Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Container Release Update

An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams,...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams,...

CVE-2026-32821

CVE-2026-32821 affects dataCycle dataCycle-CORE prior to 26.06.08. An authenticated API user with a valid access token can use user_email to have the collection API evaluate permissions as another user, potentially exposing that user’s collections. In V4, if a collection id is known, the add_item...

Important: Red Hat Security Advisory: RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release

The 1.3.6 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.3 The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19...

CVE-2026-35198

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting XSS vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through...

CVE-2026-48824 Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes" wrapped only POST /api/v1/send with http.MaxBytesReader. The...

EUVD-2026-45911

SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements field. for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrec...

SUSE-SU-2026:22763-1 Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.32.1 fixes various security issues The following security issues were fixed: - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094. - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of...

SUSE-SU-2026:3126-1 Security update for podman

This update for podman rebuilds it against the current go security release...

SUSE-SU-2026:22759-1 Security update for the Linux Kernel (Live Patch 5 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.26.1 fixes various security issues The following security issues were fixed: - CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524. - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats...

Important: kernel-livepatch-6.1.168-203.330

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.1.168-203.330 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Linux Distros Unpatched Vulnerability : CVE-2026-64033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrssrvcreatepathfiles, the sysfs root folders may already have been created an...

Linux Distros Unpatched Vulnerability : CVE-2026-63906

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: musb: omap2430: Fix use-after-free in omap2430probe In omap2430probe, ofnodeputnp is called prematurely before the last access to np, leading to a...

Important: kernel-livepatch-6.1.170-208.319

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.1.170-208.319 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Medium: golist

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

yggdrasil-worker-package-manager security update

0.2.3-7 - Bump release for rebuild 0.2.3-6 - Bump release for rebuild...

Important: kernel-livepatch-6.1.175-219.357

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.1.175-219.357 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.1.176-220.358

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.1.176-220.358 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Linux Distros Unpatched Vulnerability : CVE-2026-64080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Snapshot notifier callbacks under lock Both notification handlers currentl...

Linux Distros Unpatched Vulnerability : CVE-2026-64011

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: Fix use-after-free in llcpsockrelease llcpsockrelease unconditionally unlinks the socket from the local sockets list. However, if the socket is still...