Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)
Security Fix(es):
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.(CVE-2026-112893)
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining dest_length without a per-branch cap. A delta can add roughly 255 image rows in one iteration, so a kilobyte-sized file with a large but permitted width can expand the data bytearray to hundreds of megabytes or more, causing memory-exhaustion denial of service. This issue is fixed in version 13.0.0.(CVE-2026-96638)
CVE-2026-126663 is a path traversal vulnerability in Contao versions 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6. It allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag by exploiting incorrect validation order of paths. Attackers can use percent-encoded sequences to bypass the Validator::isInsecurePath() check, causing the frontend to serve files outside the intended directory.
CVE-2026-126662 is an access control bypass vulnerability in Contao versions 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6. It allows filemount-restricted backend users with certain permissions to modify folders outside their authorized filemount via the file manager's Edit-Multiple operation. This can lead to publishing protected folders or excluding them from synchronization, potentially exposing files for public download.
BlueprintUE Self-Hosted Edition versions 1.0.0 through before 4.3.5 contain a resource exhaustion vulnerability. Unauthenticated attackers can repeatedly create anonymous blueprints with a 'never' expiration, bypassing automatic purges. This allows attackers to fill server storage, leading to denial of service. The vulnerability is fixed in version 4.3.5.
ByteStash versions 1.5.10 through before 1.6.2 have a vulnerability where API keys remain valid even after the associated user account is deactivated. This occurs because the validateApiKey function does not verify the account status, allowing continued access to API endpoints for snippet management and MCP tools.
Finite State, a product security firm, raised $27 million in a Series C funding round to expand its international presence and enhance its autonomous device security platform. The platform inspects compiled firmware and binaries to identify known and zero-day vulnerabilities in connected devices, helping manufacturers in sectors like automotive, medical, industrial, consumer electronics, and utilities. It also supports compliance with regulations such as the EU Cyber Resilience Act, FDA premarket cybersecurity requirements, UNECE vehicle regulations, and IEC 62443. The investment is driven by increased discovery of critical vulnerabilities and growing regulatory mandates. AI agents automate analysis, triage, testing, and regulatory reporting within the platform.
Red Hat has released a security update for python3.9 addressing multiple vulnerabilities including arbitrary file deletion via a race condition during temporary directory cleanup, certificate verification bypass due to missing server_hostname validation in SSLContext.wrap_bio(), use-after-free in server-side SSLContext when sni_callback switches contexts, and arbitrary file write via tarfile extraction filter bypass. These issues affect Red Hat Enterprise Linux 9 and related products. The update is rated as having a moderate security impact.
Multiple security vulnerabilities have been identified and fixed in Grafana and related Golang components as part of a Red Hat security advisory. These include privilege escalation, unauthorized access, denial of service, cross-site scripting, code execution via plugin archive extraction, and man-in-the-middle attacks. The advisory covers a range of CVEs affecting Grafana and Golang libraries used within the product. Red Hat Enterprise Linux 9 packages have been updated to address these issues.
A heap-based buffer overflow vulnerability exists in the raptor2 RDF Parser Toolkit used in Red Hat Enterprise Linux 9. This flaw occurs in the handling of language tags and can lead to arbitrary code execution. Red Hat has issued a security update to address this issue in raptor2 version 2.0.15-32.el9_9.1. The vulnerability is rated as having an important security impact by Red Hat Product Security.
Two denial of service vulnerabilities have been identified in the Qt software toolkit's qt5-qtbase and qt6-qtbase packages related to XML serialization and parsing. These issues could allow an attacker to cause a denial of service via uncontrolled recursion during XML processing. Red Hat has issued a security advisory for Red Hat Enterprise Linux 9 with updates addressing these vulnerabilities.
GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment.
Security Fix(es):
* gnome-remote-desktop: Busy-Wait DoS in VNC TLS I/O Handlers (GNUTLS_E_AGAIN / GNUTLS_E_INTERRUPTED) (CVE-2026-109832)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
* freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling (CVE-2026-109242)
* freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding (CVE-2026-110837)
* freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication (CVE-2026-111880)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The libsoup packages provide an HTTP client and server library for GNOME.
Security Fix(es):
* SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service (CVE-2026-15709)
* libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denial of service via oversized control frame protocol violation (CVE-2026-15711)
* libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556)
* libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557)
* libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558)
* libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559)
* libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth (CVE-2026-102560)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple denial of service vulnerabilities have been identified in the rhc client tool and daemon used for Red Hat system and subscription management. These issues involve crafted HTTP Range headers, multiple ECH outer extension references in crypto/tls, and excessive HTTP/2 SETTINGS frames. Red Hat has released an important security update addressing these flaws in rhc for Red Hat Enterprise Linux 9 and related products.
The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space.
Security Fix(es):
* dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561)
* dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562)
* dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563)
* dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565)
* dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566)
* dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567)
* dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845)
* dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846)
* dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847)
* dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848)
* dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849)
* dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856)
* dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683)
* dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.
Security Fix(es):
* xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java.
Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive amount of memory, leading to an OutOfMemoryError. A crafted string passed to FrequentLongsSketch.getInstance(String) could also make deserialization, or a later update, loop indefinitely. Only applications that deserialize sketches from untrusted sources are affected.
This issue affects Apache DataSketches Java: through 9.0.0.
Users are recommended to upgrade to version 9.1.0, which fixes the issue.
A concurrency flaw in Keycloak's login-failure storage component affects multi-node deployments using MySQL or MariaDB. Simultaneous failed login attempts for the same user can cause a synchronization error that locks the user's database record, blocking legitimate login attempts and causing failures. Additionally, some failed attempts may not be recorded properly, potentially bypassing brute-force protection.
X.Org X11 libXi runtime library
Security Fix(es):
* libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser (CVE-2026-93543)
* libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply (CVE-2026-109090)
* libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow (CVE-2026-109089)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.