RHBA-2025:6294 Red Hat Bug Fix Advisory: python3.12 bug fix and enhancement update

Bulletin has no description...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: vim: vim-X11-9.2.967-1.hum1 aarch64, x8664 vim-common-9.2.967-1.hum1 aarch64, x8664 vim-data-9.2.967-1.hum1 noarch vim-default-editor-9.2.967-1.hum1 noarch vim-enhanced-9.2.967-1.hum1 aarch64,...

OPENSUSE-SU-2026:11545-1 ffmpeg-9-libavcodec-devel-9.0.1-2.1 on GA media

These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-2.1 package on the GA media of openSUSE Tumbleweed...

php8.4 security, bug fix, and enhancement update

8.4.24-2 - rebase to 8.4.24...

PT-2026-78692

Name of the Vulnerable Software and Affected Versions Termix versions prior to 2.3.2 Description An authenticated low-privileged user can cause the platform to authenticate to an attacker-controlled SSH server, leading to the disclosure of another user's stored SSH password or private-key materia...

OPENSUSE-SU-2026:11549-1 markdown-oxide-0.25.12-1.1 on GA media

These are all security issues fixed in the markdown-oxide-0.25.12-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11555-1 postgresql17-17.11-1.1 on GA media

These are all security issues fixed in the postgresql17-17.11-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11550-1 perl-Net-CIDR-Set-0.230.0-1.1 on GA media

These are all security issues fixed in the perl-Net-CIDR-Set-0.230.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-80790

Name of the Vulnerable Software and Affected Versions Drupal Gammu SMS Daemon versions . Description A security issue exists in the Drupal Gammu SMS Daemon project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. Recommendations At the...

PT-2026-80792

Name of the Vulnerable Software and Affected Versions Drupal Link content parser affected versions not specified Description A security issue exists within the Drupal Link content parser. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

Fedora 43 : perl-Imager (2026-4fb0f012fb)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4fb0f012fb advisory. Upstream changes 1.034: - Security fix: EXIF: fix decoding of ASCII fields with zero size CVE-2026-19082, GHSA-hx46-55wp-hv6m - JPEG: depend on Imager 1.034...

OPENSUSE-SU-2026:11557-1 python313-sqlparse-0.6.0-1.1 on GA media

These are all security issues fixed in the python313-sqlparse-0.6.0-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-V5RC-CPWC-CFPR Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Summary The fix for GHSA-v2wp-frmc-5q3v added validateacmeurl to reject acmeurl values not in ACMEDIRECTORYHOSTALLOWLIST, but the validation is only called at authority creation time POST. The authority update endpoint PUT /api/1/authorities/ accepts and stores arbitrary options -- including a...

Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Summary The fix for GHSA-v2wp-frmc-5q3v added validateacmeurl to reject acmeurl values not in ACMEDIRECTORYHOSTALLOWLIST, but the validation is only called at authority creation time POST. The authority update endpoint PUT /api/1/authorities/ accepts and stores arbitrary options -- including a...

Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 validaterevocationurl in lemur /certificates/verify.py can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations RFC1918, loopback,...

GHSA-QXQ5-QHX6-94QW Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch

Summary GHSA-89gg-p5r5-q6r4 claims the pickle deserialization vulnerability in algofrompickle was fixed in v1.5.2. However, monai/auto3dseg/utils.py has not been modified since 2024-07-12 — 18 months before v1.5.2 was released 2026-01-29. All three pickle.loads calls remain unchanged. The fix was...

CVE-2026-71303 Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Lemur manages TLS certificate creation. Prior to 1.9.3, validateacmeurl enforced ACMEDIRECTORYHOSTALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-7383: Backport to odf-4.18.z GSS PDB is created for rgw even though the gateway instance count is 1...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-7382: Backport to odf-4.19.z GSS PDB is created for rgw even though the gateway instance count is 1...

CVE-2026-61634

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...