Red Hat has issued a security advisory for python-urllib3 addressing two vulnerabilities: a denial of service via unbounded memory allocation in the chunk parser (CVE-2026-97689) and traffic interception through HTTPS proxy TLS configuration override (CVE-2026-97687). These issues affect Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and Extended Life Cycle variants. The advisory rates the impact as Important and provides updated packages to remediate the vulnerabilities.
A security update for OpenSSL addresses a vulnerability identified as CVE-2026-84782 affecting the compat-openssl component. The flaw involves DTLS retransmitting handshake messages from a stale buffer offset. This issue is rated as having an important security impact by Red Hat and affects Red Hat Enterprise Linux Server Extended Life Cycle Support Extension 6. A patch is available in the updated OpenSSL packages provided by Red Hat.
Multiple critical vulnerabilities have been identified in the python-pillow library used in Red Hat Enterprise Linux 8.6. These include heap buffer overflows, denial of service conditions via various memory and recursion issues, and an argument injection vulnerability potentially leading to remote code execution. The vulnerabilities affect image processing functions such as TIFF saving, PDF parsing, JPEG decoding, and image transformations. Red Hat has issued a security update addressing these issues.
A security vulnerability (CVE-2026-118669) in python-oauthlib was addressed by Red Hat. The flaw involves privilege escalation due to client identity confusion in token grant handlers. This issue affects Red Hat Enterprise Linux 8.6 variants and has been rated as having an important security impact by Red Hat Product Security.
Red Hat OpenShift Container Platform 4.17.60 includes multiple critical security fixes addressing vulnerabilities in kernel components, OpenSSH, OpenSSL, PCRE2, and other libraries. These fixes resolve issues such as use-after-free, out-of-bounds writes, security bypasses, and certificate distrust. Users of OpenShift Container Platform 4.17 are advised to upgrade to this release to mitigate these critical vulnerabilities.
Red Hat issued a security advisory for golang-github-openprinting-ipp-usb addressing multiple vulnerabilities in Go packages used by the IPP-over-USB HTTP reverse proxy. The vulnerabilities include denial of service, certificate validation bypass, privilege escalation, and denial of service via various malformed inputs affecting crypto/x509, net, mime, encoding/asn1, net/url, net/http, crypto/tls, and encoding/xml packages. These issues impact Red Hat Enterprise Linux 10.0 Extended Update Support and related architectures. The advisory rates the security impact as Important and provides updated packages to remediate the issues.
Multiple security vulnerabilities have been identified and fixed in the dnsmasq packages used in Red Hat Enterprise Linux 8.4. These include heap buffer overflows, infinite loops, out-of-bounds reads, and source validation bypasses affecting DNS and DHCP functionalities. An update addressing these issues is available.
Multiple security vulnerabilities have been identified in Flatpak, a system for building and running sandboxed desktop applications on Linux. These include arbitrary code execution due to missing symlink protection, arbitrary root write access via extra-data extraction, a buffer overflow on 32-bit systems, and local privilege escalation via symlink traversal. Red Hat has issued a security update addressing these issues in Flatpak packages for Red Hat Enterprise Linux 8.4. Users are advised to apply the update to mitigate these vulnerabilities.
Red Hat OpenShift Container Platform 4.13.73 includes a critical security update addressing multiple vulnerabilities, notably a kernel IPv4 issue (CVE-2026-98432) involving freeing inet_opt and ireq_opt after an RCU grace period. This release fixes several bugs and security flaws across components such as OpenSSL, OpenSSH, GnuTLS, libxml2, and others. Users of OpenShift Container Platform 4.13 are advised to upgrade to this release to mitigate these critical vulnerabilities.
The npm package 'yummy-bolts' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
Microsoft's November 2026 Patch Tuesday addresses 1095 vulnerabilities across multiple products, including 64 critical issues. Among these, 48 are remote code execution vulnerabilities. One vulnerability, CVE-2026-124194 in Microsoft Office Outlook, has been exploited in the wild and involves spoofing due to lack of UI warnings for unsafe actions. Several high-severity remote code execution and elevation of privilege vulnerabilities affect Windows components, Active Directory, Microsoft Exchange Server, and Microsoft Office applications. Microsoft highlights certain vulnerabilities as more likely to be exploited, including CVE-2026-113862 (Windows NAT), CVE-2026-118146 and CVE-2026-118148 (Active Directory), CVE-2026-118207 (Exchange Server), and CVE-2026-119952 (Windows Schannel).
The npm package @fadelsm/libsignal-node contains malicious code that compromises any computer on which it is installed or running. Systems with this package should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a different, trusted device. Removing the package does not guarantee removal of all malicious software introduced by it.
This Red Hat security advisory addresses multiple vulnerabilities and bug fixes in the Linux kernel packages for Red Hat Enterprise Linux 9. The update includes fixes for numerous security issues such as NULL pointer dereferences, use-after-free conditions, out-of-bounds writes, memory corruption, and denial of service vulnerabilities across various kernel subsystems including networking, USB, Bluetooth, RDMA, and virtualization. The advisory emphasizes the importance of applying the update and rebooting the system to mitigate these issues.
The npm package pt-logger-telemetry-eax0x1 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
A denial of service vulnerability exists in Gitoxide before version 0.42.0 caused by processing a crafted commit-graph file. This flaw can cause the affected software to become unavailable or crash when handling maliciously crafted input.
CVE-2026-123532 is a vulnerability in gix-fs before version 0.24.1 that allows NTLM credential disclosure via a Windows symlink UNC probe. The affected product is Microsoft software version 3.0. No CVSS score or detailed impact information is provided.
CVE-2026-113431 is a vulnerability in the cowlib cow_http2_machine component where the decoded HTTP/2 header-list size is unbounded. This flaw enables HPACK amplification memory exhaustion, potentially leading to resource exhaustion on affected systems. The issue affects Microsoft product version 3.0. No CVSS score or public exploit code is currently available.