AlmaLinux 9.6 [TuxCare] Security Update: compat-openssl11 (ALMALINUX9.6:CLSA-2026:1792183929)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792183929 advisory. - Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD...

Linux Distros Unpatched Vulnerability : CVE-2026-110601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gifinitframe in src/fromgif.c, which never checks the GIF...

Linux Distros Unpatched Vulnerability : CVE-2026-110698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whispermodelload of the file external/whispercpp/whisper.cpp of the...

Linux Distros Unpatched Vulnerability : CVE-2026-111105

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...

Linux Distros Unpatched Vulnerability : CVE-2026-111880

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1792190438)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792190438 advisory. - A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via...

libXpm -- vulnerability

X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for. CVE-2026-94287: Denial of service via unsigned underflow in libXpm's write path...

libX11 -- multiple vulnerabilities

X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for. CVE-2026-88806: Out-of-bounds write vulnerability in libX11's XKB X Keyboard Extension action parser CVE-2026-94283: Out-of-bounds read...

CVE-2026-67407

A flaw was found in rabbitmq-server. Due to improper regular expression character escaping, topic permission templates for Message Queuing Telemetry Transport MQTT clients fail to sanitize hyphen characters. An authenticated, low-privileged attacker controlling their client identifier can exploit...

[slackware-security] libXpm

New libXpm packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libXpm-3.5.20-i586-1slack15.0.txz: Upgraded. This update fixes a security issue: Denial of service via unsigned underflow in libXpm's...

CVE-2026-111151

A flaw was found in OpenJPH. This vulnerability allows an attacker to cause a Denial of Service DoS and memory corruption by tricking a user or application into processing a crafted image file. When the High-Throughput JPEG 2000 HTJ2K decoder processes single-row image blocks, an out-of-bounds...

CVE-2026-111275

A flaw was found in nifticlib. This vulnerability can result in a Denial of Service DoS or memory corruption when an application processes a specially crafted NIfTI-2 image file. Due to missing range validation on dimension header values, an attacker could supply a malicious file that triggers a...

CVE-2026-111105

A flaw was found in rlottie. This vulnerability allows remote attackers to execute arbitrary code due to improper validation of user-supplied data, which can cause an out-of-bounds write before the start of an allocated buffer. Successful exploitation requires user interaction, such as convincing...

CVE-2026-110654

A flaw was found in zvbi. An out-of-bounds write vulnerability in the Teletext decoder allows an attacker to cause a Denial of Service DoS and memory corruption by supplying a specially crafted Teletext stream. When the application decodes the malicious stream containing unvalidated Dynamically...

CVE-2026-70197

A flaw was found in .NET. An out-of-bounds write vulnerability allows an unauthenticated remote attacker to execute arbitrary code over the network. By sending specially crafted input to an affected application, an attacker can corrupt system memory and compromise the host environment...

OPENSUSE-SU-2026:22123-1 Security update for gimp

This update for gimp fixes the following issues: Changes in gimp: - CVE-2026-106061: plug-ins: Bound allocation for XMC import bsc1284473 - CVE-2026-106062: plug-ins/file-dds: fix out of bounds write bsc1284474 - CVE-2026-106063: plug-ins: Add bounds checks for DICOM export bsc1284475 -...

CLSA-2026-1792177938 tigervnc: Fix of 27 CVEs

CVE-2026-50264: fix out-of-bounds heap write in DRI2 DRIGetBuffers; carried by xorg-x11-server-source = 1.20.4-99.el79.tuxcare.els14, no local patch...

CVE-2026-111643

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter...

CVE-2026-111627

HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOTUSER administrators to perform write actions while impersonating the protected ROOTUSER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never...

CVE-2026-111621

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...