libX11 -- multiple vulnerabilities

X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for. CVE-2026-88806: Out-of-bounds write vulnerability in libX11's XKB X Keyboard Extension action parser CVE-2026-94283: Out-of-bounds read...

libXpm -- vulnerability

X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for. CVE-2026-94287: Denial of service via unsigned underflow in libXpm's write path...

Linux Distros Unpatched Vulnerability : CVE-2026-111280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea that allows malicious S7 peers to overflow client buffers via...

CVE-2026-111881: Integer Underflow (Wrap or Wraparound)

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboardsynthesizeimageformattobmp for...

CVE-2026-111918: Incorrect Authorization

Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write taskpositions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing defaultprojecti...

CVE-2026-111880: Out-of-bounds Write

FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATEMESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyon...

AlmaLinux 9.6 [TuxCare] Security Update: compat-openssl11 (ALMALINUX9.6:CLSA-2026:1792183929)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792183929 advisory. - Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD...

Linux Distros Unpatched Vulnerability : CVE-2026-110698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whispermodelload of the file external/whispercpp/whisper.cpp of the...

Linux Distros Unpatched Vulnerability : CVE-2026-111881

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZEMAX - 3 to StreamZero...

Linux Distros Unpatched Vulnerability : CVE-2026-110715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating ...

Linux Distros Unpatched Vulnerability : CVE-2026-110601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gifinitframe in src/fromgif.c, which never checks the GIF...

Linux Distros Unpatched Vulnerability : CVE-2026-110654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DR...

Rocky Linux 10.2 [CIQ] Security Update: ghostscript / ghostscript-debuginfo / ghostscript-debugsource / etc Multiple Vulnerabilities (crlsa-2026_83551)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202683551 advisory. ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use- after-free CVE-2026-101258 ghostscript:...

SUSE SLES12 Security Update : mutt (SUSE-SU-2026:4685-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4685-1 advisory. This update for mutt fixes the following issue: - CVE-2026-107570: heap out-of-bounds write in convertfilefromto via a crafted Content-Type...

Rocky Linux 9.6 [TuxCare] Security Update: compat-openssl11 (ALMALINUX9.6:CLSA-2026:1792183929)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792183929 advisory. - Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD...

Linux Distros Unpatched Vulnerability : CVE-2026-110604

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxmlstrtod when the locale decimal point is not '.'. Attackers can supply XML...

Linux Distros Unpatched Vulnerability : CVE-2026-111275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never...

Linux Distros Unpatched Vulnerability : CVE-2026-111105

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...

CVE-2026-67407

A flaw was found in rabbitmq-server. Due to improper regular expression character escaping, topic permission templates for Message Queuing Telemetry Transport MQTT clients fail to sanitize hyphen characters. An authenticated, low-privileged attacker controlling their client identifier can exploit...

[slackware-security] libXpm

New libXpm packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libXpm-3.5.20-i586-1slack15.0.txz: Upgraded. This update fixes a security issue: Denial of service via unsigned underflow in libXpm's...