Updated libwebsockets packages fix a security vulnerability

warmcat libwebsockets SSH Protocol sshd.c lwssshparseplaintext resource consumption. CVE-2026-10650...

Updated coreutils package fixes a security vulnerability

Out‑of‑bounds Read in GNU coreutils. CVE-2026-56391...

Updated libnfs package fixes a security vulnerability

libnfs through 6.0.2 before 935b8db has an xid integer underflow in READIOVEC in rpcreadfromsocket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker. CVE-2026-57918...

Updated borgbackup package fixes a security vulnerability

The updated package fixes a security vulnerability: CVE-2026-62268...

Updated nss & firefox packages fix security vulnerabilities

Use-after-free in the Audio/Video: Web Codecs component. CVE-2026-92005 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. CVE-2026-92006 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. CVE-2026-92007...

Updated cpio packages fix security vulnerabilities

Path Traversal in GNU cpio. CVE-2026-66484 Uncontrolled Memory Allocation in GNU cpio. CVE-2026-66485 Improper Output Encoding in GNU cpio. CVE-2026-66486...

Updated diffutils packages fix a security vulnerability

Heap-based Buffer Overflow in GNU diffutils. CVE-2026-53910...

Updated rest packages fix a security vulnerability

Weak random number generation in pkce implementation. CVE-2026-16615...

Updated perl-Dancer2 packages fix a security vulnerability

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. CVE-2026-13577...

Updated vim packages fix security vulnerabilities

Out-of-bounds Access in libvterm Resize Handling in Vim = v8.1.0688...

Updated pcre2 packages fix a security vulnerability

Out-of-bounds write in pcre2dfamatch with recursive patterns under a low heap limit CVE-2026-86145...

Updated nmap packages fix a security vulnerability

Denial of Service via Zero-Length TCP Option Packet. CVE-2026-72712...

Updated bind package fixes security vulnerabilities

Unauthenticated IXFR deltas are applied to the live zone before TSIG verification CVE-2026-19033. qpcache NOQNAME proof use-after-free crashes recursive resolver CVE-2026-19662. Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path CVE-2026-19666. Remote assertion failure via 16-bit...

Updated patch package fixes security vulnerabilities

NULL Pointer Dereference in GNU patch. CVE-2026-56288 Loop with Unreachable Exit Condition in GNU patch. CVE-2026-56289...

Updated mpg123 package fixes security vulnerabilities

Updated packages fix security vulnerabilities, please se the reference...

Updated python-httplib2 packages fix a security vulnerability

Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling. CVE-2026-59939...

Updated perl-YAML packages fix a security vulnerability

Updated packages fixes CVE-2026-63676...

Updated python-configargparse packages fix security vulnerabilities

Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values...

Updated libde265 package fixes security vulnerabilities

Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 function at sdl.cc. CVE-2024-38949 Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to...

Updated ntfs-3g packages fix security vulnerabilities

Heap memory corruption when processing a corrupt or maliciously crafted filesystem. CVE-2026-42616 Heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. CVE-2026-42617 Single-byte heap buffer overflow when decompressing...

Updated libssh packages fix security vulnerabilities

Stack buffer overflow in SFTP server longname construction. CVE-2026-15370 Denial of service via zero advertised channel packet size. CVE-2026-59843 Denial of service via oversized SFTP read length. CVE-2026-59844 Denial of service via unchecked ProxyCommand fork failure. CVE-2026-59845 Informati...

Updated postfix packages fix security vulnerabilities

Updated packages fix security issues. Please see the references...

Updated gawk packages fix security vulnerabilities

Use after free in gawk. CVE-2026-40467 Heap buffer overflow in gawk. CVE-2026-40468 Heap buffer overflow in gawk. CVE-2026-40469 Stack-based buffer overflow in gawk. CVE-2026-40553...

Updated ntpsec packages fix a security vulnerability

Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' in ntpsec. CVE-2026-18321...

Updated gstreamer1.0-plugins-base packages fix a security vulnerability

GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. CVE-2026-18297...

Updated libpcap packages fix security vulnerabilities

OOBR and OOBW in libpcap before 1.10.7. CVE-2026-0799 abort in libpcap before 1.10.7 on an invalid BPF opcode. CVE-2026-31911 OOBR in libpcap before 1.10.7. CVE-2026-31912 Division by zero in libpcap before 1.10.7. CVE-2026-6244 Infinte loop in libpcap before 1.10.7. CVE-2026-6554 rpcapd memory...

Updated graphicsmagick packages fix a security vulnerability

Integer overflows in MNG magnification. CVE-2025-55154...

Updated gdk-pixbuf2.0 packages fix security vulnerabilities

Heap‑buffer‑overflow in gdk‑pixbuf. CVE-2025-7345 Out-of-bounds read in ico parser. CVE-2026-16768 Invalid write in jpeg icc profile parser on error recovery. CVE-2026-81893...

Updated python-starlette package fixes security vulnerabilities

Arbitrary HTTP method dispatched to HTTPEndpoint attributes via getattr. CVE-2026-48817 Unvalidated request path concatenated into authority poisons request.url.hostname. CVE-2026-54282...

Updated imagemagick package fixes security vulnerabilities

Heap-use-after-free in Layer method of PerlMagick could result in a crash Path Policy TOCTOU symlink race bypass in the video decoder Heap-use-after-free in the GetList method of PerlMagick could result in a crash Memory Leak in MSL decoder Denial of service when exhausting the process memory...

Updated python-h2 packages fix a security vulnerability

Duplicate Host header facilitate request smuggling. CVE-2026-71554...

Updated libgd packages fix a security vulnerability

A vulnerability was discovered in libgd2, a library for programmatic graphics creation and manipulation, which may result in denial of service or potentially the execution of arbitrary code if a malformed GIF file is processed...

Updated aom packages fix security vulnerabilities

Heap buffer overflow in av1 encoder first-pass stats buffer via lap mode. CVE-2026-56208 Arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack. CVE-2026-56209 Heap-buffer-overflow read via missing bounds check in ctrlsetlayerid. CVE-2026-56210 Remote code executi...

Updated cockpit packages fix a security vulnerability

Cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in sendloginhtml. CVE-2026-76235...

Updated packagekit packages fix a security vulnerability

PackageKit API pk-transaction.c gfiletest improper authorization. CVE-2026-10294...

Updated perl-Authen-SASL packages fix a security vulnerability

Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in serverstep. CVE-2026-86219...

Updated libssh2 packages fix security vulnerabilities

Double-Free Heap Corruption via sftpopen. CVE-2026-66032 Integer Underflow DoS via AES-GCM Cipher Negotiation. CVE-2026-66033 Heap Buffer Overflow via ETM Cipher Negotiation. CVE-2026-66035...

Updated tar packages fix security vulnerabilities

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. CVE-2025-45582 Tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape. CVE-2026-18477 Tar: --one-top-level hardlink targets not confined to...

Updated bzip2 packages fix a security vulnerability

Off-by-One Leading to Out-of-Bounds Write in bzip2. CVE-2026-42250...

Updated perl-HTML-FormFu packages fix a security vulnerability

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. CVE-2026-19873...

Updated libcupsfilters & cups-filters packages fix security vulnerabilities

cpu exhaustion via infinite loop in cfieee1284normalizemakemodel. CVE-2026-64611 cups image filter process abort via malformed png. CVE-2026-64612...

Updated unzip packages fix security vulnerabilities

Vulnerabilities were discovered in the Info-ZIP unzip program, which could result in the execution of arbitrary code if a specially crafted file is processed...

Updated zip packages fix a security vulnerability

zip test option -T command injection. Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service invalid free and application crash or possibly have unspecified other impact because of an off-by-one error. CVE-2018-13410...

Updated bind package fixes a security vulnerability

It was discovered that Bind incorrectly handled DNSSEC validation when a domain was covered by both NSEC and NSEC3 records with only one type having an RRSIG. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service CVE-2026-13204...

Updated ffmpeg package fixes security vulnerabilities

Out-of-Bounds Write in RASC Decoder decodedlta. CVE-2026-58049 Heap Buffer Overflow via VobSub Subtitle Demuxer. CVE-2026-64830 Double-Free in NVDEC Hardware Decoder via nvdec.c. CVE-2026-64832 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c. CVE-2026-64833 Infinite Loop DoS via RTP/ASF Demuxer...

Updated xz packages fix security vulnerabilities

XZ Utils: Invalid write if a decoder is reinitialized after allocation failure...

Updated librabbitmq packages fix security vulnerabilities

amqpdecodebytes sizet integer overflow bypasses bounds check on 32-bit OOB read. CVE-2026-59986 Heap Buffer Overflow in amqpsendframe When Serializing Oversized AMQPFRAMEBODY. CVE-2026-61547...

Updated java-21-openjdk & java-17-openjdk packages fix security vulnerabilities

Enhance TLS certificate handling. CVE-2026-46968 Improve DTLS handshaking. CVE-2026-46917 Enhance JPEG handling. CVE-2026-47010 Enhance XBM image support. CVE-2026-47021 Enhance Jar file processing. CVE-2026-47027 Improve certification checking. CVE-2026-60147 Enhance AWT ImagingLib. CVE-2026-470...

Updated perl-Catalyst-Plugin-Static-Simple packages fix a security vulnerability

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable...

Updated perl-Imager packages fix a security vulnerability

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags...