Two security vulnerabilities have been identified in the perl-DBI package used in Red Hat Enterprise Linux 10. The first (CVE-2026-78030) allows loading arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. The second (CVE-2026-88815) can cause a denial of service through an invalid memory read during numeric type casting. Red Hat has issued an important security advisory with updates to address these issues.
Red Hat issued a security advisory for webkit2gtk3, addressing multiple vulnerabilities in the Chromium browser components Skia and ANGLE. The vulnerabilities include out of bounds reads, buffer overflows, use after free, uninitialized resource usage, and race conditions. These issues affect the WebKitGTK port of the WebKit rendering engine on the GTK platform. The update is rated as important by Red Hat Product Security and is available for Red Hat Enterprise Linux 9 on multiple architectures.
Two denial of service vulnerabilities have been identified in the c-ares C library, which handles asynchronous DNS requests and name resolution. The first vulnerability (CVE-2026-69186) involves unvalidated DNS header record counts leading to denial of service. The second (CVE-2026-69184) allows CPU exhaustion through unbounded DNS name compression pointer chains. Red Hat has issued security updates for Red Hat Enterprise Linux 10.2 Extended Update Support and related variants to address these issues.
Two denial of service vulnerabilities have been identified in the Qt software toolkit's qt6-qtbase package. One issue involves an excessively large HTTP Cache-Control header (CVE-2026-76151), and the other involves crafted XML parsing in QXmlStreamReader (CVE-2026-16762). These vulnerabilities can cause application crashes or resource exhaustion. Red Hat has issued an important security advisory with updates for affected Red Hat Enterprise Linux 10.2 Extended Update Support versions to address these issues.
Two security vulnerabilities have been identified in the nginx web and proxy server, specifically in the ngx_http_core_module. One is a heap-based buffer overflow triggered via alias with rewrite referencing $request_filename (CVE-2026-15176). The other is an unspecified vulnerability in the same module (CVE-2026-97205). Red Hat has issued a security advisory and released updates for Red Hat Enterprise Linux 10.2 Extended Update Support and related products to address these issues.
Multiple security vulnerabilities have been identified in the perl-CGI module used in Red Hat Enterprise Linux 10. These include a denial of service via unenforced request and upload limits, arbitrary file write through unsanitized upload filenames, and a security feature bypass via untainted request parameters. Red Hat has issued an important security update addressing these issues.
A denial of service vulnerability exists in the libpcap library due to an infinite loop in the BPF interpreter. This issue affects Red Hat Enterprise Linux 9.8 Extended Update Support and related products. The vulnerability is identified as CVE-2026-6554 and has been rated with an important security impact by Red Hat. A security update is available to address this issue.
A use-after-free vulnerability (CVE-2026-108094) was identified in the mutter compositing window manager, specifically in the Wayland color-management ICC image description path. Mutter manages desktop display through OpenGL and inherits window-management logic from Metacity. This vulnerability is client-triggered and affects Red Hat Enterprise Linux 10.2 Extended Update Support and related CodeReady Linux Builder products. Red Hat has issued a security advisory and released updates to address this issue.
A security vulnerability (CVE-2026-96541) was identified in GNOME Remote Desktop, a remote desktop and screen sharing service for the GNOME desktop environment. The issue involves unauthenticated RDP sockets lacking a handshake deadline, which could potentially lead to resource exhaustion. Red Hat has issued a security update for Red Hat Enterprise Linux 10.2 Extended Update Support to address this moderate severity flaw.
A security update for Mozilla Firefox and Thunderbird addresses multiple vulnerabilities including numerous use-after-free bugs, sandbox escapes, privilege escalations, information disclosures, spoofing, and site isolation issues across various components such as JavaScript GC, DOM, Graphics, Audio/Video, Networking, and Security. These vulnerabilities could allow attackers to escape sandbox restrictions, escalate privileges, disclose information, or bypass security mitigations. The update is rated as important by Red Hat Product Security and applies to Red Hat Enterprise Linux 8 Firefox packages.
A security vulnerability (CVE-2026-116591) affecting the Grafana plugin for Performance Co-Pilot in Red Hat Enterprise Linux 9 allows denial of service via crafted zstd compressed input. This issue is related to the klauspost/compress library used for zstd compression. Red Hat has issued an important security update to address this vulnerability.
A security vulnerability in GNU Emacs, specifically in Flymake mode, allows for arbitrary code execution. This issue is addressed by a security update released by Red Hat for Red Hat Enterprise Linux 9. The vulnerability is identified as CVE-2026-96442 and is rated as having an important security impact by Red Hat Product Security.
A security update for Grafana addresses two vulnerabilities: an Azure Monitor data source in Grafana could leak its Azure access token (CVE-2026-88967), and a denial of service vulnerability exists in the klauspost/compress zstd library via crafted compressed input (CVE-2026-116591). Red Hat has released patches for these issues in Red Hat Enterprise Linux 10.2 Extended Update Support and related variants.
A security vulnerability (CVE-2026-121629) exists in the gst-plugins-good component of the GStreamer multimedia framework used in Red Hat Enterprise Linux 10.2 Extended Update Support. The flaw involves local file disclosure through unvalidated file:// URIs in the adaptivedemux2 manifest handling. Red Hat has issued an important security update to address this issue.
A security advisory from Red Hat addresses multiple vulnerabilities in Apache Tomcat 9, including improper input validation, authentication bypass, HTTP/2 header validation issues, information disclosure during WebSocket authentication, improper authorization, case sensitivity handling flaws, security constraint bypass via URL encoding, and insufficient documentation that may lead to insecure configurations. These issues have been rated with moderate severity and affect Red Hat Enterprise Linux 10 distributions. Updates are available to remediate these vulnerabilities.
A stack buffer overflow vulnerability exists in the H.266/VVC parser of the gstreamer1-plugins-bad-free package used in Red Hat Enterprise Linux 10.2 Extended Update Support. This flaw is tracked as CVE-2026-119777 and has been rated with high severity by Red Hat Product Security. The issue is addressed by an update to the gstreamer1-plugins-bad-free package version 1.26.7-2.el10_2.8. The vulnerability could potentially allow an attacker to cause a denial of service or possibly execute arbitrary code via crafted media data. Red Hat has released patches for multiple architectures including x86_64, s390x, ppc64le, and aarch64. Users of affected Red Hat Enterprise Linux 10.2 Extended Update Support versions are advised to apply the update promptly.
A denial of service vulnerability (CVE-2026-102554) exists in Google Guava due to unthrottled memory allocation during deserialization. This flaw can cause excessive memory consumption leading to service disruption. Red Hat has issued a security advisory and released updates for Guava in Red Hat Enterprise Linux 9.8 Extended Update Support and related variants to address this issue.
A security vulnerability (CVE-2026-125712) was identified in the gst-plugins-base component of GStreamer, a streaming media framework. The flaw involves missing bounds checks in the parsing of RTCP SDES packets. Red Hat has issued an important security update for gstreamer1-plugins-base in Red Hat Enterprise Linux 10 to address this issue.