.NET 8.0 on Red Hat Enterprise Linux 9.6 has received an important security update addressing two vulnerabilities: an out-of-bounds write in the Google Brotli decoder (CVE-2026-111497) and an elevation of privilege vulnerability in ASP.NET Core affecting multiple .NET versions (CVE-2026-114148). These issues could allow attackers to cause memory corruption or escalate privileges. Red Hat has released updated packages for these components as part of the 9.6 Extended Update Support. Users should apply the provided updates to mitigate these vulnerabilities.
CVE-2026-120347 is a SQL injection vulnerability in dayrui XunRuiCMS versions 4.7.0 through 4.7.4. The flaw exists in the View function of the Member Module component, specifically in the file dayrui/Fcms/Core/View.php. An attacker can remotely manipulate the 'catid' argument to execute SQL injection. Public exploit code has been disclosed. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9.
Multiple security vulnerabilities have been identified and fixed in the nginx web and proxy server as part of a Red Hat security advisory. These include arbitrary code execution, denial of service, heap-based buffer overflow, heap buffer over-read, and memory disclosure issues affecting various nginx modules such as ngx_http_rewrite_module, HTTP/2 header processing, and ngx_http_slice_module. The advisory pertains to Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. The update addresses critical security flaws that could allow attackers to execute code or disrupt service.
.NET 9.0 on Red Hat Enterprise Linux 9.6 contains an elevation of privilege vulnerability in ASP.NET Core identified as CVE-2026-114148. This security issue allows an attacker to gain higher privileges than intended. Red Hat has released an important security update addressing this vulnerability in SDK version 9.0.123 and runtime version 9.0.22. The update is available for multiple Red Hat Enterprise Linux 9.6 variants and related products. Users should apply the update to mitigate the risk.
CVE-2026-120345 is a critical OS command injection vulnerability in the WAVLINK WN551X3-A device. It affects the DNS Resolution Handler component, specifically the sub_41a430 function in the /bin/ioos file. The vulnerability allows remote attackers to manipulate argument data to execute arbitrary OS commands. Public exploit code exists, increasing the risk of exploitation.
Multiple security vulnerabilities have been identified and fixed in the util-linux package used by Red Hat Enterprise Linux 10. These include time-of-check to time-of-use (TOCTOU) race conditions in the mount program, a heap use-after-free in libblkid nested partition probing, privilege bypasses, information leaks, and an integer overflow in the DOS partition parser. The issues affect critical low-level system utilities necessary for Linux system operation.
Multiple security vulnerabilities were identified in the curl and libcurl components provided by Red Hat Enterprise Linux 9.6 Extended Update Support. These include authentication bypasses, information disclosure through OAuth2 token leakage and Digest authentication header reuse, man-in-the-middle attacks via SSH host key bypass, security feature bypasses due to improper mutual TLS connection reuse, insecure TLS connection establishment, unauthorized connection reuse, cookie injection via malicious HTTP servers, and proxy authentication state leakage. Red Hat has issued an important security update addressing these issues.
Multiple security vulnerabilities have been identified in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include denial of service conditions via crafted commands and out-of-bounds reads, as well as remote code execution through heap buffer overflows and uninitialized heap memory disclosure. The vulnerabilities affect Red Hat Enterprise Linux 8.8 variants and have been rated with an important security impact by Red Hat. Updates addressing these issues are available.
CVE-2026-120344 is a critical OS command injection vulnerability in the WAVLINK WN551X3-A device's WireGuard CLI Group Handler component. The flaw exists in the system function of the /bin/ioos file, where manipulation of the group_name argument allows remote attackers to execute arbitrary OS commands. The vulnerability has a CVSS 4.0 base score of 10.0, indicating maximum severity. Public exploit code has been disclosed, but no official patch or remediation information is currently available.
CVE-2026-120343 is a cross-site scripting (XSS) vulnerability in the mathurvishal CloudClassroom-PHP-Project affecting the manageassessment2.php file. The flaw arises from improper handling of the ExamName and question parameters (Q1 to Q5), allowing remote attackers to inject malicious scripts. Exploit code has been published, but no vendor response or patch is currently available. Due to the product's rolling release model, specific affected versions are not identified.
Multiple security vulnerabilities have been identified and fixed in Apache Tomcat as distributed by Red Hat Enterprise Linux 9.8. These include security constraint bypass, access control bypass due to an off-by-one error, improper input validation allowing HTTP/2 no-authority bypass of strict SNI validation, improper authentication from principal lookup failure, authentication bypass via replay attack in DIGEST authenticator, unauthorized resource access via FORM authentication bypass, and denial of service via HTTP/2 allocation leak. Red Hat has released updated packages addressing these issues for various architectures and product variants.
CVE-2026-120342 is a SQL injection vulnerability in the mathurvishal CloudClassroom-PHP-Project. The flaw exists in an unknown function within the file viewquery.php, where manipulation of the 'eid' argument allows remote attackers to execute SQL injection attacks. Exploit code is publicly available. The product uses a rolling release model, so specific affected or fixed versions are not provided. The vendor did not respond to early disclosure attempts.
CVE-2026-120341 is a security vulnerability in the mathurvishal CloudClassroom-PHP-Project affecting an unknown function within studentdetails.php. The flaw allows execution after a redirect, which can be exploited remotely without authentication. The vulnerability has been publicly disclosed, but no vendor response or patch information is available. The product uses a rolling release model, so specific affected or fixed versions are not provided.
A moderate security vulnerability (CVE-2025-11395) exists in the podman tool used for managing container pods and images. The flaw allows arbitrary file write during the import of an OCI archive. This vulnerability affects Red Hat Enterprise Linux 10 and related products. A security update addressing this issue is available from Red Hat.
CVE-2026-120340 is a session expiration vulnerability in the Global Session Handler component of the mathurvishal CloudClassroom-PHP-Project. The issue can be exploited remotely but requires high attack complexity and no user interaction. Exploit code is publicly available. The product uses a rolling release model, so no specific affected versions are identified. The vendor has not responded to the disclosure.
A security update for the Linux kernel in Red Hat Enterprise Linux 8 addresses multiple vulnerabilities including use-after-free bugs, improper pointer refreshes in IPv6 extension headers, privilege escalation, and input validation issues. The update fixes several CVEs such as CVE-2026-63922, CVE-2026-63924, CVE-2026-64109, CVE-2026-72083, CVE-2026-74283, and CVE-2026-93787. The kernel is a critical component of the operating system, and these fixes improve overall system security. Red Hat recommends applying the update and rebooting the system to ensure protection.
A stack overflow vulnerability (CVE-2026-14330) was identified in the Pulse Server component of PipeWire, a multimedia server for Linux and Unix-like systems. Red Hat has issued a security advisory for this vulnerability affecting Red Hat Enterprise Linux 10 and related variants. The vulnerability is rated as moderate in severity. An update to PipeWire is available to address this issue.
CVE-2026-120339 is a cross-site scripting (XSS) vulnerability in the mathurvishal CloudClassroom-PHP-Project. The flaw exists in the updatedetailsfromfaculty.php file, where manipulation of the fname argument can lead to XSS attacks. The vulnerability can be exploited remotely and public exploit code is available. The product uses a rolling release model, so specific affected versions are not identified. The vendor has not responded to the disclosure. The CVSS 4.0 score is 5.3, indicating a medium severity risk.