Multiple security vulnerabilities affecting the Grafana plugin for Performance Co-Pilot in Red Hat Enterprise Linux 9 have been addressed. These include denial of service issues in Go encoding/asn1, net/url, net/http, crypto/tls, and net/http/internal/http2 components, a cross-site scripting vulnerability in html/template, and a man-in-the-middle attack vector via untrusted intermediate certificates in crypto/x509. Red Hat has released an important security update to fix these issues.
Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.
Security Fix(es):
* fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.
Security Fix(es):
* dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391)
* dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208)
* dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852)
* dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019)
* dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263)
* dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605)
* dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007)
* dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities have been identified and fixed in the xorg-x11-server-Xwayland component of Red Hat Enterprise Linux 9. These include several arbitrary code execution flaws, privilege escalation, out-of-bounds writes, and buffer overflows affecting various parts of the X server and Xwayland. The update addresses these issues to prevent potential exploitation.
The gcc-toolset-15-gcc package contains the GNU Compiler Collection version 15.
Security Fix(es):
* gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if (CVE-2026-102010)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-125761 is a stored cross-site scripting (XSS) vulnerability in YITH WooCommerce Ajax Search versions prior to 2.30.1. The flaw involves improper neutralization of input during web page generation, allowing attackers with low privileges and requiring user interaction to inject malicious scripts. This vulnerability has a medium severity rating with a CVSS score of 6.5. A fix is available in version 2.30.1.
CVE-2026-121014 is a missing authorization vulnerability in the Ahmad WP Job Portal plugin for WordPress, affecting versions prior to 2.8.0. This flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to unauthorized information disclosure. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 2.8.0.
CVE-2026-124408 is a missing authorization vulnerability in the Arraytics WPCafe plugin for WordPress, affecting versions prior to 3.0.23. This flaw allows attackers with low privileges to exploit incorrectly configured access control, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a medium severity rating and is fixed in version 3.0.23.
CVE-2026-123473 is a stored cross-site scripting (XSS) vulnerability in the Happy Addons for Elementor plugin by weDevs. It affects versions from initial releases up to 3.51.0. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute malicious scripts. The issue is fixed in version 3.51.3.
Cockpit component for managing libvirt virtual machines.
Security Fix(es):
* cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)
* cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)
* cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-121773 is a stored cross-site scripting (XSS) vulnerability in GenerateBlocks, a plugin for GeneratePress. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers with limited privileges to inject malicious scripts. This vulnerability affects GenerateBlocks versions from initial releases up to 2.5.0. A fix is available in version 2.5.1.
CVE-2026-124752 is a stored cross-site scripting (XSS) vulnerability in BdThemes Element Pack Elementor Addons versions prior to 10.0.4. It allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges and user interaction to execute malicious scripts. The vulnerability is fixed in version 10.0.4.
CVE-2026-125438 is a missing authorization vulnerability in Webful Creations RepairBuddy, a computer repair shop management software. The flaw allows unauthorized access due to incorrectly configured access control security levels. It affects versions from initial releases up to 4.1235. A fix is available in version 4.1236. The vulnerability has a CVSS score of 5.3, indicating medium severity, with impact limited to confidentiality loss without integrity or availability impact.
CVE-2026-125434 is a missing authorization vulnerability in Webful Creations RepairBuddy, a computer repair shop management software. The flaw allows exploitation of incorrectly configured access control security levels in versions prior to 4.1236. This could lead to unauthorized actions impacting the integrity and availability of the system. The vulnerability has a medium severity score of 5.4 and has been fixed in version 4.1236.
GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment.
Security Fix(es):
* gnome-remote-desktop: gnome-remote-desktop: unauthenticated RDP sockets lack a handshake deadline (CVE-2026-96541)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6.