Important: python-pyasn1

Issue Overview: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string...

Important: python-pyasn1

Issue Overview: pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains ma...

Medium: gstreamer-plugins-base

Issue Overview: A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD .sub subtitle file...

Medium: gnome-shell

Issue Overview: A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing...

Important: postgresql-odbc

Issue Overview: Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps...

Important: thunderbird

Issue Overview: Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. CVE-2026-117860 Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox...

Medium: exiv2

Issue Overview: Out of bounds read in CrwMap::decodeBasic CVE-2026-49275 Affected Packages: exiv2 Issue Correction: Run dnf update exiv2 --releasever 2023.12.20261112 or dnf update --advisory ALAS2023-2026-3434 --releasever 2023.12.20261112 to update your system. More information on how to update...

Important: xorg-x11-server

Issue Overview: A flaw in the X.Org Server's handling of EDID Display-Range descriptors can result in an out-of-bounds write, potentially leading to server crashes or memory corruption. CVE-2026-109091 A bounds-checking flaw in the X.Org Server's XvShmPutImage handling can result in an...

Medium: gdk-pixbuf2

Issue Overview: A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an...

Important: gstreamer1-plugins-bad-free

Issue Overview: A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding SCC extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the...

Important: git

Issue Overview: Size calculations for very large merge results can overflow, leading to an undersized buffer and heap corruption. CVE-2026-105437 Recursive clones can lead to remote code execution through unsafe handling of submodule-related repository metadata. CVE-2026-111760 A server can...

Important: qemu

Issue Overview: A flaw was found in QEMU's websocket I/O channel QIOChannelWebsock in io/channel-websock.c. The websocket server reads encoded data from a connected client into an input buffer and decodes it into a separate buffer, but the size limit is enforced only on the encoded-input buffer a...

Medium: gdk-pixbuf2

Issue Overview: A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an...

Medium: sqlite

Issue Overview: SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL o...

Important: compat-rpm-411

Issue Overview: A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary comman...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save CVE-2026-89912 In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control i.e. pending TLB flush on...

Medium: gstreamer1-plugins-bad-free

Issue Overview: A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service. CVE-2026-121259...

Important: xfsprogs

Issue Overview: A flaw was found in the xfsadmin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command...

Important: perl-CGI

Issue Overview: CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescaped into the substitutio...

Important: xfsprogs

Issue Overview: A flaw was found in the xfsadmin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command...

Medium: freetype

Issue Overview: An integer overflow vulnerability was discovered in Freetype in tthvadvanceadjust function in src/truetype/ttgxvar.c. CVE-2023-2004 Affected Packages: freetype Issue Correction: Run dnf update freetype --releasever 2023.12.20261112 or dnf update --advisory ALAS2023-2026-3446...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk-action escaping walkpmdrange CVE-2026-89754 In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GETNESTEDSTATEPAGES if getting said pages fails...

Important: libheif

Issue Overview: libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in uncdecodermixedinterleave::processTile that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example,...

Important: perl-MIME-tools

Issue Overview: MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing...

Medium: speex

Issue Overview: Speex libspeex through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer or...

Important: libimobiledevice

Issue Overview: A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: bonding: fix type confusion in bondsetupbyslave CVE-2026-43456 In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped CVE-2026-72434 In the Linux...

Important: firefox

Issue Overview: Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. CVE-2026-117860 Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox...

Important: gstreamer1-plugins-bad-free

Issue Overview: A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding SCC extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the...

Medium: gstreamer1-plugins-base

Issue Overview: A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD .sub subtitle file...

Important: postgresql-odbc

Issue Overview: psqlODBC copies the reply to a large-object read loread into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds...

Important: rpm

Issue Overview: A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAGLONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext that shrinks a buffer allocation to one byte, after which the...

Important: nodejs22

Issue Overview: Node js security advisory: Permission Model filesystem over-grant via wildcard radix lookup CVE-2026-106071 SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are no...

Medium: gstreamer1-plugins-bad-free

Issue Overview: A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service. CVE-2026-121259...

Medium: sqlite

Issue Overview: SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like...

Important: rpm

Issue Overview: A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAGLONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext that shrinks a buffer allocation to one byte, after which the...

Important: qemu

Issue Overview: A flaw was found in QEMU's websocket I/O channel QIOChannelWebsock in io/channel-websock.c. The websocket server reads encoded data from a connected client into an input buffer and decodes it into a separate buffer, but the size limit is enforced only on the encoded-input buffer a...

Medium: libnvjpeg-13-4

Issue Overview: NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A successful exploit of this vulnerability might lead to denial of service. CVE-2026-65160 Affected Packages: libnvjpeg-13-4 Issue Correction: Run dnf update libnvjpeg-13-4 --releasever latest o...

Important: perl-MIME-tools

Issue Overview: MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit...

Medium: python-botocore

Issue Overview: Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if...

Important: libsoup3

Issue Overview: A flaw was found in libsoup. The soupuridecodedatauri function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling gbase64decodeinplace. If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and b...

Important: skopeo

Issue Overview: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS25...

Important: tomcat10

Issue Overview: A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-...

Important: python-pillow

Issue Overview: A flaw was found in Pillow. When parsing GIF images with numerous comment blocks, the library repeatedly copies data in an inefficient manner. A remote attacker can exploit this vulnerability by submitting a specially crafted GIF image to an application that processes images using...

Medium: amazon-ssm-agent

Issue Overview: When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such...

Important: xorg-x11-server-Xwayland

Issue Overview: A bounds-checking flaw in the X.Org Server's XvShmPutImage handling can result in an out-of-bounds read or write, potentially leading to server crashes or memory corruption. CVE-2026-109092 A flaw in the X.Org Server's XTestFakeInput handling can result in a stack out-of-bounds...

Critical: httpd

Issue Overview: modmd NULL pointer dereference leads to child process crash CVE-2026-106023 modvhostalias 1 byte stack buffer overwrite after CVE-2026-63292 CVE-2026-109163 Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's modhttp2 in...

Important: git

Issue Overview: Size calculations for very large merge results can overflow, leading to an undersized buffer and heap corruption. CVE-2026-105437 Recursive clones can lead to remote code execution through unsafe handling of submodule-related repository metadata. CVE-2026-111760 A server can...

Important: squid

Issue Overview: Due to an Improper Input Validation CWE-20 bug, Squid is vulnerable to a Stack-based Buffer Overflow CWE-121 attack against HTTP Authentication. CVE-2026-104786 Affected Packages: squid Issue Correction: Run dnf update squid --releasever 2023.12.20261112 or dnf update --advisory...

Important: firefox

Issue Overview: Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. CVE-2026-117860 Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox...