Red Hat issued a security advisory for Red Hat Edge Manager version 1.2.1 addressing multiple vulnerabilities including CVE-2026-6377. Red Hat Edge Manager is a solution for managing edge devices and container workloads, supporting scalable and security-focused lifecycle management. The advisory does not provide specific details on fixes or patches. The vulnerabilities are rated as high severity. No known exploits in the wild are reported. The advisory emphasizes the product's role in managing large-scale edge deployments but does not specify remediation steps or affected versions beyond those listed.
A medium severity vulnerability identified as CVE-2026-90439 affects Red Hat Hardened Images RPMs, specifically various nginx packages. Red Hat has released a security advisory with a patch update to address this issue. The update includes multiple nginx-related RPMs version 1.30.5-4.hum1 for different architectures. The vulnerability is related to a software defect categorized under CWE-787. A fix is available and users are advised to apply the update as per Red Hat's guidance.
Red Hat has issued a security advisory addressing vulnerabilities in the GNU coreutils package, specifically affecting the uniq and unexpand utilities. The uniq utility suffers from a denial of service and information disclosure vulnerability due to an out-of-bounds read with multibyte input (CVE-2026-56391). The unexpand utility is vulnerable to denial of service through crafted tab stop values (CVE-2026-56392). Updated coreutils packages have been released to mitigate these issues.
Multiple security vulnerabilities affecting the Linux kernel have been addressed in a Red Hat security advisory. The issues include use-after-free, heap overflow, access control bypass, and validation errors across various kernel subsystems such as netfilter, Bluetooth, crypto, IPv6, USB serial drivers, and SCSI. These vulnerabilities could potentially be exploited to compromise system integrity or stability. A patch is available and should be applied to affected kernel versions. The advisory also includes bug fixes and enhancements unrelated to security. Users are advised to update and reboot their systems to apply the fixes.
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 10.0.112
Runtime version: 10.0.12
Security Fix(es):
* dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649)
* dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806)
Bug Fix(es) and Enhancement(s):
* Update .NET 10.0 to SDK 10.0.112 and Runtime 10.0.12 [rhel-9.8.z] (JIRA:RHEL-252319)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat has released a security advisory addressing multiple high severity vulnerabilities in Red Hat Hardened Images RPMs, including the grafana13.1 and grafana13.2 packages. The update resolves issues identified by CVE-2026-90771, CVE-2026-9029, and others. No known exploits have been reported in the wild. Users are advised to apply the provided RPM updates to remediate these vulnerabilities.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating multiple python3.14 packages to address several vulnerabilities including CVE-2026-87910. The advisory lists updated RPM packages for various architectures and includes fixes for multiple CVEs. No explicit patch versions are stated as affected, and no known exploits are reported in the wild. The update is classified as a security advisory with high severity.
Red Hat has issued a security advisory for its Hardened Images RPMs, specifically updating multiple CUPS-related packages to address CVE-2026-87876. The update includes packages such as cups, cups-client, cups-devel, cups-filesystem, cups-ipptool, cups-libs, cups-lpd, and cups-printerapp. The advisory indicates a low severity vulnerability related to these packages. No affected versions are explicitly stated, and the update is available in version 2.4.19-4.2.hum1 for multiple architectures.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including an update to the rabbitmq-server4.3 package. The update addresses multiple security issues identified by numerous CVEs. Updated RPM packages are provided for aarch64 and x86_64 architectures. No detailed vulnerability descriptions or specific fixes are included in the advisory text.
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:
https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.15/html-single/release_notes/index#acm-release-notes
The multicluster engine for Kubernetes v2.10 images
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
Multiple security vulnerabilities affecting Grafana as packaged in Red Hat Enterprise Linux 10 have been addressed in a security update. These include privilege escalation via dashboard overwrite, unauthorized access due to incorrect IPv6 allow-list defaults, and denial of service issues caused by unbounded memory growth and excessive memory allocation. The update also fixes various underlying Go language library vulnerabilities impacting certificate validation, email parsing, and HTML parsing. Red Hat rates the overall security impact as Moderate and provides updated packages to remediate these issues.
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container
Platform 4.22.14. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/RHSA-2026:66356
Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/
Security Fix(es):
* curl: curl: Insecure connection establishment due to TLS configuration
mismatch (CVE-2026-8286)
* curl: curl: Man-in-the-middle attack via SSH host key bypass
(CVE-2026-9547)
* bind: bind9: Cache poisoning via label count discrepancy, RRSIG,
wildcards (CVE-2026-11721)
* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer
overflow in FTS5 (CVE-2026-11824)
* bind: bind9: Unexpected exit with NSEC and NSEC3 both present
(CVE-2026-13204)
* dracut: dracut: root code execution via unescaped error message written
to sourced emergency hook script in die() (CVE-2026-15816)
* kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
(CVE-2026-43133)
* unbound: Unbound: Denial of Service via malformed EDNS Report-Channel
option (CVE-2026-55973)
* glib: off-by-one error in glib/gkeyfile.c via
"g_key_file_get_locale_string_list" (CVE-2026-58014)
* glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via
keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015)
* kbd: Local privilege escalation in openvt via incorrect process owner
verification allowing passwordless root login (CVE-2026-72693)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.22 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.
Multiple security vulnerabilities have been identified and fixed in the Linux kernel packages used by Red Hat. These include issues such as out-of-bounds writes, race conditions, improper access restrictions, and validation errors across various kernel subsystems including networking, storage, and device drivers. The advisory covers several CVEs, each addressing a specific kernel component flaw. The update also includes bug fixes and enhancements unrelated to security. A patch is available to address these vulnerabilities.
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:
https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.11/html-single/release_notes/index#acm-release-notes
Red Hat has issued an important security advisory for the Linux kernel packages in Red Hat Enterprise Linux 8, addressing multiple vulnerabilities including integer overflow, use-after-free, buffer overflow, and other flaws across various kernel components such as EDAC/bluefield, Wi-Fi drivers, KVM, net, blk-cgroup, scsi, and dm-verity. These vulnerabilities could lead to system crashes or other security impacts. The update requires a system reboot to take effect.
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
* rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
* rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)
* rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
* rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
* rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
* rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
* rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
* rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
* rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)
* rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
* rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)
* rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
* rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
* rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
* rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
* rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)
* rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)
* rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)
* rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
* rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
* rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)
Bug Fix(es) and Enhancement(s):
* Rebase rsync to version 3.5.0 in RHEL10 (JIRA:RHEL-246094)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.