A memory exhaustion vulnerability exists in heifer-isobmff when parsing crafted HEIF/HEIC files with a maliciously large number of item and extent counts in the iloc box. This can cause excessive memory allocation leading to process aborts. The issue affects all versions prior to 0.3.27 and was fixed by bounding counts and rejecting invalid extents.
A vulnerability in the heifer-hevc-dec Rust crate allows a crafted HEVC stream to cause a panic during decoding by redefining tile layouts that do not match the active sequence parameter set (SPS). This leads to an out-of-bounds indexing panic, aborting the decoding thread or process. The issue is fixed in version 0.3.27 by rejecting invalid tile layouts at decode time.
Multiple vulnerabilities have been identified in IBM QRadar Security Information and Event Management (SIEM) software. These vulnerabilities affect versions prior to and including 7.6.0.6. A fix is available in version 7.6.0.6.
A vulnerability in the rsync tool, used for synchronizing files and directories, has been identified that allows for a denial of service (DoS) condition. The issue is documented as CVE-2026-119741 and was published on November 3, 2026. No specific affected versions or detailed technical information are provided.
Multiple vulnerabilities have been identified in IBM WebSphere Application Server Liberty, a lightweight, dynamic application server for Java applications and microservices. These issues affect versions prior to and including 26.0.0.12. A fix is available in version 26.0.0.12.
A vulnerability in IBM Storage Scale allows bypassing security measures. IBM Storage Scale is a solution for managing large unstructured data sets, running on a dedicated hardware platform. The issue affects versions prior to 5.2.3.9, with the fix implemented in version 5.2.3.9.
A vulnerability has been identified in IBM i, an operating system for IBM Power Systems servers. The flaw allows bypassing security measures and can lead to denial of service conditions. No specific affected versions or detailed technical information are provided.
A security vulnerability (CVE-2026-32597) in the PyJWT library used in Red Hat Enterprise Linux allows acceptance of unknown 'crit' header extensions, violating RFC 7515 requirements. This flaw could enable bypassing of security controls. Red Hat has released security updates for multiple RHEL 8.4 and 8.8 variants to address this issue.
SQLite versions prior to 3.54.0 have a vulnerability where opening a database file alongside a write-ahead-log file with a differing page size can cause queries to return uninitialized page-cache memory, potentially leaking stale process memory. The Rust crate libsqlite3-sys, when built with its bundled SQLite source between versions 0.6.0 and before 0.39.0, is affected due to bundling vulnerable SQLite versions. The issue requires local access and crafted files. The vulnerability is fixed in libsqlite3-sys version 0.39.0, which bundles SQLite 3.54.0.
Multiple vulnerabilities affecting the Skia component used in Chromium-based browsers such as Google Chrome and Microsoft Edge have been identified. These include use-after-free, information disclosure, improper input validation, memory corruption, integer overflow, and out-of-bounds read issues. The vulnerabilities are addressed in a security update for the webkit2gtk3 package on Red Hat Enterprise Linux 9. The update mitigates risks related to cross-origin data disclosure and memory corruption in the Skia graphics library used by these browsers.
Multiple denial of service vulnerabilities have been identified in the Pillow library used in Red Hat Enterprise Linux 8. These issues include unbounded recursion, double free, null pointer dereference, infinite loops, and out-of-bounds memory access triggered by crafted image or PDF files. Red Hat has released security updates addressing these flaws.
A security advisory from Red Hat addresses multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.1.9, which is based on the WildFly application runtime. The update fixes issues including information disclosure via CORS header overwrite, denial of service via uncontrolled form parameters, authentication bypass via crafted OIDC tokens, and XML External Entity (XXE) vulnerabilities in Apache CXF components. These vulnerabilities could allow attackers to bypass security controls, cause denial of service, or disclose sensitive information. The advisory rates the update as important and provides fixes in version 8.1.9.
Multiple high-impact security vulnerabilities have been identified and fixed in Mozilla Firefox, Firefox ESR, and Thunderbird. These include issues such as sandbox escapes, use-after-free bugs, privilege escalations, information disclosures, and incorrect boundary conditions across various components like DOM, JavaScript engine, graphics, networking, audio/video, and WebRTC signaling. The vulnerabilities were addressed in Firefox version 159.
Multiple security vulnerabilities affecting the Skia component used in the chromium-browser (Google Chrome) have been identified and addressed. These include use-after-free, cross-origin data disclosure, information disclosure, uninitialized resource usage, integer overflow, out-of-bounds read, memory corruption, and improper input validation issues. The vulnerabilities are addressed in a security update for webkit2gtk3 provided by Red Hat for Red Hat Enterprise Linux 9 and related distributions.
A vulnerability has been identified in IBM i, an operating system for IBM Power Systems Servers used in business applications. The flaw allows for information disclosure. No specific affected versions or detailed technical information are provided.
Multiple vulnerabilities have been identified in Python versions distributed as Red Hat Hardened Images RPMs. These vulnerabilities are tracked under CVE-2026-103995, CVE-2026-114583, and CVE-2026-115557. Red Hat has released updated packages for Python 3.14 and 3.15 to address these issues. The advisories do not specify the exact nature or impact of the vulnerabilities but provide updated RPM packages for affected architectures. No exploits in the wild have been reported.
Multiple vulnerabilities in Libreswan on Red Hat Enterprise Linux 10 allow denial of service conditions. These include a denial of service via bogus X.509 certificates, a use-after-free bug in IKEv2 over TCP, and a null pointer dereference in PKCS#7 bundles without certificates. An update addressing these issues is available from Red Hat.
Multiple vulnerabilities have been identified in IBM App Connect Enterprise, a product that integrates IBM Integration Bus technologies with cloud-native features. These vulnerabilities affect versions prior to and including 13.0.9.0. A fix is available in version 13.0.9.0.
A critical security vulnerability (CVE-2026-114406) affects the ca-certificates package in Red Hat Enterprise Linux 10. The issue involves distrusting eMudhra intermediate CA certificates due to security concerns, which could allow bypassing security measures relying on these certificates. Red Hat has released an update to address this vulnerability across multiple architectures and support lifecycles.
A vulnerability in rsyslog, an advanced multithreaded syslog daemon, has been identified that allows manipulation of files. The product supports features such as MySQL, syslog/TCP, RFC 3195, permitted sender lists, message filtering, and fine-grained output control. No specific affected versions or CVSS score are provided.