RLSA-2026:41949 Important: python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

python3.14 security update

An update is available for python3.14. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming languag...

CLSA-2026-1784713205 Fix CVE(s): CVE-2026-47729, CVE-2026-50012

SECURITY UPDATE: out-of-bounds read in FTP gateway listing parser - debian/patches/CVE-2026-47729.patch: guard against a NUL byte before strchr in ftpListParseParts, preventing an out-of-bounds read that could disclose memory from unrelated transactions - CVE-2026-47729 SECURITY UPDATE: heap buff...

CLSA-2026-1784716497 Fix CVE(s): CVE-2026-47729, CVE-2026-50012

SECURITY UPDATE: out-of-bounds read in FTP gateway directory-listing parser - debian/patches/CVE-2026-47729.patch: guard the whitespace-skipping strchrwspace, copyFrom checks in ftpListParseParts with a 'copyFrom &&' short-circuit so a listing date that is not followed by a filename cannot advanc...

CLSA-2026-1784710881 Fix CVE(s): CVE-2026-47729, CVE-2026-50012

SECURITY UPDATE: out-of-bounds read in the FTP gateway directory-listing parser when a TypeA/TypeB listing entry date is not followed by a filename - debian/patches/CVE-2026-47729.patch: restrict parsing to the input buffer in ftpListParseParts by checking for a NUL byte before strchrwspace in...

OPENSUSE-SU-2026:21412-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues: - CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes outside the configured data director bsc1271629. - CVE-2026-15043: DBI:SQL:Nano has incorrect predicate evaluation,...

OPENSUSE-SU-2026:21408-1 Security update for joe

This update for joe fixes the following issue - CVE-2026-13412: improper validation in tag-file parser can lead to arbitrary command execution bsc1269379...

SUSE-SU-2026:22843-1 Security update for joe

This update for joe fixes the following issue - CVE-2026-13412: improper validation in tag-file parser can lead to arbitrary command execution bsc1269379...

SUSE-SU-2026:22845-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues: - CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes outside the configured data director bsc1271629. - CVE-2026-15043: DBI:SQL:Nano has incorrect predicate evaluation,...

EUVD-2026-46642

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...

MiracleLinux 8 : python3-3.6.8-77.el8_10.ML.1 (AXSA:2026-1330:09)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1330:09 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding...

RockyLinux 10 : python3.14 (RLSA-2026:40856)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:40856 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding descriptio...

RockyLinux 9 : python3.14 (RLSA-2026:41949)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:41949 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

PT-2026-63528

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket on protocol error in the library lib/facil/http/parsers/websocket parser.h of the component WebSocket Frame Parser. This manipulation of the argument on message causes improper input validation. The attack...

📄 ThorVG SVG Parser NULL Pointer Dereference

A proof of concept exploit for ThorVG version prior to 1.0.5 demonstrates a NULL pointer dereference vulnerability in the SVG parser. A malformed, truncated child element within a root svg node causes createElement to return a NULL pointer which is subsequently dereferenced by parseStyle without...

EUVD-2026-45551

fast-uri vulnerable to host confusion via literal backslash authority delimiter...

@bpmiq/mcp (>=1.0.0, <=2.3.0), @bpmiq/validator (>=1.0.0, <=2.3.0) +29 more potentially affected by CVE-2026-73569 via fast-xml-parser (>=5.9.3, <=5.10.0)

fast-xml-parser NPM version =5.9.3, =1.0.0, =1.0.0, =0.1.0, =1.18.42-test.0, =0.24.0, =5.1.22, =5.1.22, =0.0.1, =0.0.1, =49.13.0, =50.0.0, =2.4.0, =1.0.0-next.27766, =12.1.0-rc.347 and more Source cves: CVE-2026-73569 Source advisory: GHSA-8R6M-32JQ-JX6Q...

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Impact fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities. addInputEntities resets the entity expansion counters every time it is called. An attacker can therefore insert...

NPM: fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

NPM: fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits vulnerability discovered by ? in WordPress Npm fast-xml-parser versions = 5.9.3, 5.10.1...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' via the addInputEntities function. An attacker can cause excessive...