Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python-jinja2: python3-jinja2+i18n-3.1.6-10.1.hum1 noarch python3-jinja2-3.1.6-10.1.hum1 noarch python-jinja2-3.1.6-10.1.hum1.src src...

EUVD-2026-46133

Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation...

GO-2026-6036 Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) in gitea.dev

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698 in gitea.dev...

DEBIAN-CVE-2026-14899

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...

CVE-2026-14899

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: hugo: hugo-0.164.0-0.1.2.hum1 aarch64, x8664 hugo-0.164.0-0.1.2.hum1.src src Security Fixes: hugo: CVE-2026-56852...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop through the rtpasffixheader function in libavformat/rtpdecasf.c. An attacker can exhaust CPU and prevent normal service by sending a crafted RTP/ASF stream containing ASF objects with a chunksize smaller than the 24-byte...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2 (CVE-2026-11897)

Summary IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2 when servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Vulnerability Details CVEID:CVE-2026-11897 DESCRIPTION: IBM WebSphere Application Server Liberty is...

CVE-2026-14899 Off-by-one out of bounds read in MIME header parser for forwarding

The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...

Security Bulletin: Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-3482)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed Access Control security vulnerability. Vulnerability Details CVEID:CVE-2026-3482 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway could allow an unauthenticated user to read sensitive informatio...

Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libarchive: bsdcat-3.8.8-3.1.hum1 aarch64, x8664 bsdcpio-3.8.8-3.1.hum1 aarch64, x8664 bsdtar-3.8.8-3.1.hum1 aarch64, x8664 bsdunzip-3.8.8-3.1.hum1 aarch64, x8664 libarchive-3.8.8-3.1.hum1 aarch6...

USN-8477-3: tar regression

USN-8477-1 fixed a vulnerability in tar. That fix was incomplete and could cause tar to fail to extract old archives that recorded a nonzero size for directory entries, resulting in a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was...

SUSE-SU-2026:3193-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues - CVE-2026-55628: policy bypass in concatenate operation due to missing checks bsc1270081. - CVE-2026-56362: heap buffer overflow read in GetPixelIndex due to metadata-cache desynchronization in OpenPixelCache bsc1271100. - CVE-2026-56366: ME...

EUVD-2026-47710

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItemGrid::decodegridtile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentofu1.11: opentofu1.11-1.11.13-0.2.hum1 aarch64, x8664 opentofu1.11-1.11.13-0.2.hum1.src src Security Fixes: opentofu1.11: CVE-2026-56852...

Duplicate Advisory: Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-42cj-m3vj-89wv. This link is maintained to preserve external references. Original Description Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for...

SUSE-SU-2026:22904-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 bsc1243603. - CVE-2026-31503: udp: Fix wildcard bind...

i2c: i801: fix hardware state machine corruption in error path

...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Vulnerable to Regular Expression Denial of Service (ReDoS)

Summary spring-core-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41848. Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which is then...

Security update for python-sqlparse

This update for python-sqlparse fixes the following issue Fixed a bug where formatting list of tuples leads to denial of service bsc1268597. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you ca...