A security vulnerability (CVE-2026-118669) in python-oauthlib was addressed by Red Hat. The flaw involves privilege escalation due to client identity confusion in token grant handlers. This issue affects Red Hat Enterprise Linux 8.6 variants and has been rated as having an important security impact by Red Hat Product Security.
Two security vulnerabilities have been identified in the python3.12-urllib3 package used in Red Hat Enterprise Linux 9.6 Extended Update Support. The first vulnerability (CVE-2026-97689) involves a denial of service caused by unbounded memory allocation in the chunk parser. The second vulnerability (CVE-2026-97687) allows traffic interception via HTTPS proxy TLS configuration override. Red Hat has released updated packages to address these issues.
Red Hat OpenShift Container Platform 4.17.60 includes multiple critical security fixes addressing vulnerabilities in kernel components, OpenSSH, OpenSSL, PCRE2, and other libraries. These fixes resolve issues such as use-after-free, out-of-bounds writes, security bypasses, and certificate distrust. Users of OpenShift Container Platform 4.17 are advised to upgrade to this release to mitigate these critical vulnerabilities.
Red Hat issued a security advisory for golang-github-openprinting-ipp-usb addressing multiple vulnerabilities in Go packages used by the IPP-over-USB HTTP reverse proxy. The vulnerabilities include denial of service, certificate validation bypass, privilege escalation, and denial of service via various malformed inputs affecting crypto/x509, net, mime, encoding/asn1, net/url, net/http, crypto/tls, and encoding/xml packages. These issues impact Red Hat Enterprise Linux 10.0 Extended Update Support and related architectures. The advisory rates the security impact as Important and provides updated packages to remediate the issues.
Multiple security vulnerabilities have been identified and fixed in the dnsmasq packages used in Red Hat Enterprise Linux 8.4. These include heap buffer overflows, infinite loops, out-of-bounds reads, and source validation bypasses affecting DNS and DHCP functionalities. An update addressing these issues is available.
Multiple security vulnerabilities have been identified in Flatpak, a system for building and running sandboxed desktop applications on Linux. These include arbitrary code execution due to missing symlink protection, arbitrary root write access via extra-data extraction, a buffer overflow on 32-bit systems, and local privilege escalation via symlink traversal. Red Hat has issued a security update addressing these issues in Flatpak packages for Red Hat Enterprise Linux 8.4. Users are advised to apply the update to mitigate these vulnerabilities.
Red Hat OpenShift Container Platform 4.13.73 includes a critical security update addressing multiple vulnerabilities, notably a kernel IPv4 issue (CVE-2026-98432) involving freeing inet_opt and ireq_opt after an RCU grace period. This release fixes several bugs and security flaws across components such as OpenSSL, OpenSSH, GnuTLS, libxml2, and others. Users of OpenShift Container Platform 4.13 are advised to upgrade to this release to mitigate these critical vulnerabilities.
The npm package 'yummy-bolts' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
Microsoft's November 2026 Patch Tuesday addresses 1095 vulnerabilities across multiple products, including 64 critical issues. Among these, 48 are remote code execution vulnerabilities. One vulnerability, CVE-2026-124194 in Microsoft Office Outlook, has been exploited in the wild and involves spoofing due to lack of UI warnings for unsafe actions. Several high-severity remote code execution and elevation of privilege vulnerabilities affect Windows components, Active Directory, Microsoft Exchange Server, and Microsoft Office applications. Microsoft highlights certain vulnerabilities as more likely to be exploited, including CVE-2026-113862 (Windows NAT), CVE-2026-118146 and CVE-2026-118148 (Active Directory), CVE-2026-118207 (Exchange Server), and CVE-2026-119952 (Windows Schannel).
The npm package @fadelsm/libsignal-node contains malicious code that compromises any computer on which it is installed or running. Systems with this package should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a different, trusted device. Removing the package does not guarantee removal of all malicious software introduced by it.
This Red Hat security advisory addresses multiple vulnerabilities and bug fixes in the Linux kernel packages for Red Hat Enterprise Linux 9. The update includes fixes for numerous security issues such as NULL pointer dereferences, use-after-free conditions, out-of-bounds writes, memory corruption, and denial of service vulnerabilities across various kernel subsystems including networking, USB, Bluetooth, RDMA, and virtualization. The advisory emphasizes the importance of applying the update and rebooting the system to mitigate these issues.
The npm package pt-logger-telemetry-eax0x1 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
A denial of service vulnerability exists in Gitoxide before version 0.42.0 caused by processing a crafted commit-graph file. This flaw can cause the affected software to become unavailable or crash when handling maliciously crafted input.
CVE-2026-123532 is a vulnerability in gix-fs before version 0.24.1 that allows NTLM credential disclosure via a Windows symlink UNC probe. The affected product is Microsoft software version 3.0. No CVSS score or detailed impact information is provided.
CVE-2026-113431 is a vulnerability in the cowlib cow_http2_machine component where the decoded HTTP/2 header-list size is unbounded. This flaw enables HPACK amplification memory exhaustion, potentially leading to resource exhaustion on affected systems. The issue affects Microsoft product version 3.0. No CVSS score or public exploit code is currently available.
An uncontrolled resource consumption vulnerability exists in the HTTP response handling component of the Qt Network module within the Qt Framework. This vulnerability could potentially lead to resource exhaustion conditions. The affected version explicitly identified is Qt Framework version 3.0. No CVSS score or detailed exploitation information is provided.
A vulnerability identified as CVE-2026-120474 affects version 3.0 of the undici HTTP client library. The issue involves cross-user cache disclosure via same-origin redirects, which could lead to unintended information leakage between users. No CVSS score or detailed impact metrics are provided. No known exploits in the wild have been reported, and no patch or remediation details are available from the vendor.
The undici HTTP client version 3.0 is vulnerable to a denial of service condition caused by an unhandled exception during cache-interceptor response replay. This flaw can cause the application using undici to crash or become unresponsive when the exception occurs.