Multiple vulnerabilities were discovered in libvips affecting various Ubuntu LTS releases. These include incorrect handling of PDF files, integer overflows in image dimension calculations, improper validation of EXIF tags, and errors processing TIFF, Radiance, and PPM images. The issues could lead to denial of service, information disclosure, or potentially arbitrary code execution. Fixes are available in updated libvips package versions for affected Ubuntu releases.
A vulnerability in SOGo was discovered where the client-supplied Origin header was used when constructing password reset links. This flaw could allow a remote attacker to obtain password reset tokens and potentially take over user accounts. The issue affects certain versions of SOGo and has been fixed in version 5.12.4-1.2ubuntu0.1~esm2. Users are advised to update to the fixed version and restart the SOGo service to apply the patch.
Relax-and-Recover (rear) versions prior to certain patched releases create a world-readable initrd when GRUB_RESCUE is enabled. This misconfiguration could allow a local attacker to access sensitive information. Fixes are available in updated package versions for Ubuntu 18.04 LTS, 20.04 LTS, and 22.04 LTS.
Net::EasyTCP, a Perl module for creating TCP/IP clients and servers, used the built-in Perl rand() function to generate encryption keys when no strong randomization module was present. This weak randomization could allow an attacker to predict encryption keys and potentially obtain sensitive information. The issue affects multiple Ubuntu LTS releases and has been fixed in updated package versions.
A critical security advisory from Red Hat addresses multiple vulnerabilities in GuideLLM 3.5.1, particularly focusing on CVE-2026-104851, which involves arbitrary code execution via unrestricted template evaluation in the ReferenceFileSystem component of fsspec. This flaw allows a remote attacker to execute code by tricking a user or automated service into opening a malicious reference file. The impact is limited to the privileges of the running container or application process, without immediate host-level access. No fixes are currently available for these vulnerabilities in the affected products, including Red Hat OpenShift AI.
Multiple vulnerabilities were discovered in the Ruby Rack webserver interface affecting header parsing, regular expressions, static file handling, and resource consumption. These issues could allow attackers to bypass security filters, cause denial of service through excessive CPU or disk usage, manipulate header values, exfiltrate data, disclose deployment details, or poison generated links. The vulnerabilities are addressed in the updated package version 3.2.4-1ubuntu1.1.
Multiple security vulnerabilities have been identified in the Cockpit web-based server administration tool used in Red Hat Enterprise Linux 9. These include denial of service issues due to URL-root handling and unbounded connection thread spawning, as well as an unauthenticated remote memory leak via the CockpitLang cookie. Red Hat has issued an important security advisory with updates to address these issues.
Red Hat has issued a security advisory for an update to Red Hat Hardened Images RPMs, including multiple java-25-openjdk packages. The update addresses various security issues identified by numerous CVEs. The advisory provides updated RPM versions for different architectures but does not specify affected versions or detailed vulnerability descriptions. No known exploits in the wild have been reported. The update is classified with medium severity.
Multiple vulnerabilities were discovered in libsoup2.4 and libsoup3 affecting various Ubuntu LTS and interim releases. These issues involve incorrect handling of WebSocket frames, data URIs, HTTP requests, proxy credentials, multipart messages, and fragmented or compressed WebSocket messages. Remote attackers could exploit these flaws to cause application crashes or potentially expose sensitive information. The vulnerabilities affect Ubuntu 16.04 LTS through 26.10 releases. Fixes are available in updated package versions distributed by Ubuntu, including Ubuntu Pro Extended Security Maintenance (ESM) updates.
Red Hat Edge Manager (RHEM) version 1.2.2 addresses multiple security vulnerabilities affecting the management of edge devices and applications. RHEM supports image-mode RHEL and container workloads on Podman/Docker or Kubernetes and is available standalone or as a plugin for Red Hat Advanced Cluster Management and Ansible Automation Platform. The update aims to enhance secure lifecycle management of edge devices from onboarding to decommissioning. No specific fixed versions are stated in the advisory. The vulnerabilities are rated as high severity.
Multiple vulnerabilities were discovered in PCRE2 affecting various Ubuntu LTS and interim releases. These issues include improper memory management, incorrect processing of certain patterns, and exposure of uninitialized data. The vulnerabilities could allow attackers to execute arbitrary code, cause denial of service, or obtain sensitive information. The affected Ubuntu versions range from 16.04 LTS through 26.10. Fixes have been released for all affected versions.
CVE-2026-56860 is a denial of service vulnerability in the Go net/url package used by LVMS 4.19. It arises from inefficient handling of relative paths containing multiple parent directory segments ('..'), leading to quadratic time complexity and excessive memory use. This flaw can be exploited remotely by providing crafted paths, causing resource exhaustion and service unavailability. Red Hat has addressed this issue by updating the Golang version in LVMS 4.19. Users are advised to upgrade to the latest OpenShift Container Platform version containing the fix.
Red Hat has released a critical security update for Red Hat OpenShift GitOps version 1.22.3 addressing multiple issues including malformed version strings in the Argo Rollouts controller and image updater inconsistencies. The update fixes several CVEs including CVE-2026-56855. Users are advised to apply this update after ensuring all previous errata are applied.
Red Hat has released a critical security update for Red Hat OpenShift GitOps version 1.21.7 addressing multiple vulnerabilities including CVE-2026-75838. The update fixes issues such as malformed version strings in the Argo Rollouts controller and other security flaws identified by CWEs 79, 125, and 295. Users are advised to apply this update after ensuring all prior relevant errata are installed.
A denial of service vulnerability exists in the klauspost compress library's Zstandard (zstd) decompression implementation used by Red Hat OpenShift distributed tracing platform (Tempo). A remote attacker can submit a specially crafted zstd compressed stream that triggers an out-of-bounds read due to an integer handling flaw, causing the application to crash. This vulnerability does not involve data confidentiality or integrity impacts but results in service disruption. The issue is addressed in klauspost/compress version 1.20.2 and corresponding Red Hat builds.
A vulnerability in libmspack was found where pointers were not properly initialized when handling errors in KWAJ archive headers. This flaw could allow an attacker to cause a denial of service by crashing libmspack or potentially execute arbitrary code. Fixed versions are available for multiple Ubuntu releases.
Two vulnerabilities in HAProxy were discovered involving improper handling of truncated HTTP/2 PING frames and certain HTTP/1.1 chunked requests. These issues could allow a remote attacker to cause HAProxy to consume excessive CPU resources, resulting in denial of service conditions. The vulnerabilities affect multiple Ubuntu package versions and have been addressed in updated package releases.
A vulnerability in the Go crypto/x509 package used by the Zero Trust Workload Identity Manager for Red Hat OpenShift allows improper certificate validation. This flaw causes the certificate verification process to trust intermediate certificates associated with compromised Certificate Authorities, enabling potential man-in-the-middle attacks. The vulnerability affects Go-based clients or servers relying on standard TLS certificate verification. Exploitation requires network positioning and use of certificates from untrusted intermediates. The vulnerability is rated Important by Red Hat with a CVSS base score of 6.8. No fix has been released yet, and mitigation involves applying previously released errata and managing operator upgrade policies.