CVE-2026-12345 is a medium severity vulnerability in the Python Software Foundation's CPython implementation, specifically affecting Red Hat Hardened Images RPM packages for python3.12. The vulnerability is identified with CWE-59 and has a CVSS 4.0 base score of 5.9. Red Hat has released updated RPM packages (version 3.12.15-1.hum1) for multiple python3.12 components on aarch64 and x86_64 architectures to address this issue. No known exploits are reported in the wild. The vendor advisory provides updated packages but does not explicitly state a fix for the CVE, so patch status should be confirmed via the vendor links.
A security vulnerability identified as CVE-2026-101903 affects the node-axios package versions including 0.19.0+dfsg-2 through 1.19.0-1 and several others. The issue involves the RFC 2397 regular expression allowing slash characters on both sides of the media-type separator. Red Hat has issued an advisory for Red Hat Hardened Images RPMs, including updates to the grafana12.4 package, which addresses this vulnerability among others. The advisory directs users to update via Red Hat's image repository. No explicit patch version ranges for node-axios are provided in the advisory.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing multiple vulnerabilities in the grafana13.2 package, including CVE-2026-63209. The update includes version 13.2.1-0.8.hum1 for aarch64 and x86_64 architectures. No explicit patch or fix details are provided in the advisory. The vulnerabilities are considered high severity.
wolfSSL versions 5.7.2 through 5.9.2 have a client-side flaw in the implementation of RFC 6961 multiple OCSP response stapling. This flaw allows clients using specific OCSP stapling features to accept unauthorized certificates as valid certificate authorities. An attacker with a certificate chaining to a trusted CA and its private key can forge certificates for arbitrary identities, which are then stored persistently and affect future connections.
A vulnerability in wolfSSL versions v5.3.0 through v5.9.2 affects TLS 1.2 and below session cache handling when NO_SESSION_CACHE_REF and related options are undefined. The function wolfSSL_get_session() returns a ClientSession reference that can be manipulated by an attacker due to insufficient validation. This allows session resumption without proper certificate verification, enabling an attacker to impersonate the original server for resumed connections. The issue is addressed by adding a per-write generation counter to the cache and increasing the cache version to reject poisoned cache entries.
A new variant of the PamStealer malware targets macOS users by masquerading as a fake Wavel cryptocurrency wallet application. It uses a complex server-side decryption process involving a custom utility and live ECIES key exchange, preventing offline payload decryption. The malware, rewritten in Swift, steals credentials from seventeen browsers, extracts keychain data, collects system fingerprints, and harvests user files including shell history and account photos. It maintains persistence through multiple redundant mechanisms and suppresses notifications by terminating background task management processes.
A security update for webkit2gtk3 on Red Hat Enterprise Linux 9 addresses multiple vulnerabilities in the ANGLE component used by chromium-browser. These include out-of-bounds memory access, heap buffer overflows, use-after-free, integer overflows, type confusion, and insufficient validation of untrusted input. The update is rated as important by Red Hat Product Security and fixes numerous CVEs affecting ANGLE. The vulnerabilities could potentially lead to memory corruption and other security issues.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the jaeger package to version 2.20.0-0.9.hum1. This update addresses the security vulnerability identified as CVE-2026-81871. The advisory does not provide detailed technical information about the vulnerability or its exploitation but categorizes it with medium severity.
Red Hat has issued a security advisory for its Hardened Images RPMs, specifically updating multiple python3.13 packages to address several vulnerabilities including CVE-2026-82049. The update provides security fixes for these RPMs on aarch64 and x86_64 architectures. No explicit patch version ranges are provided in the advisory. The severity of the vulnerabilities addressed is high.
A vulnerability in the buildah/copier Go package allows a non-root user, when using the package outside of Buildah, to craft a tar archive with malicious symlinks that can escape the intended extraction directory and create files outside the target location. Buildah itself is not affected due to its use of chroot hardening. The issue has a medium severity rating and a CVSS score of 4.5.