Live threat intelligence radar

A heap-based buffer overflow vulnerability in raptor2's language tag handling can lead to arbitrary code execution. This issue affects versions of raptor2 prior to 2.0.15-18.el8_10. A security update fixing this vulnerability is available from Red Hat.

Cockpit is a web-based interface for administering GNU/Linux servers. A security update addresses multiple vulnerabilities including an unauthenticated remote memory leak via the CockpitLang cookie in the send_login_html function (CVE-2026-76235). This issue could allow an attacker to leak memory remotely without authentication. The update fixes this vulnerability in version 356.4-1.el9_8 and later.

Multiple security vulnerabilities have been identified in GIMP, including heap buffer overflow, heap out-of-bounds read/write, and use-after-free conditions in various image loaders such as DDS, PSD, and XCF. These flaws could be triggered by processing crafted image files. An update fixing these issues is available for Red Hat Enterprise Linux 9.8 Extended Update Support.

CVE-2026-44405 is a low-severity vulnerability in the Robot Framework's use of Paramiko's rsakey.py module, which allows the deprecated SHA-1 algorithm. This affects versions of Robot Framework prior to 7.4.2_2. The vulnerability has been fixed in version 7.4.2_2.

A local privilege escalation vulnerability exists in the qemu-guest-agent component of qemu-kvm due to a symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080). This issue allows a local attacker within the guest to escalate privileges. The vulnerability affects versions of qemu-guest-agent prior to 17:10.1.0-17.el9_8.9.alma.1. A patch is available in this fixed version. Additional bug fixes and enhancements are included in the update.

AnyIO's process-pool workers have a vulnerability where stderr is connected to a pipe that is never drained. This can cause the pipe to fill and block indefinitely if the worker writes enough data to stderr, leading to a deadlock. The issue affects versions from 0.13.1 up to but not including 0.32. A fix is available in version 0.32. Closing sys.stderr in the target function can serve as a workaround to prevent deadlock.

AnyIO versions from 0.13.1 up to but not including 0.32 are vulnerable to a TLS certificate spoofing issue due to the use of IDNA 2003 host name encoding in TLSStream. This allows an attacker who hijacks and redirects a TLS connection to present a legitimate certificate encoded with IDNA 2003, which the client will validate successfully. The vulnerability is critical with a CVSS 4.0 score of 9.3. A fix is available in version 0.32, and a workaround is to encode host names using the 'idna' package before connecting.