firefox security update

140.15.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 - diable wasisdk to prevent build failure with newer llvm 140.15.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 140.15.0-1 - Update to 140.15.0 ESR...

CVE-2026-91840

username newline injection reaches a root password helper...

ROS-20260917-73-0025

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260917-73-0030

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260917-73-0031

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

Unbreakable Enterprise kernel security update

5.15.0-324.217.5.3 - net: tun: bound receive headroom Asim Viladi Oglu Manizada Orabug: 40035523 CVE-2026-81000 - xfrm: ah6: validate routing header segmentsleft Asim Viladi Oglu Manizada Orabug: 40035522 CVE-2026-80844 - tcp: clear sockops cb flags before force-closing a child socket Sechang Lim...

Security update for MozillaFirefox (important)

openSUSE security update: security update for mozillafirefox ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21853-1 Rating: important References: bsc1278001 Cross-References: CVE-2026-74952 CVE-2026-75874 CVE-2026-84118 CVE-2026-84119 CVE-2026-8412...

sngrep-1.8.4-2.1 on GA media (moderate)

sngrep-1.8.4-2.1 on GA media Announcement ID: openSUSE-SU-2026:11791-1 Rating: moderate Cross-References: CVE-2026-90558 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the sngrep-1.8.4-2.1...

jq-1.8.2-2.1 on GA media (moderate)

jq-1.8.2-2.1 on GA media Announcement ID: openSUSE-SU-2026:11789-1 Rating: moderate Cross-References: CVE-2025-9403 CVSS scores: CVE-2025-9403 SUSE : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2025-9403 SUSE : 1.9...

Angie -- worker process memory corruption when using HTTP/3

The Angie Software Team reports: When using an OpenSSL version without native HTTP/3 support 3.5.0 or earlier, if the default server for the address that accepted a regular HTTPS request also used HTTP/3 the listen directive with the quic parameter, possibly on a different port, while a server...

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipvlan: Make the addrslock be per port CVE-2026-23103 kernel: xfrm: hold dev ref until after transportfinish NFHOOK CVE-2026-31663 kernel: netfilter: nfconntrackh323: fix OOB read in...

Security update for mbedtls-2 (important)

openSUSE security update: security update for mbedtls-2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21864-1 Rating: important References: bsc1245810 bsc1252454 Cross-References: CVE-2025-52496 CVE-2025-59438 CVSS scores: CVE-2025-59438 SUSE : 5....

kernel security, bug fix, and enhancement update

6.12.0-211.56.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

CVE-2026-89088

heap buffer overflow in duplicatelegacyrootdir...

ROS-20260917-73-0016

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-62846

SQUID-2026:9...

tomcat security, bug fix, and enhancement update

1:9.0.120-1 - Resolves: RHEL-192825 HTTP/2 request headers not validated CVE-2026-41293 - Resolves: RHEL-192659 Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 - Resolves: RHEL-219565 Security constraint bypass via improper URL encoding in rewrite valve CVE-2026-59083...

libevent security update

2.1.8-11 - Fix CVE-2026-63385: HTTP header injection via CRLF in header values - Resolves: RHEL-253566 2.1.8-10 - Fix CVE-2026-63387: out-of-bounds write in evdns dnsnametolabels - Resolves: RHEL-249889 2.1.8-9 - Fix CVE-2026-63383: out-of-bounds read in decodetaginternal - Resolves: RHEL-250240...

CVE-2026-82373

Unknown description...

Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: ipvlan: Make the addrslock be per port CVE-2026-23103 kernel: xfrm: hold dev ref until after transportfinish NFHOOK CVE-2026-31663...