RHBA-2026:21387 Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update

Bulletin has no description...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tomcat11: tomcat11-11.0.25-0.1.hum1 noarch tomcat11-admin-webapps-11.0.25-0.1.hum1 noarch tomcat11-common-11.0.25-0.1.hum1 noarch tomcat11-docs-webapp-11.0.25-0.1.hum1 noarch...

ROOT-APP-NPM-GHSA-H25M-26QC-WCJF GHSA-h25m-26qc-wcjf in next - Patched by Root

Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available...

.NET 10.0 security, bug fix, and enhancement update

10.0.111-1.0.1 - Add support for Oracle Linux 10.0.111-1 - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235482...

.NET 9.0 security, bug fix, and enhancement update

9.0.120-1.0.1 - Add support for Oracle Linux 9.0.120-1 - Update to .NET SDK 9.0.120 and Runtime 9.0.19 - Resolves: RHEL-235476...

PT-2026-76988

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description Privilege escalation exists in the Request Handling component. Recommendations Update Firefox t...

.NET 10.0 security, bug fix, and enhancement update

10.0.111-1.0.1 - Add support for Oracle Linux 10.0.111-1 - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235481...

pcp security update

5.3.7-22.0.12.el810.5 - Implemented units header in csv output using pmrepOrabug: 39064482 - Adds interval option support in PCP nfsiostat tool Orabug: 38902336 - Introduces proc.numamaps metrics in linuxproc PMDA Orabug: 38509848 - adds numastat process option in the tool - Added support for siz...

Security Vulnerabilities fixed in Firefox ESR 115.39 — Mozilla

Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited...

Linux Distros Unpatched Vulnerability : CVE-2026-72429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentrynulldst to mark that the destination should not be changed after the transformation. This d...

mysql8.4 security, bug fix, and enhancement update

8.4.11-1 - Rebase to 8.4.11...

Linux Distros Unpatched Vulnerability : CVE-2026-15803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query...

sg3_utils security, bug fix, and enhancement update

1.44-6.1 - sginq output conformance for SCSI name string and ATA fields RHEL-188162...

PT-2026-77245

MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/shared func.py logs that an archive member exceeding ZIP MAX UNCOMPRESSED FILE SIZE is being skipped but does not continue to the next member, so an authenticated user...

CVE-2026-64782

The vulnerability resides in the WebKit component of Apple platforms. A memory corruption issue was addressed with improved locking. Processing maliciously crafted web content may cause an unexpected Safari crash. Fixed in iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26...

CVE-2026-67967

Buffer Overflow vulnerability in Tenda W20E V16.01.0.62782 allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819...

CVE-2026-73560

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformersutils/processors/mimov2omni.py passes attacker-controlled image and audio strings through fetchimage, requests.get, and Image.open instead of MediaConnector,...

CVE-2026-63669

In ApostropheCMS before 4.32.0, the page module's move() skips the destination parent's _create permission check due to an archive-condition bug, allowing an authenticated editor or contributor to move a page into a restricted subtree and re-rank protected sibling pages via nudgeNewPeers() update...

CVE-2026-68519

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen with shell operators enabled, allowing configured redirection, command chaining, or pipes to...

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Summary In Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen from interpreting the shell operators &&, | and in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its...