gpsd security update

3.26.1-3.0.1.el102.1 - Replace upstream reference Orabug: 37033219 1:3.26.1-3.el102.1 - fix command injection in gpsprof CVE-2026-58459...

kernel security, bug fix, and enhancement update

4.18.0-553.153.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

Fedora 44 : trafficserver (2026-5bec7441bb)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5bec7441bb advisory. Update to upstream 10.1.4 Resolves: - CVE-2026-22068 - Unanchored regular-expression matching allows ACL and policy bypass - CVE-2026-33267 -...

kernel security, bug fix, and enhancement update

6.12.0-211.43.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

keycloak-services: keycloak-services: SAML IdP-initiated broker login bypasses link-only restriction

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

CVE-2026-16442

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

EUVD-2026-53395

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

EUVD-2026-53393

A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication skip-auth-regex, the proxy forwards client-supplied identity headers X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token to the upstream application without stripping them. An unauthenticated attacke...

CVE-2026-49331

A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication skip-auth-regex, the proxy forwards client-supplied identity headers X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token to the upstream application without stripping them. An unauthenticated attacke...

[SECURITY] Fedora 44 Update: perl-5.42.3-525.fc44

Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common...

kernel security, bug fix, and enhancement update

4.18.0-553.151.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

osbuild-composer security update

175-1.0.1 - Track github upstream...

kernel security, bug fix, and enhancement update

5.14.0-687.34.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

AI assistance was used to help inspect the code and prepare this report. SummaryThe fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote passe...

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

SummaryThe terminal proxy in backend/openwebui/routers/terminals.py forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is...

PYSEC-2026-3597 open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...

kernel security, bug fix, and enhancement update

6.12.0-211.42.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

nodejs24 security update

1:24.18.0-3.0.1 - Update upstream references 1:24.18.0-3 - Fix CVE-2026-13149 brace-expansion 1:24.18.0-2 - Fix CVE-2026-59873 and CVE-2026-59874 nodejs-tar...

osbuild-composer security, bug fix, and enhancement update

175-1.0.1 - Track github upstream...

ALSA-2026:49871 Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown CVE-2025-68214 kernel: procfs: avoid fetching build ID while holding VMA lock CVE-2026-23199 Bug Fixes...