osbuild-composer security update

An update is available for osbuild-composer. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A service for building customized OS artifacts, such as VM images a...

RLSA-2026:66392 Moderate: apr-util security update

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fixes: apr-util: Apache Portable Runtime...

RLSA-2026:66336 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via out-of-bounds write in terminal handling CVE-2026-52859 vi...

RLSA-2026:66432 Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...

vim security update

An update is available for vim. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Vim Vi IMproved is an updated and improved version of the vi editor. Security...

RLSA-2026:66403 Moderate: coreutils security update

The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Security Fixes: coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values CVE-2026-56392 For more details about the...

coreutils security update

An update is available for coreutils. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The coreutils packages contain the GNU Core Utilities and represent a...

RLSA-2026:66366 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via out-of-bounds write in terminal handling CVE-2026-52859 vi...

RLSA-2026:66341 Moderate: apr-util security update

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fixes: apr-util: Apache Portable Runtime...

vim security update

An update is available for vim. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Vim Vi IMproved is an updated and improved version of the vi editor. Security...

CVE-2026-45761

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring NSM engine. A local attacker, by providing a specially crafted rule with mixed-case frame syntax, could trigger a heap buffer overflow. This vulnerability occur...

CVE-2026-45752

A flaw was found in Suricata, a network Intrusion Detection System. When specific detection transforms are chained, the decompress transform pipeline can attempt to read from an inspection buffer after it has been reallocated and freed. This use-after-free vulnerability can be triggered by a...

CVE-2026-45751

A flaw was found in Suricata, a network Intrusion Detection System. A remote attacker could exploit a use-after-free vulnerability in the inspection-buffer helper. This occurs when a chained transform reallocates a buffer, leaving an inspection pointer referencing freed memory. This issue,...

CVE-2026-87776

A flaw was found in the compression Node.js and Express middleware. A remote unauthenticated attacker can exploit this vulnerability by repeatedly initiating and then prematurely aborting connections while compressed responses are being sent. This action prevents the zlib stream, used for...

CVE-2026-46387

A flaw was found in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. A remote attacker could send a specially crafted HTTP/2 DATA payload with a high compression ratio. This could cause Suricata's HTTP/2 decompression path to...

CVE-2026-45770

A flaw was found in Suricata, a network Intrusion Detection System. A specially crafted Lua rule that registers an excessive number of flow variables can corrupt the Lua detection state. This could allow an attacker to bypass Suricata's restricted Lua sandbox, potentially leading to unauthorized...

CVE-2026-45762

A flaw was found in Suricata, a network Intrusion Detection System. The IP defragmentation tracker lookup did not properly verify the IP address family of incoming packets. A remote attacker could send specially crafted fragmented IPv4/IPv6 traffic, causing an IPv6 fragment to be incorrectly...

CVE-2026-45759

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring NSM engine. A remote attacker could exploit this vulnerability by sending crafted HTTP traffic with large Content-Disposition headers. This could lead to...

CVE-2026-45747

A flaw was found in Suricata, a network Intrusion Detection System. A remote attacker could exploit a NULL dereference vulnerability in the Lua TLS certificate information helper. This vulnerability occurs when a Lua script attempts to retrieve certificate details from TLS Transport Layer Securit...

CVE-2026-76922

A flaw was found in Wireshark. A local attacker could exploit a crash in the Bluetooth BR/EDR FHS protocol dissector, requiring user interaction. This vulnerability could lead to a denial of service, making the application unavailable to users. Mitigation To mitigate this issue, users should avoi...