Important: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion CVE-2026-102556 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly CVE-2026-102557 libsoup: libsoup:...

Important: python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Moderate: perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 F...

Important: xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fixes: xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling...

Important: bubblewrap security update

Bubblewrap /usr/bin/bwrap is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fixes: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup CVE-2026-87766 For more details about the...

RHEL 8 : perl-URI (RHSA-2026:84590)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:84590 advisory. This module implements the URI class. Objects of this class represent Uniform Resource Identifier references as specified in RFC 2396 and updated by...

ALSA-2026:85193 Important: xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests...

AlmaLinux 9 : environment-modules (ALSA-2026:84594)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:84594 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable ha...

PT-2026-117342

Cross-Site Request Forgery CSRF vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and...

PT-2026-117360

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which acce...

Roundcube -- Multiple vulnerabilities

The Roundcube Mail project reports: IMAP command injection via CRLF in uid parameter of mail/headers and mail/viewsource action bug where an alias login wasn’t qualified by IMAP host Add a size limit to the CSS proxy content processing SSRF filter islocalurl bypass via NAT64 64:ff9b::/96 remote...

Ubuntu 26.04 LTS : curl vulnerabilities (USN-8927-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8927-1 advisory. It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : curl vulnerabilities (USN-8932-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8932-1 advisory. Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when...

Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

Oracle Linux 9 : environment-modules (ELSA-2026-84594)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-84594 advisory. 5.3.0-2.1 - fix command injection in bash Tab completion CVE-2026-85013 Tenable has extracted the preceding description block directly from the Oracle Linux...

CVE-2026-98815

In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in 0 - the code there is heavily based on the NVMe code. Currently the NS head .open and .release fileoperations methods take and put a...

RHEL 10 : xorg-x11-server-Xwayland (RHSA-2026:85191)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85191 advisory. Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server: xorg-x11-server: Arbitrary code execution vi...

RHEL 9 : python3.14-urllib3 (RHSA-2026:84577)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:84577 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

RHEL 10 : python3.14-urllib3 (RHSA-2026:84578)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:84578 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : urllib3 vulnerabilities (USN-8926-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8926-1 advisory. Yu-Fu Fu, Seth Larson and Yonatan Magier discovered that urllib3 did not correctly handle certain...