Live threat intelligence radar

Multiple security vulnerabilities have been identified in GIMP 2.8, including out-of-bounds writes and integer overflows in various plugins and file loaders. These flaws could lead to memory corruption issues such as heap-based buffer overflows when processing crafted preset files or image files. Red Hat has issued an important security update for GIMP 2.8 on Red Hat Enterprise Linux 8 to address these issues.

A vulnerability (CVE-2026-76151) exists in the QtNetwork module of the Qt Framework used in Red Hat Hardened Images. It is an out-of-bounds read flaw triggered by processing an excessively large HTTP Cache-Control header from a remote server, causing a denial of service (application crash). This affects only client-side applications using QNetworkAccessManager and does not allow information disclosure or code execution. Red Hat Enterprise Linux 8 and 9 are not affected as they use Qt 5, which lacks the vulnerable code. A security update with fixed RPM packages is available.

A vulnerability in the Qt XML component (QDom) allows improper output neutralization during serialization of comments, CDATA, and processing instructions. This flaw can enable an attacker to inject arbitrary XML markup, potentially compromising data integrity. The issue is addressed in updated Red Hat Hardened Images RPM packages for qt6-qtbase.

Multiple security vulnerabilities have been identified and fixed in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include denial of service and remote code execution issues caused by heap buffer overflows, out-of-bounds reads, and uninitialized memory disclosures. The vulnerabilities affect the xfreerdp client and related components. Red Hat has issued an important security update for FreeRDP in Red Hat Enterprise Linux 9 to address these issues.

The local-commander-agent npm package version 0.3.52 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.

Multiple critical security vulnerabilities affecting the ANGLE component used in Chromium-based browsers, including Google Chrome, have been addressed in a webkit2gtk3 update for Red Hat Enterprise Linux 8. These vulnerabilities include arbitrary code execution, information disclosure, use-after-free, buffer overflow, improper input validation, and uninitialized resource issues. The update also fixes a regression affecting Eclipse IDE WebKit-based views on CentOS Stream 9.

This Red Hat security advisory addresses two vulnerabilities in Ruby 2.5 and related gems. The first vulnerability (CVE-2026-80212) affects the resolv gem, allowing denial of service via uncontrolled memory growth from crafted DNS responses. The second vulnerability (CVE-2026-88030) affects the rubygem-mongo MongoDB Ruby driver, enabling data disclosure and denial of service through query-operator injection. Red Hat has released updates for Ruby 2.5 modules on Red Hat Enterprise Linux 8 to remediate these issues.