FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
* FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624)
* FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299)
* FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289)
* FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-9323 is a security vulnerability in the python-urwid package affecting Red Hat Enterprise Linux versions 8.4 and 8.8. The vulnerability involves predictable session IDs that could lead to remote code execution and information disclosure. Red Hat has issued security advisories and updates to address this issue. The severity is rated as medium, and patches are available for affected versions.
Multiple security issues were fixed in the hare-0.26.0.1-1.1 package on the GA media of openSUSE Tumbleweed. The details of these issues are not specified. The severity is assessed as medium.
A security update for Chromium version 151.0.7922.169 addresses multiple critical vulnerabilities including buffer overflows, use-after-free, type confusion, race conditions, information leaks, and inappropriate implementations in components such as WebGL, Dawn, CORS, CredentialProvider, USB, Core, Media, GPU, ANGLE, V8, and Skia. These vulnerabilities could allow attackers to cause crashes, execute arbitrary code, or leak sensitive information. The update fixes these issues to improve Chromium's security.
This security update for WeeChat addresses multiple vulnerabilities including buffer overflows, integer overflows, use-after-free, memory exhaustion, path traversal, authentication bypass, timing attacks, and out-of-bounds reads and writes. The update includes fixes for issues in core, IRC, relay, API, logger, and file transfer components. Notably, it fixes CVE-2026-53524 and CVE-2026-53525 related to memory exhaustion and timing attacks in the relay component. The update also adds new features and performance improvements.
This security update for bugwarden version 0.5.0 addresses multiple improvements including environment-based configuration for allowed hosts and authentication headers, enforcement of bearer token authentication on HTTP transport, enhanced audit and diagnostics export to OTLP collectors, and graceful container shutdown handling. Additionally, it updates the vendored h2 library to version 0.4.16 to fix a denial of service vulnerability related to unbounded empty DATA frames. The update also includes documentation improvements for OpenTelemetry collector usage.
Multiple denial of service vulnerabilities and a crash issue have been identified in libreswan, an IPsec and IKE implementation for Linux. These include DoS via RSA-SHA1 authentication payloads in IKEv1 and IKEv2, malformed fragmentation in IKEv2, and an assertion failure triggered by badly formatted X.509 certificates causing daemon crashes. The vulnerabilities affect Red Hat Enterprise Linux 9.6 Extended Update Support and related distributions. A security update addressing these issues is available from Red Hat.
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 140.14.0 ESR.
- MFSA 2026-76 (bsc#1274867)
* CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component
* CVE-2026-74935: Privilege escalation in the DOM: Networking component
* CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component
* CVE-2026-74939: Privilege escalation in the DOM: Navigation component
* CVE-2026-74940: Use-after-free in the Graphics: Text component
* CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component
* CVE-2026-74942: Privilege escalation in the Remote Settings Client component
* CVE-2026-74943: Use-after-free in the Graphics: ImageLib component
* CVE-2026-74944: Use-after-free in the DOM: Core & HTML component
* CVE-2026-74945: Information disclosure in the Graphics: Text component
* CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
* CVE-2026-74948: Information disclosure in the Graphics component
* CVE-2026-74949: Privilege escalation due to use-after-free in the Graphics:Canvas2D component
* CVE-2026-74953: Privilege escalation in the Networking: Cookies component
* CVE-2026-74957: Mitigation bypass in the Safe Browsing component
* CVE-2026-74959: Mitigation bypass in the Storage: Cache API component
* CVE-2026-74960: Site isolation issue in the WebExtensions component
* CVE-2026-74962: Site isolation issue in the Networking: Cookies component
* CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies component
* CVE-2026-74964: Integer overflow in the Graphics component
* CVE-2026-74965: Privilege escalation in the Shell Integration component
* CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback component
* CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component
* CVE-2026-74971: Information disclosure in the DOM: UI Events & Focus Handling component
* CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions component
* CVE-2026-74973: Race condition, use-after-free in the Graphics component
* CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component
* CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT component
* CVE-2026-74983: Mitigation bypass in the Data Loss Prevention component
* CVE-2026-74987: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
* CVE-2026-74990: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and
Firefox 154
This update for python313 fixes the following issues:
- CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
- CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).
- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
`configparser` module is used (bsc#1269066).
- CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting
hardlinks (bsc#1269959).
- CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
- CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and
enables arbitrary file reads and writes (bsc#1268977).
- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS
(bsc#1269788).
- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations
(bsc#1271192).
A security update for python-unearth addresses a vulnerability in the is_within_directory function. The function failed to normalize paths before validation, allowing directory traversal sequences ('../') to bypass directory containment checks. This flaw could enable unauthorized access to files outside the intended directory scope.
A security update for forgejo-cli addresses an integer overflow vulnerability in the vendored bytes crate (CVE-2026-25541) that could corrupt tracked capacity and lead to out-of-bounds slices. The update also includes multiple feature additions, localization support, and various fixes unrelated to security. No known exploits are reported. The update is provided by the SUSE Product Security Team.
This security update for the kitty terminal emulator addresses multiple issues including regressions in Wayland support, memory leaks, crashes, and usability improvements. The update spans versions 0.48.0 through 0.48.2 and fixes bugs such as broken drag and drop on Plasma, a memory leak introduced in version 0.40.0, and various Wayland compositor compatibility problems. No explicit security vulnerability details or exploit information are provided in the update notes.
Multiple security issues were fixed in the redis-8.10.1-1.1 package distributed with openSUSE Tumbleweed. The vulnerabilities addressed are related to the SUSE Redis package version 8.10.1-1.1. No specific details about the nature of the vulnerabilities or affected versions are provided.
PipeWire is a multimedia server for Linux and other Unix like operating systems.
Security Fix(es):
* pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading (CVE-2026-5674)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update for htop addresses an out-of-bounds access vulnerability (CVE-2024-37676) in the settings parser that could be triggered by tampered configuration files. The update improves the htoprc settings parser to prevent segmentation faults and hardens it against malformed inputs. The vulnerability is fixed by sanitizing sort keys, validating configuration invariants, and ensuring NULL safety. openSUSE is assessed as not affected by this issue.
This security update for Chromium addresses multiple use-after-free vulnerabilities in various components including V8, TabStrip, Extensions, HTML, and Blink. These issues are fixed in Chromium version 151.0.7922.137. The vulnerabilities are identified by CVE IDs CVE-2026-19556 through CVE-2026-19560 and are classified with high severity.
Multiple security issues were addressed in the kubeshark-cli package versions prior to 53.4.0-1.1 on openSUSE Tumbleweed. These vulnerabilities affect several versions of the software and have been fixed in the updated package. The issues are classified with medium severity and relate to CWE-862 (Missing Authorization).
This security update for git-cliff addresses multiple issues including two notable vulnerabilities: CVE-2026-25541, an integer overflow in the 'BytesMut:reserve' function that can cause undefined behavior and crashes, and CVE-2025-55159, an incorrect bounds check in the 'get_disjoint_mut' function that can lead to undefined behavior or potential crashes due to out-of-bounds access. The update to version 2.13.1 includes these fixes along with various feature enhancements and bug fixes.