XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.
Security Fix(es):
* xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix(es):
* bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616)
* flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275)
* flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280)
* flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808)
* flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
* flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.
Security Fix(es):
* openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing (CVE-2026-35189)
* openssl: openssl: Denial of Service via excessive QUIC packet buffer retention (CVE-2026-54873)
* openssl: openssl: Denial of Service via crafted CMP certificate revocation response (CVE-2026-75805)
* openssl: openssl: Denial of Service via inefficient QUIC stream reassembly (CVE-2026-42772)
* openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations (CVE-2026-54872)
* openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control (CVE-2026-75804)
* openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V (CVE-2026-54875)
* openssl: openssl: Traffic amplification Denial of Service via QUIC packet over-accounting (CVE-2026-35191)
* openssl: OpenSSL: Private key recovery via SM2 timing side-channel (CVE-2026-77696)
* openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch (CVE-2026-72897)
* openssl: OpenSSL: Denial of Service via undersized DTLS record (CVE-2026-75806)
* openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog (CVE-2026-84784)
Bug Fix(es) and Enhancement(s):
* [RHEL 9.9] OpenSSL silently uses default provider when `fips.so` is missing on systems in FIPS mode (JIRA:RHEL-239862)
* OpenSSL fails to initialize when automatic initialization happens in threads [RHEL 9] (JIRA:RHEL-256385)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities have been identified in the xorg-x11-server component of Red Hat Enterprise Linux 9. These include several arbitrary code execution flaws, privilege escalation, use-after-free, double-free, out-of-bounds write, and buffer overflow issues. The vulnerabilities affect core graphical system functionality and could allow attackers to execute code or escalate privileges. Red Hat has released security updates addressing these issues.
CVE-2026-124421 is a missing authorization vulnerability in BdThemes ZoloBlocks affecting versions before 2.8.4. It allows unauthorized access due to incorrectly configured access control security levels. The issue is fixed in version 2.8.4.
CVE-2026-124255 is a medium severity vulnerability in Franky Events Made Easy (versions before 3.3.6) involving improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue. This flaw allows code injection via crafted input. The vulnerability is fixed in version 3.3.6.
A denial of service vulnerability (CVE-2026-56860) exists in the golang net/url package used by the runC container runtime tool. The flaw involves quadratic complexity in path resolution, which can be exploited to cause denial of service. Red Hat has issued an important security update for runC in Red Hat Enterprise Linux 9 to address this issue.
The UK National Cyber Security Centre (NCSC) has launched the Cyber Adversary Simulation (CyAS) scheme to help critical organisations rigorously test their cyber defences. The scheme certifies commercial providers who simulate realistic cyber attacks tailored to each organisation's environment, enabling them to assess their ability to prevent, detect, and respond to threats. This initiative supports national cyber resilience by providing trusted services that go beyond traditional penetration testing and audits. It complements existing NCSC frameworks and aids oversight bodies in evaluating sector-wide cyber resilience. The scheme is currently in a Minimum Viable Product phase to refine its approach before full deployment.
Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.
Security Fix(es):
* lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)
* lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)
Bug Fix(es) and Enhancement(s):
* lrzsz: segfault with -s [rhel-9.9.z] (JIRA:RHEL-282118)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries.
Security Fix(es):
* gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if (CVE-2026-102010)
* gcc: libstdc++ integer overflow in `new` operator (CVE-2026-95619)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-124753 is a missing authorization vulnerability in the Ahmad WP Job Portal plugin for WordPress. It affects versions from initial releases up to 2.7.2. The flaw allows attackers with limited privileges to bypass access controls due to incorrectly configured security levels. The vulnerability has a medium severity rating with a CVSS score of 4.3. A fix is available in version 2.8.0.
The gcc-toolset-16-gcc13 package contains the GNU Compiler Collection version 16.
Security Fix(es):
* gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if (CVE-2026-102010)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 5.9.11.
CVE-2026-125437 is a missing authorization vulnerability in NSquared Simply Schedule Appointments affecting versions prior to 1.6.13.4. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to certain functions. The issue has a medium severity with a CVSS score of 5.3 and is fixed in version 1.6.13.4.
The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.
Security Fix(es):
* librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-121028 is a medium severity vulnerability in the WP Chill Strong Testimonials plugin that allows code injection via improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) flaw. This affects versions from initial release up to 3.3.17. The issue is fixed in version 3.3.18.
A security update for the Ignition utility in Red Hat Enterprise Linux 9 addresses a vulnerability in the golang crypto/x509 package that could allow man-in-the-middle attacks via untrusted intermediate certificates. Ignition is used during system initialization to configure disks, files, and users based on remote or local configuration sources. The update fixes CVE-2026-111943 to prevent exploitation of this certificate validation flaw.