freerdp security update

2:3.10.3-12.11 - Fix RPC gateway fragment size and capacity checks CVE-2026-55193 Resolves: RHEL-247346...

PT-2026-90409

In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4 acl to attr return value in nfsd4 create nfsd4 create stores the return value of nfsd4 acl to attr in status, but the switchcreate-cr type block unconditionally overwrites it in every branch. ACL translation...

PT-2026-90427

In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN ON ONCE from nfsd mode check The header for commit e75b23f9e323 "nfsd: check d can lookup in fh verify of directories" details the assumption that justified adding the WARN ON ONCE to nfsd mode check, tha...

PT-2026-90367

In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs name decode in handle session handle session decodes the MDSCapAuth records carried by a CEPH SESSION OPEN message msg version = 6. For each record the match.path and match.fs name byte strings...

PT-2026-90282

In the Linux kernel, the following vulnerability has been resolved: jbd2: check need resched when skipping busy checkpoint buffers journal shrink one cp list skips busy checkpoint buffers when called with JBD2 SHRINK BUSY SKIP. The continue statement on this path also skips the need resched check...

PT-2026-90482

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold exec update lock around namespace ioctl The PIDFD GET NAMESPACE ioctls in pidfd ioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment state...

PT-2026-90410

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOAD CANCEL path clp != NULL, manage cpntf state freed the target cpntf state without checking ownership. The lookup key st-si opaque.so id is allocated...

PT-2026-90365

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in build xattrs build xattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

PT-2026-89901

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UI...

PT-2026-89787

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...

PT-2026-89860

AVideo through 29.0 contains an insecure direct object reference IDOR vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory capability and a CSRF nonce before passing the attacker-supplied $ REQUEST'id' to Category::deleteAssets, which...

PT-2026-89785

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including chart...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107273)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107273 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add a dcstate NULL check in dcstaterelease How Check wheather state is NULL befo...

PT-2026-90123

In the Linux kernel, the following vulnerability has been resolved: net: phylink: correctly validate returned PCS in phylink inband caps In phylink inband caps, the PCS returned by mac select pcs is only checked if NULL but mac select pcs can also return an error pointer. This can cause a kernel...

PT-2026-90387

In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp-mask nfsd3 proc setacl calls set posix acl unconditionally for both ACL TYPE ACCESS and ACL TYPE DEFAULT, passing argp-acl access and argp-acl default verbatim. The NFSv3 ACL decoder only populates...

PT-2026-90266

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth gss: enforce krb5 token minimum length svcauth gss unwrap priv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gss unwrap: if len xdr stream remainingxdr goto unwrap...

PT-2026-90155

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Add a NULL check for sst inst To be consistent with other places, add a NULL check for failed socket loading by checking isst common.sst inst...

PT-2026-89888

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval...

PT-2026-90345

In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Check size of status and firmware events before reading them Malformed status and firmware events could cause an out-of-bounds read since the size wasn't being checked. Check the size and warn on unexpected...

PT-2026-90503

ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBL...