The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.
Security Fix(es):
* librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-121028 is a medium severity vulnerability in the WP Chill Strong Testimonials plugin that allows code injection via improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) flaw. This affects versions from initial release up to 3.3.17. The issue is fixed in version 3.3.18.
A security update for the Ignition utility in Red Hat Enterprise Linux 9 addresses a vulnerability in the golang crypto/x509 package that could allow man-in-the-middle attacks via untrusted intermediate certificates. Ignition is used during system initialization to configure disks, files, and users based on remote or local configuration sources. The update fixes CVE-2026-111943 to prevent exploitation of this certificate validation flaw.
Multiple security vulnerabilities affecting the Grafana plugin for Performance Co-Pilot in Red Hat Enterprise Linux 9 have been addressed. These include denial of service issues in Go encoding/asn1, net/url, net/http, crypto/tls, and net/http/internal/http2 components, a cross-site scripting vulnerability in html/template, and a man-in-the-middle attack vector via untrusted intermediate certificates in crypto/x509. Red Hat has released an important security update to fix these issues.
Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.
Security Fix(es):
* fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.
Security Fix(es):
* dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)
* dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)
* dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)
* dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)
* dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)
* dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)
* dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)
* dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities have been identified and fixed in the xorg-x11-server-Xwayland component of Red Hat Enterprise Linux 9. These include several arbitrary code execution flaws, privilege escalation, out-of-bounds writes, and buffer overflows affecting various parts of the X server and Xwayland. The update addresses these issues to prevent potential exploitation.
The gcc-toolset-15-gcc package contains the GNU Compiler Collection version 15.
Security Fix(es):
* gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if (CVE-2026-102010)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-121014 is a missing authorization vulnerability in the Ahmad WP Job Portal plugin for WordPress, affecting versions prior to 2.8.0. This flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to unauthorized information disclosure. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 2.8.0.
CVE-2026-124408 is a missing authorization vulnerability in the Arraytics WPCafe plugin for WordPress, affecting versions prior to 3.0.23. This flaw allows attackers with low privileges to exploit incorrectly configured access control, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a medium severity rating and is fixed in version 3.0.23.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.51.0.
Cockpit component for managing libvirt virtual machines.
Security Fix(es):
* cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)
* cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)
* cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GeneratePress GenerateBlocks generateblocks allows Stored XSS.This issue affects GenerateBlocks: from n/a through 2.5.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.3.