Important: Red Hat Security Advisory: kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, and kpatch-patch-4_18_0-477_97_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

PT-2026-56563

Name of the Vulnerable Software and Affected Versions NATS Server versions prior to 2.12.8 NATS Server versions prior to 2.11.17 Description An unauthenticated peer with network access to a leafnode listener with compression enabled can cause the server to crash. This occurs during the...

PT-2026-56497

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.6.5 protobufjs versions prior to 8.6.6 Description protobufjs compiles protobuf definitions into JavaScript functions. The software parses option names by advancing through schema tokens until an = token is reach...

PT-2026-56605

Name of the Vulnerable Software and Affected Versions RestrictedPython versions prior to 8.3 Description The check function argument names function fails to reject protected guard hook names when they are used as positional-only arguments. This allows local parameters to shadow protected names su...

Oracle Linux 8 : compat-openssl10 (ELSA-2026-36215)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-36215 advisory. 1.1.0-2o-4.3 - Fix CVE-2026-45447: Fix double-free of caller-owned BIO in PKCS7verify Tenable has extracted the preceding description block directly from the...

PT-2026-56516

Name of the Vulnerable Software and Affected Versions Astro version 6.4.7 Description Astro performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit. Subsequently, rewrite route matching performs an additional decodeURI operation, which can...

ALSA-2026:36645 Important: kernel update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: eventpoll: defer struct eventpoll free to RCU grace period CVE-2026-43074 kernel: eventpoll: fix epremove struct eventpoll / struct file UAF CVE-2026-46242 kernel: Linux kernel: netfilter...

SUSE CVE-2026-42327

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocspresponders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref wraps the raw bytes with str::fromutf8unchecked. OpenSSL does not enforce th...

PYSEC-2026-1724 Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability

A vulnerability in open-webui/open-webui versions = 0.3.8 allows remote code execution by non-admin users via Cross-Site Request Forgery CSRF. The application uses cookies with the SameSite attribute set to lax for authentication and lacks CSRF tokens. This allows an attacker to craft a malicious...

PYSEC-2026-1874 try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter

Impact Via a type confusion bug in the CPython interpreter when using try/except RestrictedPython could be bypassed. We believe this should be fixed upstream in Python itself until that we remove support for try/except from RestrictedPython. It has been fixed for some Python versions. Patches...

PYSEC-2026-1767 pgAdmin Remote Code Execution (RCE) vulnerability

pgAdmin = 8.4 is affected by a Remote Code Execution RCE vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the...

PYSEC-2026-1317 Reflected XSS Vulnerability in dpaste

Impact A security vulnerability has been identified in the expires parameter of the dpaste API, allowing for a POST Reflected XSS attack. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of a user's browser, potentially leading to unauthorized...

PYSEC-2026-774 Apache Airflow Google Provider Improper Input Validation vulnerability

Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0...

RHSA-2026:35833 Red Hat Security Advisory: container-tools:rhel8 security update

Bulletin has no description...

grafana-pcp security update

An update is available for grafana-pcp. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Grafana plugin for Performance Co-Pilot includes datasources for...

SUSE CVE-2026-14393

Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...

MiracleLinux 9 : opentelemetry-collector-0.144.0-2.el9_8 (AXSA:2026-1213:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1213:03 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go:...

AlmaLinux 8 : container-tools:rhel8 (ALSA-2026:35833)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:35833 advisory. github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption JWE object CVE-2026-34986...

RockyLinux 8 : grafana (RLSA-2026:35830)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:35830 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...

RockyLinux 10 : rrdtool (RLSA-2026:33731)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:33731 advisory. rrdtool: Stack buffer overflow in rrdcached handlerequestcreate allows local privilege escalation via unbounded DS/RRA arguments CVE-2026-43958 Tenable has...