katello: missing repository authorization in content_uploads exposes cross-product content existence

A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the editproducts permission to query content information for repositories outside the products they were authorized to...

Important: Red Hat Security Advisory: Satellite 6.17.10 Async Update

A new release is now available for Red Hat Satellite 6.17 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2026-56848

CVE-2026-56848 affects Node.js 22.x/24.x/26.x. The vulnerability arises from a heap-use-after-free caused by re-entrant nghttp2_session_mem_send() during nghttp2_session_mem_recv(). OSV/OpenSUSE entries show fixes: nodejs26-26.5.1-1.1 and corepack24-24.18.1-1.1 in GA media, with additional OSV De...

CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

MINI-CP45-MGMJ-5M2W

Bulletin has no description...

CVE-2026-24079 Missing Authentication for Critical Function in Data Modem

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters...

CVE-2026-24079 Missing Authentication for Critical Function in Data Modem

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters...

EUVD-2026-52732

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters...

EUVD-2026-52702

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious baseurl in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own setting...

CVE-2026-18401

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

DEBIAN-CVE-2026-70367

A Server-Side Request Forgery SSRF bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., “::ffff:127.0.0.1” or unspecified addresses "0.0.0.0", "::"...

Important: Red Hat Security Advisory: python3 security update

An update for python3 is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

MINI-2357-WC68-84GW

Bulletin has no description...

p11-kit security update

An update is available for p11-kit. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The p11-kit packages provide a mechanism to manage PKCS11 modules. The...

CVE-2026-58080

In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy, sessions receive no role IDs and the default access controller skips role-permission check...

RLSA-2026:49667 Moderate: p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS11 modules. The p11-kit-trust subpackage includes a PKCS11 trust module that provides certificate anchors and black lists based on configuration files. Security Fixes: p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing...

RLSA-2026:49214 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: rtnetlink: add missing netlinknscapable check for peer netns CVE-2026-31692 kernel: netfilter: ctnetlink: ensure safe access to master conntrack CVE-2026-43116 kernel: fanotify: fix false...

firefox: thunderbird: Site isolation issue in the Networking component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking component...

thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory...