Important: qemu

Issue Overview: A flaw was found in QEMU's websocket I/O channel QIOChannelWebsock in io/channel-websock.c. The websocket server reads encoded data from a connected client into an input buffer and decodes it into a separate buffer, but the size limit is enforced only on the encoded-input buffer a...

Medium: speex

Issue Overview: Speex libspeex through 1.2.1 contains an out-of-bounds write vulnerability in speexbitsreadwholebytes in libspeex/bits.c that mishandles length truncation for non-owned SpeexBits buffers. Attackers can stream crafted Speex data into buffers set up with speexbitsinitbuffer or...

Important: jackson

Issue Overview: jackson-core contains core low-level incremental "streaming" parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, if a user parses an input file and it has deeply nested data, Jackson could end up throwing a StackoverflowError if the depth...

Important: fltk

Issue Overview: FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in FlBMPImage::loadbmp that allows attackers to corrupt stack memory by supplying an oversized BMP colorsused field. Attackers can craft BMP or ICO files with colorsused above 256 to overflow the 768-byte...

Important: libgsf

Issue Overview: A flaw was found in libgsf. A heap-based buffer overflow vulnerability exists in the OLE2 document parser within the oleinforeadmetabat function. A remote attacker could exploit this flaw by enticing a user to open a specially crafted file. Successful exploitation could lead to...

Important: fltk

Issue Overview: FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in FlBMPImage::loadbmp that allows attackers to corrupt stack memory by supplying an oversized BMP colorsused field. Attackers can craft BMP or ICO files with colorsused above 256 to overflow the 768-byte...

Medium: gstreamer1-plugins-base

Issue Overview: A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD .sub subtitle file...

Medium: libstoragemgmt

Issue Overview: A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI Small Computer System Interface Vital Product Data VPD page 0x80 data. This malformed data, specifically an untrusted page length field, can lea...

Important: curl

Issue Overview: When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback. CVE-2026-87865 Affected Packages: curl Note: This advisory is applicable to Amazon Lin...

Important: python-pillow

Issue Overview: A flaw was found in Pillow. When saving an image in the TIFF format, Pillow incorrectly forwards unknown metadata tags to the underlying image processing library. A remote attacker could exploit this flaw by providing a specially crafted image containing malicious metadata to an...

Important: rsyslog

Issue Overview: An SQL injection issue affects rsyslog deployments using the optional omclickhouse output module. Its built-in INSERT template used escaping that did not account for ClickHouse backslash escapes. A sender able to submit a log message routed to this action could alter the SQL sent ...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped CVE-2026-72434 In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. CVE-2026-74406 I...

Medium: amazon-ssm-agent

Issue Overview: When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such...

Important: freerdp

Issue Overview: FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with an unknown message type without checking it lies within the packet's declared length, causing a WinPR stream assertion failure. A remote RDP client with an active...

Medium: bcel

Issue Overview: Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker...

Important: buildah

Issue Overview: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS25...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bondxmitbroadcast CVE-2026-31419 In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini report...

Important: xorg-x11-server

Issue Overview: A flaw in the X.Org Server's handling of EDID Display-Range descriptors can result in an out-of-bounds write, potentially leading to server crashes or memory corruption. CVE-2026-109091 A bounds-checking flaw in the X.Org Server's XvShmPutImage handling can result in an...

Critical: httpd

Issue Overview: modvhostalias 1 byte stack buffer overwrite after CVE-2026-63292 CVE-2026-109163 Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server’s modhttp2 in assignheaders can lead to RCE. CVE-2026-119618 Affected Packages: httpd Issue...

Important: nodejs24

Issue Overview: Node js security advisory: Permission Model filesystem over-grant via wildcard radix lookup CVE-2026-106071 undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when an Agent composes the redirect and shared cache interceptors, a cached...

Important: xdg-desktop-portal

Issue Overview: XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host limited to files the user has access to. The FileChooser.SaveFiles...

Medium: libreswan

Issue Overview: In Libreswan before 5.3.2, when the operating system and Libreswan are running in FIPS mode and at least one CA certificate is loaded, a malformed X.509 certificate payload can cause the pluto daemon to abort on an assertion. In FIPS mode, adddecodedcert calls CERTExtractPublicKey...

Important: haproxy

Issue Overview: A flaw was found in haproxy. A remote, unauthenticated attacker can trigger a denial of service DoS by sending a specially crafted HTTP/1.1 chunked request. When processing the request, the parser repeatedly re-evaluates the same data without making forward progress, trapping the...

Important: ruby

Issue Overview: An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an...

Important: python-virtualenv

Issue Overview: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination...

Medium: perl-DBI

Issue Overview: DBI versions before 1.656 for Perl crash via type confusion in dbiprofile when a database handle is destroyed under a Profile Path with an attr element. An attr element names a database handle attribute, which dbiprofile reads from the handle's inner hash. It expects the inner...

Important: kernel-livepatch-6.1.180-225.360

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.1.180-225.360 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Medium: perl-DBI

Issue Overview: DBI versions before 1.656 for Perl crash via type confusion in dbiprofile when a database handle is destroyed under a Profile Path with an attr element. An attr element names a database handle attribute, which dbiprofile reads from the handle's inner hash. It expects the inner...

Important: kernel-livepatch-6.1.189-236.399

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.1.189-236.399 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Medium: perl-URI

Issue Overview: URI::idna::nameprep only lowercased the label and skipped the Unicode normalization that RFC 3490/3491 require. As a result, a host that was not already in NFC encoded to a non-standard A-label that disagrees with what browsers, curl, Go, Java, and Python compute for the same inpu...

Important: kernel-livepatch-6.18.41-94.142

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.18.41-94.142 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: docker

Issue Overview: eStargz layer decoder in the estartgz package contains a vulnerability that an input containing a cyclic hardlink crashes the process with Go's unrecoverable stack overflow error. Stargz Snapshotter with the default configuration relies on that function so pulling an eStargz image...

Important: rpm

Issue Overview: A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows tha...

Important: python-twisted

Issue Overview: A flaw was found in Twisted. An unauthenticated remote attacker can cause a Denial of Service DoS by exhausting server memory. The issue occurs because the XML stream parser retains unfinished elements in memory without enforcing size or element count limits. By transmitting a...

Medium: lvm2

Issue Overview: A flaw was found in libdm. A remote attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command...

Important: gstreamer1-plugins-good

Issue Overview: GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack...

Important: runfinch-finch

Issue Overview: go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI...

Important: runfinch-finch

Issue Overview: go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfreercu and rcuassignpointer CVE-2026-72435 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.4 Extra. Visit this page to learn more about...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfreercu and rcuassignpointer CVE-2026-72435 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

Important: rclone

Issue Overview: rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matchi...

Medium: perl-podlators

Issue Overview: Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap subtracts from the output width to get the space available for text...

Important: gstreamer1-plugins-base

Issue Overview: A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during...

Medium: curl

Issue Overview: A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process. CVE-2026-18924 A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostna...

Medium: p11-kit

Issue Overview: P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems CVE-2026-18938 Affected Packages: p11-kit Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

Important: python-pillow

Issue Overview: Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek resets TIFF frame state, so ...

Important: libXi

Issue Overview: libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow CVE-2026-109089 libXi XGetDeviceControl DEVICEENABLE Heap Buffer Overflow NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003752.html NOTE:...

Medium: python3.13

Issue Overview: tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to...

Medium: sssd

Issue Overview: A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can...

Important: ruby4.0

Issue Overview: An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an...