kernel security, bug fix, and enhancement update

6.12.0-211.49.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

java-17-openjdk security update

17.0.20.1.1-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.20.1.1-1.1 - Update to jdk-17.0.20.1+1 GA - Add to .gitignore openjdk-17.0.20.1+1.tar.xz - Set patchver to 1 - Set buildver to 1 - Update sources to openjdk-17.0.20.1+1.tar.xz - This tarball is embargoed until 2026-08-18 @ 1p...

java-21-openjdk security update

1:21.0.12.1.1-1.2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.12.1.1-1.2 - Bump release for PQC build - Related: RHEL-235625 1:21.0.12.1.1-1.1 - Update to jdk-21.0.12.1+1 GA - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - This...

cve-2026-47877 - HIGH - Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

cve-2026-47877 - HIGH - Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting XSS...

cve-2026-47885 - MEDIUM - Spring Framework maxPartSize Ignored in PartEventHttpMessageReader

cve-2026-47885 - MEDIUM - Spring Framework maxPartSize Ignored in PartEventHttpMessageReader...

cve-2026-47884 - MEDIUM - Spring Framework Improper Path Limitation in XsltView

cve-2026-47884 - MEDIUM - Spring Framework Improper Path Limitation in XsltView...

Comparison of Object References Instead of Object Contents

Overview Affected versions of this package are vulnerable to Comparison of Object References Instead of Object Contents in the process of comparing UserVerificationRequirement during WebAuthn authentication, when using distributed HTTP session stores. An attacker can bypass user verification by...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

Binding to an Unrestricted IP Address

Overview org.springframework.security:spring-security-ldap is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Binding to an...

Virtuozzo Infrastructure 7.3 Update 1 Hotfix 3 (7.3.1-66)

This update provides security fixes. Vulnerability id: VSTOR-140619 A security fix for CVE-2026-64531. Vulnerability id: VSTOR-140678 A security fix for CVE-2026-64561...

PT-2026-80606

These are all security issues fixed in the MozillaThunderbird-140.14.0-1.1 package on the GA media of openSUSE Tumbleweed...

Fedora 43 : firefox (2026-170e9d62c6)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-170e9d62c6 advisory. - Update to latest upstream 154.0 - Enabled Wayland session restore on KDE. Tenable has extracted the preceding description block directly from the...

Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2026-231-02)

The version of mozilla-thunderbird installed on the remote host is prior to 140.14.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-231-02 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues...

MiracleLinux 8 : dotnet9.0-9.0.120-1.el8_10 (AXSA:2026-1581:16)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1581:16 advisory. .NET: .NET Core: .NET Security Feature Bypass Vulnerability CVE-2026-62899 .NET: .NET Information Disclosure Vulnerability CVE-2026-62900 .NET: .NET...

cve-2026-47879 - HIGH - Spring Cloud Gateway SSRF and native file access with gRPC

cve-2026-47879 - HIGH - Spring Cloud Gateway SSRF and native file access with gRPC...

cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification

cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification...

cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces

cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces...

The vulnerability in the social_login.cgi script of the Zyxel networking device allows attackers to bypass existing security mechanisms.

The vulnerability of the sociallogin.cgi script of the Zyxel networking devices is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms remotely...

cve-2026-59283 - MEDIUM - Spring Framework Safety Guard Bypass via SpEL Expression Compilation

cve-2026-59283 - MEDIUM - Spring Framework Safety Guard Bypass via SpEL Expression Compilation...

Timing Attack

Overview org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Timing Attack via the comparison of sensitive values using standard string equality rather than constant-time...