PT-2026-56531

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.2.6 authentik versions prior to 2026.5.5 Description A diagnostic action on the LDAP Source API fails to enforce the object-level read-authorization filter applied to the rest of the API. This allows any party...

gstreamer1-plugins-ugly-free security update

1.22.12-6.1 - Fix CVE-2026-53704: multiple rmdemux security issues - Resolves: RHEL-184464...

OPENSUSE-SU-2026:11223-1 rustup-1.28.2~0-5.1 on GA media

These are all security issues fixed in the rustup-1.28.20-5.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-56845

Name of the Vulnerable Software and Affected Versions libmbedtls2 affected versions not specified libeverest affected versions not specified Description Security issues were identified and subsequently fixed in the libmbedtls23-4.2.0-1.1 and libeverest-3.6.7-1.1 packages on the GA media of openSU...

PT-2026-56532

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.2.6 authentik versions prior to 2026.5.5 Description An inbound SAML Source configured with non-default USERNAME LINK or EMAIL LINK user-matching modes interprets XML comments within a NameID differently than t...

PT-2026-56859

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.10 OpenEXR versions prior to 3.3.12 OpenEXR versions prior to 3.4.13 Description An infinite-loop issue exists in SampleCountChannel due to the roundListSizeUp function. This function rounds a sample-list size to...

PT-2026-56530

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.2.6 authentik versions prior to 2026.5.5 Description In enterprise deployments using a Google Chrome Endpoint stage with mode set to REQUIRED or the deprecated Google Chrome Device Trust Connector stage, the...

OPENSUSE-SU-2026:11226-1 woodstox-core-7.2.1-1.1 on GA media

These are all security issues fixed in the woodstox-core-7.2.1-1.1 package on the GA media of openSUSE Tumbleweed...

ALSA-2026:36749 Important: gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fixes: gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tilelistobu parser byte/bit...

PT-2026-56838

Name of the Vulnerable Software and Affected Versions libmbedtls23 affected versions not specified libeverest affected versions not specified Description Security issues were identified and subsequently fixed in the libmbedtls23 and libeverest packages within the openSUSE Tumbleweed GA media...

OPENSUSE-SU-2026:11211-1 fluidsynth-2.5.6-1.1 on GA media

These are all security issues fixed in the fluidsynth-2.5.6-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11222-1 keylime-ima-policy-0.2.9+49-1.1 on GA media

These are all security issues fixed in the keylime-ima-policy-0.2.9+49-1.1 package on the GA media of openSUSE Tumbleweed...

GO-2026-5932 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintaine...

[slackware-security] tftp-hpa

New tftp-hpa packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/tftp-hpa-5.4-i586-1slack15.0.txz: Upgraded. This update fixes bugs and security issues: Fix several security-relevant bugs in path...

SUSE-SU-2026:22576-1 Security update for qemu

This update for qemu fixes the following issues: Update to version 10.0.11. Security issues fixed: - CVE-2026-3886: integer overflow leading to privilege escalation due to lack of proper validation of user-supplied data in the virtio-gpu driver bsc1268061. - CVE-2026-48914: heap buffer overflow d...

OPENSUSE-SU-2026:21252-1 Security update for clamav

This update for clamav fixes the following issues: Update to version 1.5.3. Security issues fixed: - CVE-2026-20213: out-of-bounds write due to improper boundary checks for content in PE files during scanning bsc1270107. - CVE-2026-20214: out-of-bounds write due to improper boundary checks for...

OPENSUSE-SU-2026:21254-1 Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues: Update to go1.26.4 bsc1255111. Security issues fixed: - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG bsc1261653. - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination bsc1261654. -...

PYSEC-2026-1248 CKAN may leak Solr credentials via error message in package_search action

If there were connection issues with the Solr server, the internal Solr URL potentially including credentials could be leaked to packagesearch calls as part of the returned error message Patches This has been patched in CKAN 2.10.5 and 2.11.0...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...

RLSA-2026:35892 Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...