mod_auth_openidc:2.3 security and bug fix update

An update is available for module.modauthopenidc, cjose, module.cjose, modauthopenidc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an...

Updated znc package fixes security vulnerabilities

Updated the old bundled vulnerable version of jQuery to 3.5.1. CVE-2020-11022 Use-after-free when unloading modules, triggered by unprivileged users. CVE-2026-82373 Null pointer dereference in crypt module, triggered by IRC server. CVE-2026-82374...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreswan (UTSA-2026-150485)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150485 advisory. Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state...

Qnap QTS / QuTS hero NULL Pointer Dereference (CVE-2025-47213)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreswan (UTSA-2026-150491)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150491 advisory. Libreswan has a null pointer dereference bug in the PKCS7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type...

CVE-2026-120758

HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HLunprotect in src/H5HL.c. H5HLprotect pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HLunprotect unpins it on the final unprotect. When the metadata cache...

SUSE CVE-2026-121401

FreeRDP before 3.32.2 contains a denial of service vulnerability where rdgprocesspacket dispatches a PKTTYPEEXTENDEDAUTHMSG without verifying negotiated mode or auth context. A malicious or compromised RD Gateway can send the extended-auth packet before tunnel authentication, triggering a...

SUSE CVE-2026-121402

FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdiresizeex leaves the primary display null without ending the session, so a later bitmap upda...

CVE-2026-121402

FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdiresizeex leaves the primary display null without ending the session, so a later bitmap upda...

CVE-2026-117610

A flaw was found in expat. A remote attacker who controls input stream chunking can trigger a NULL pointer dereference by forcing an empty initial parse on an external entity subparser. Successful exploitation causes the application to crash, resulting in a Denial of Service DoS. Mitigation Avoid...

CVE-2026-99225

A flaw was found in the Linux kernel. A local attacker could exploit this vulnerability to cause a Denial of Service DoS by crashing the system. This flaw occurs due to a race condition in the key management subsystem during process keyring searches, where revoking an authorization key concurrent...

CVE-2026-99220

A flaw was found in the Linux kernel. A local, unprivileged attacker could exploit this vulnerability to cause a Denial of Service DoS by crashing the system. The issue occurs within the asymmetric key management subsystem when applying restrictions using a key that lacks identifiers, such as a...

CVE-2026-121401

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop RD Gateway can cause a Denial of Service DoS by sending an unexpected extended-authentication packet prior to tunnel authentication. Due to missing verification of the negotiated authentication context, processing this packet...

CVE-2026-57486

A flaw was found in pupnp. A remote attacker could cause a Denial of Service DoS by sending specially crafted XML data to an affected application. Due to improper validation of null values during XML node comparisons, processing this input triggers a NULL pointer dereference that crashes the...

CVE-2026-99247

In the Linux kernel, the following vulnerability has been resolved: tracing: Do not initialize tracefs work if tracing is disabled If trace buffer allocation fails during early boot e.g. in earlytraceinit - allocatetracebuffers, tracingdisabled is left set to 1 and the global trace array events...

CVE-2026-99257

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of shared GPIOs We use platform lookup tables for shared GPIOs. This mechanism needs a struct device to work so fwnode-based lookup with no device associated currently causes a...

Linux Distros Unpatched Vulnerability : CVE-2026-121402

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPG...

Linux Distros Unpatched Vulnerability : CVE-2026-120758

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HLunprotect in src/H5HL.c. H5HLprotect pins a single metadata cache entry for a local...

Linux Distros Unpatched Vulnerability : CVE-2026-121401

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a denial of service vulnerability where rdgprocesspacket dispatches a PKTTYPEEXTENDEDAUTHMSG without verifying negotiated mode or...

qt: qt: Denial of Service via NULL pointer dereference during QCborValue to JSON conversion

A flaw was found in Qt. This vulnerability allows an attacker to trigger a Denial of Service DoS by providing specially crafted Concise Binary Object Representation CBOR data. When the application converts this input into JavaScript Object Notation JSON format using QCborValue, a NULL pointer...