A security vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol client, allows remote code execution or client crash via a malicious TS Gateway. This issue is tracked as CVE-2026-55193 and affects Red Hat Enterprise Linux 10 and related products. The vulnerability is rated as important by Red Hat Product Security. A security update has been issued to address this flaw.
CVE-2026-13622 is a vulnerability in Kubevirt's virt-handler component (version 3.0) where the migration proxy follows symbolic links, potentially allowing a container to escape to the host system.
A security vulnerability (CVE-2026-73515) in PostGIS, an extension that adds geographic object support to PostgreSQL, allows memory disclosure and denial of service via a malformed FlatGeobuf buffer. This issue affects Red Hat Enterprise Linux 10 with postgresql16-postgis. Red Hat has issued a security update to address this vulnerability.
CVE-2026-56855 is a vulnerability in golang.org/x/crypto/ssh that can cause a denial of service (DoS) due to a deadlocked established channel. It affects versions 3.0 and 4.0 of the Microsoft product using this library. No CVSS score or detailed impact information is provided.
CVE-2026-78662 is a vulnerability in golang.org/x/crypto/ssh version 3.0 that can lead to a denial of service (DoS) condition caused by a deadlocked undecided channel. The issue relates to resource exhaustion or blocking behavior in the SSH library implementation.
CVE-2026-84304 is a vulnerability in gRPC-Go version 3.0 involving heap memory exhaustion caused by HTTP/2 DATA frame fragmentation. This can lead to out-of-memory (OOM) conditions. The vulnerability is categorized under CWE-400, indicating a resource exhaustion issue. There is no CVSS score or detailed impact description available. No patch or remediation information is provided.
A security advisory from Red Hat addresses vulnerabilities in the Composer package manager included in Red Hat Hardened Images RPMs. The key issue involves a flaw in how Composer handles Perforce source URLs, which could allow an attacker to execute arbitrary commands if certain conditions are met. Exploitation requires the Perforce p4 client to be installed and processing of untrusted package metadata or lock files. The advisory rates the severity as important due to the potential for arbitrary code execution within the user or CI context running Composer. The update includes Composer version 2.10.3-1.hum1 and its source RPM. No direct fix versions are explicitly stated for Red Hat products, but the advisory references the updated Composer release that addresses the issue.
A security vulnerability in the Generic Graphics Library (GEGL) used by GIMP allows remote code execution via an integer overflow in HDR file parsing. This issue is tracked as CVE-2026-18300 and affects Red Hat Enterprise Linux 8 across multiple architectures. Red Hat has issued an important security update to address this vulnerability.
A security advisory from Red Hat addresses multiple vulnerabilities in the Red Hat Hardened Images RPMs, specifically in the Valkey component. One notable flaw (CVE-2026-85522) involves an out-of-bounds read in the Slot Migration component's createSlotImportJob function, which can be triggered remotely by manipulating the job_name argument. This vulnerability can cause the Valkey daemon to crash, resulting in a denial of service. The attack surface is limited by the unprivileged service account and SELinux policies, preventing further compromise. Red Hat has released updated RPM packages to fix these issues.
A use-after-free vulnerability exists in the Linux kernel's IPv6 networking code due to a stale pointer in fib6_rule_suppress. This flaw affects Red Hat Enterprise Linux 8.6 kernel packages. Red Hat has released a security update to address this issue and recommends applying the update and rebooting the system. The vulnerability is rated as having an important security impact.
A security update for the Linux kernel in Red Hat Enterprise Linux 9.4 addresses a vulnerability identified as CVE-2026-53016 related to the crypto CCP module's handling of initialization vectors. The update also includes bug fixes and enhancements unrelated to security. Red Hat rates the security impact as moderate and recommends applying the update promptly with a system reboot.
A vulnerability in libgit2's set_data function allows a remote attacker operating a malicious Git server to cause a heap out-of-bounds read. This results in a denial of service (DoS) by crashing client applications that use libgit2 during fetch or clone operations. The issue affects Red Hat Hardened Images RPMs and is rated as having an important impact due to unauthenticated remote exploitation causing client termination without compromising host integrity or sensitive data.
A security vulnerability in the gstreamer1-plugins-base package for Red Hat Enterprise Linux 10 allows arbitrary code execution due to a buffer overflow in OGG file parsing. This issue is identified as CVE-2026-18297 and is rated with an Important security impact by Red Hat. A security update addressing this vulnerability is available for multiple architectures and update streams of Red Hat Enterprise Linux 10.
CVE-2026-17527 is a vulnerability related to the Virt-cdi-operator component of Microsoft software, specifically version 3.0. The vulnerability involves an aggregated cluster role granting create permissions, potentially related to the containerized-data-importer (CDI) in the Kubernetes environment. No CVSS score or detailed impact information is provided.
An infinite loop vulnerability exists in golang.org/x/text when processing invalid input, potentially causing the affected software to become unresponsive. This issue affects versions 3.0 and 4.0 of the product. No CVSS score or detailed impact information is provided, and there is no indication of active exploitation or available patches.
Multiple security vulnerabilities were discovered affecting AMD processors and the Linux kernel subsystems. These include speculative execution data leakage on AMD processors, privilege escalation on AMD Zen 2 processors due to shared resource isolation flaws, and entropy issues in AMD Zen 5 processors affecting the RDSEED instruction. Additionally, numerous flaws across a wide range of Linux kernel subsystems and drivers were identified that could allow attackers to compromise the system. Fixes for these issues have been released in updated Linux kernel versions.