CVE-2026-85509 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85509 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-61712 affecting package moby-engine for versions less than 25.0.3-20

CVE-2026-61712 affecting package moby-engine for versions less than 25.0.3-20. A patched version of the package is available...

CVE-2026-85505 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85505 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-85508 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85508 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-70409 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-70409 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

morgan vulnerable to Log Forging via unescaped Unicode line separators

Impact Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutralizes C0 control characters, DEL, and backslash, but it does not escape the Unicode line separators U+0085 NEL, U+2028 LINE SEPARATOR, or U+2029 PARAGRAPH SEPARATOR. These code points...

GHSA-JXFW-X594-9X9M morgan vulnerable to Log Forging via unescaped Unicode line separators

Impact Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutralizes C0 control characters, DEL, and backslash, but it does not escape the Unicode line separators U+0085 NEL, U+2028 LINE SEPARATOR, or U+2029 PARAGRAPH SEPARATOR. These code points...

NPM: Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

NPM: Hono: Incomplete fix for CVE-2026-39408: toSSG still writes files outside the output directory vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...

Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Summary The fix released for CVE-2026-39408 does not cover every traversal sequence. toSSG can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Details Static site generation builds each output path from the route pat...

GHSA-GQVV-2MRQ-WPJV Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Summary The fix released for CVE-2026-39408 does not cover every traversal sequence. toSSG can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Details Static site generation builds each output path from the route pat...

GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

Summary TagReference.create forwards a caller-influenced positional reference value into git tag without it ever being inspected by the unsafe-option guard, allowing an arbitrary file read the file's contents are returned in-band as the annotated tag message. This is an incomplete-fix bypass of...

GHSA-3WXW-XV34-2FRG GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

Summary TagReference.create forwards a caller-influenced positional reference value into git tag without it ever being inspected by the unsafe-option guard, allowing an arbitrary file read the file's contents are returned in-band as the annotated tag message. This is an incomplete-fix bypass of...

CLSA-2026-1788892753 TuxCare security update for 4 packages (1 CVE)

TuxCare rebuilt 4 packages to address 1 CVE. Fixed in 0.26.1-tuxcare.3...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.1: grafana13.1-13.1.3-0.6.hum1 aarch64, x8664 grafana13.1-13.1.3-0.6.hum1.src src Security Fixes: grafana13.1: CVE-2026-84394 CVE-2026-84292...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: sudo: sudo-1.9.17-16.p2.1.hum1 aarch64, x8664 sudo-devel-1.9.17-16.p2.1.hum1 aarch64, x8664 sudo-logsrvd-1.9.17-16.p2.1.hum1 aarch64, x8664 sudo-python-plugin-1.9.17-16.p2.1.hum1 aarch64, x8664...

CLSA-2026-1788887721 TuxCare security update for 10 packages (1 CVE)

TuxCare rebuilt 10 packages to address 1 CVE. Fixed in 3.1.3.RELEASE-tuxcare.2...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.2: grafana13.2-13.2.1-0.2.hum1 aarch64, x8664 grafana13.2-13.2.1-0.2.hum1.src src Security Fixes: grafana13.2: CVE-2026-84394 CVE-2026-84292...

CLSA-2026-1788881357 TuxCare security update for org.thymeleaf:thymeleaf (1 CVE)

TuxCare rebuilt org.thymeleaf:thymeleaf to address 1 CVE. Fixed in 3.1.3.RELEASE-tuxcare.2...

Important: Red Hat Security Advisory: Red Hat Quay 3.9.26

Red Hat Quay 3.9.26 is now available with bug fixes. Quay 3.9.26...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.10: python3.10-3.10.21-1.1.hum1 aarch64, x8664 python3.10-debug-3.10.21-1.1.hum1 aarch64, x8664 python3.10-devel-3.10.21-1.1.hum1 aarch64, x8664 python3.10-idle-3.10.21-1.1.hum1 aarch64,...