.NET 8.0 received an important security update addressing an out-of-bounds write vulnerability in the Google Brotli decoder (CVE-2026-111497) and an elevation of privilege vulnerability in ASP.NET Core (CVE-2026-114148). The update includes SDK version 8.0.133 and runtime version 8.0.33. These vulnerabilities affect Red Hat Enterprise Linux 8 packages and have been fixed in the specified versions.
.NET 10.0 contains an elevation of privilege vulnerability in ASP.NET Core identified as CVE-2026-114148. This issue affects multiple .NET runtimes including 8.0, 9.0, 10.0, and 11.0. Red Hat has released updates to SDK 10.0.114 and Runtime 10.0.14 to address this vulnerability along with other bug fixes and enhancements. The update is rated as Important by Red Hat Product Security. No public exploits or in-the-wild exploitation have been reported.
Multiple security vulnerabilities have been identified in Apache Tomcat, including a security constraint bypass due to improper access control (CVE-2026-65182) among others. These issues affect versions prior to 1:9.0.121-1.el8_10 and have been addressed in the fixed version 1:9.0.121-1.el8_10. The vulnerabilities include access control bypasses, improper input validation, and authentication bypasses. Red Hat has issued an important security update for affected Red Hat Enterprise Linux 8 distributions to remediate these issues.
This Red Hat Security Advisory addresses multiple security vulnerabilities in Mozilla Firefox, including denial of service, privilege escalation, use-after-free, information disclosure, sandbox escapes, mitigation bypasses, and other memory safety issues. The update also includes bug fixes and enhancements, specifically a Firefox ESR 153 rebase for Red Hat Enterprise Linux 9. The advisory rates the security impact as Important and covers a broad range of components such as XML processing, JavaScript engine, networking, graphics, and sandboxing.
A critical vulnerability (CVE-2026-110264) affects GitLab CE/EE versions from 7.0 up to but not including several fixed releases before 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. This flaw allows an unauthenticated attacker to execute arbitrary code on the GitLab server by exploiting an integer overflow during the compilation of a specially crafted regular expression.
Two denial of service vulnerabilities have been identified in the Qt5 and Qt6 qtbase packages related to XML processing. One vulnerability (CVE-2026-11573) involves uncontrolled recursion during XML serialization, and the other (CVE-2026-19248) involves XML parsing. These flaws could cause applications using the affected Qt libraries to become unresponsive or crash when processing malicious XML data. Red Hat has issued security updates for these vulnerabilities in Red Hat Enterprise Linux 9.8 Extended Update Support and related products.
A security update for the perl-DBI package addresses a denial of service vulnerability caused by an invalid memory read during numeric type casting (CVE-2026-88815). This vulnerability affects the standard database interface module for Perl, which provides a consistent set of methods for database operations. The issue has been rated as important by Red Hat Product Security. The update is available for Red Hat Enterprise Linux 8 across multiple architectures.
A security vulnerability in GEGL (Generic Graphics Library) used by GIMP allows remote code execution via an integer overflow in HDR file parsing. This issue is tracked as CVE-2026-18300 and affects Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat has issued a security advisory with an important severity rating and provided updated packages to address the flaw.
Multiple security vulnerabilities were identified in curl, including issues that could lead to information disclosure, denial of service, arbitrary code execution, and man-in-the-middle attacks. These vulnerabilities affect various curl features such as WebSocket handling, AWS SigV4 authentication, SSH host verification, cookie handling, HTTP proxy authentication, HSTS processing, IMAP command injection, FTP wildcard matching, TFTP transfer direction validation, file overwrite protection, MIME structure processing, and HTTP/2 upload handling. The vulnerabilities were fixed in Ubuntu 26.10 package version 8.20.0-2ubuntu11.1.
Multiple security vulnerabilities have been identified in GIMP 2.8, including out-of-bounds writes and integer overflows in various plugins and file loaders. These flaws could lead to memory corruption issues such as heap-based buffer overflows when processing crafted preset files or image files. Red Hat has issued an important security update for GIMP 2.8 on Red Hat Enterprise Linux 8 to address these issues.
Multiple denial of service vulnerabilities and heap-based buffer overflow issues have been identified in the Wireshark network protocol analyzer. These flaws affect various protocol dissectors including C12.22, RRC, ESS, X.509IF, H.245, and SPDY. The vulnerabilities can cause crashes or memory corruption when processing malformed network traffic. Red Hat has released security updates addressing these issues in Wireshark packages for Red Hat Enterprise Linux 10 and related variants.
Multiple critical vulnerabilities in the ANGLE component of Chromium-browser, as used in WebKitGTK, allow for arbitrary code execution and information disclosure via various memory corruption and input validation flaws. Red Hat has issued a security advisory with updates to webkit2gtk3 for Red Hat Enterprise Linux 9 to address these issues. The update also fixes a regression affecting Eclipse IDE WebKit-based views on CentOS Stream 9.