <=0.7.16), aap (>=0.4.0, <=0.4.1) +3744 more potentially affected by unknown CVE via rustls-webpki (>=0.100.3, <=0.102.8)

rustls-webpki CARGO version =0.100.3, =0.0.26, =0.4.0, =0.1.0, =0.21.0-alpha.1, =0.1.11, =0.12.1, =0.2.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0099...

a11ywatch_cli (>=0.0.26, <=0.7.16), aap (>=0.4.0, <=0.4.1) +3744 more potentially affected by unknown CVE via rustls-webpki (>=0.100.3, <=0.102.8)

rustls-webpki CARGO version =0.100.3, =0.0.26, =0.4.0, =0.1.0, =0.21.0-alpha.1, =0.1.11, =0.12.1, =0.2.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0098...

Incomplete List of Disallowed Inputs

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the handling of environment variables in the exec env denylist. An attacker can execute arbitrary commands by injecting malicious values into...

EUVD-2026-19927

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7...

EUVD-2026-19931

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7...

EUVD-2026-19929

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7...

EUVD-2026-19891

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper handling of user-supplied input in the list fields on page values and the Special:CargoTables interface. An attacker can execute arbitrary JavaScript in the context of other users by injecting...

CVE-2026-39841

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7...

CVE-2026-39840

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7...

CVE-2026-39839

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7...