CVE-2026-59946 Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and...

org.jenkins-ci.main:jenkins-test-harness (1.555), org.jenkins-ci.main:jenkins-war (1.555) +4 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.555)

org.jenkins-ci.main:jenkins-core MAVEN version 1.555 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.555 - org.jenkins-ci.main:jenkins-war 1.555 -...

org.jenkins-ci.main:jenkins-test-harness (1.555), org.jenkins-ci.main:jenkins-war (1.555) +4 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (1.555)

org.jenkins-ci.main:jenkins-core MAVEN version 1.555 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.555 - org.jenkins-ci.main:jenkins-war 1.555 -...

org.jenkins-ci.main:jenkins-test-harness (1.555), org.jenkins-ci.main:jenkins-war (1.555) +4 more potentially affected by CVE-2026-53435 via org.jenkins-ci.main:jenkins-core (1.555)

org.jenkins-ci.main:jenkins-core MAVEN version 1.555 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.555 - org.jenkins-ci.main:jenkins-war 1.555 -...

osbuild-composer security update

149-5.0.1 - Add missing dependency over dracut-config-rescue for image-installer ORABUG: 38587453 - Switch to UEKR8 repositories for OL9.6 Orabug: 37962207 - Add support to create OpenScap images JIRA: OLDIS-35301 - Simplify repository names JIRA: OLDIS-35893 - Refactor patches to fix some naming...

org.jenkins-ci.main:jenkins-test-harness (1.555), org.jenkins-ci.main:jenkins-war (1.555) +4 more potentially affected by CVE-2026-33001 via org.jenkins-ci.main:jenkins-core (1.555)

org.jenkins-ci.main:jenkins-core MAVEN version 1.555 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.555 - org.jenkins-ci.main:jenkins-war 1.555 -...

org.jenkins-ci.main:jenkins-test-harness (1.555), org.jenkins-ci.main:jenkins-war (1.555) +4 more potentially affected by CVE-2025-67636 via org.jenkins-ci.main:jenkins-core (1.555)

org.jenkins-ci.main:jenkins-core MAVEN version 1.555 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.555 - org.jenkins-ci.main:jenkins-war 1.555 -...

org.jenkins-ci.main:jenkins-test-harness (1.555), org.jenkins-ci.main:jenkins-war (1.555) +4 more potentially affected by CVE-2025-59475 via org.jenkins-ci.main:jenkins-core (1.555)

org.jenkins-ci.main:jenkins-core MAVEN version 1.555 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.555 - org.jenkins-ci.main:jenkins-war 1.555 -...

org.jenkins-ci.main:jenkins-test-harness (1.555), org.jenkins-ci.main:jenkins-war (1.555) +4 more potentially affected by CVE-2025-59476 via org.jenkins-ci.main:jenkins-core (1.555)

org.jenkins-ci.main:jenkins-core MAVEN version 1.555 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.555 - org.jenkins-ci.main:jenkins-war 1.555 -...

RHSA-2025:9640 Red Hat Security Advisory: osbuild-composer security update

Bulletin has no description...

ALSA-2025:9623 Moderate: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: net/http:...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...

ALSA-2025:7967 Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

ALSA-2025:7425 Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...

osbuild-composer security update

118.2-1.0.1 - jwt-go allows excessive memory allocation during header parsing CVE-2025-30204...

ALSA-2025:4669 Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...