Multiple security vulnerabilities have been identified in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include denial of service conditions via crafted commands and out-of-bounds reads, as well as remote code execution through heap buffer overflows and uninitialized heap memory disclosure. The vulnerabilities affect Red Hat Enterprise Linux 8.8 variants and have been rated with an important security impact by Red Hat. Updates addressing these issues are available.
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
CVE-2026-120343 is a cross-site scripting (XSS) vulnerability in the mathurvishal CloudClassroom-PHP-Project affecting the manageassessment2.php file. The flaw arises from improper handling of the ExamName and question parameters (Q1 to Q5), allowing remote attackers to inject malicious scripts. Exploit code has been published, but no vendor response or patch is currently available. Due to the product's rolling release model, specific affected versions are not identified.
Multiple security vulnerabilities have been identified and fixed in Apache Tomcat as distributed by Red Hat Enterprise Linux 9.8. These include security constraint bypass, access control bypass due to an off-by-one error, improper input validation allowing HTTP/2 no-authority bypass of strict SNI validation, improper authentication from principal lookup failure, authentication bypass via replay attack in DIGEST authenticator, unauthorized resource access via FORM authentication bypass, and denial of service via HTTP/2 allocation leak. Red Hat has released updated packages addressing these issues for various architectures and product variants.
Multiple security vulnerabilities have been identified in nginx, a widely used web and proxy server. These include code execution, denial of service, heap-based buffer overflow, heap buffer over-read, and memory disclosure issues affecting various nginx modules such as ngx_http_rewrite_module, HTTP/2 header processing, and ngx_http_slice_module. Red Hat has issued an important security advisory with updates for Red Hat Enterprise Linux 9.4 to address these vulnerabilities.
.NET 8.0 on Red Hat Enterprise Linux contains security vulnerabilities including an out-of-bounds write in the Google Brotli decoder (CVE-2026-111497) and an elevation of privilege vulnerability in ASP.NET Core (CVE-2026-114148). These issues have been addressed in updated SDK and runtime versions. The update is rated as important by Red Hat Product Security.
CVE-2026-120342 is a SQL injection vulnerability in the mathurvishal CloudClassroom-PHP-Project. The flaw exists in an unknown function within the file viewquery.php, where manipulation of the 'eid' argument allows remote attackers to execute SQL injection attacks. Exploit code is publicly available. The product uses a rolling release model, so specific affected or fixed versions are not provided. The vendor did not respond to early disclosure attempts.
CVE-2026-120341 is a security vulnerability in the mathurvishal CloudClassroom-PHP-Project affecting an unknown function within studentdetails.php. The flaw allows execution after a redirect, which can be exploited remotely without authentication. The vulnerability has been publicly disclosed, but no vendor response or patch information is available. The product uses a rolling release model, so specific affected or fixed versions are not provided.
A moderate security vulnerability (CVE-2025-11395) exists in the podman tool used for managing container pods and images. The flaw allows arbitrary file write during the import of an OCI archive. This vulnerability affects Red Hat Enterprise Linux 10 and related products. A security update addressing this issue is available from Red Hat.
A weakness has been identified in mathurvishal CloudClassroom-PHP-Project. This issue affects some unknown processing of the component Global Session Handler. Executing a manipulation can lead to session expiration. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been made available to the public and could be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
A security update for the Linux kernel in Red Hat Enterprise Linux 8 addresses multiple vulnerabilities including use-after-free bugs, improper pointer refreshes in IPv6 extension headers, privilege escalation, and input validation issues. The update fixes several CVEs such as CVE-2026-63922, CVE-2026-63924, CVE-2026-64109, CVE-2026-72083, CVE-2026-74283, and CVE-2026-93787. The kernel is a critical component of the operating system, and these fixes improve overall system security. Red Hat recommends applying the update and rebooting the system to ensure protection.
A stack overflow vulnerability (CVE-2026-14330) was identified in the Pulse Server component of PipeWire, a multimedia server for Linux and Unix-like systems. Red Hat has issued a security advisory for this vulnerability affecting Red Hat Enterprise Linux 10 and related variants. The vulnerability is rated as moderate in severity. An update to PipeWire is available to address this issue.
CVE-2026-120339 is a cross-site scripting (XSS) vulnerability in the mathurvishal CloudClassroom-PHP-Project. The flaw exists in the updatedetailsfromfaculty.php file, where manipulation of the fname argument can lead to XSS attacks. The vulnerability can be exploited remotely and public exploit code is available. The product uses a rolling release model, so specific affected versions are not identified. The vendor has not responded to the disclosure. The CVSS 4.0 score is 5.3, indicating a medium severity risk.
.NET 9.0 on Red Hat Enterprise Linux contains an elevation of privilege vulnerability in ASP.NET Core identified as CVE-2026-114148. This security issue affects multiple .NET versions including 8.0, 9.0, 10.0, and 11.0. Red Hat has released security updates for these versions as part of their Extended Update Support for RHEL 10.0. The vulnerability allows an attacker to gain elevated privileges, potentially compromising system security.
A denial of service vulnerability (CVE-2026-94286) exists in the X.Org X11 libXtst runtime library due to an out-of-bounds read in the RECORD reply parser. This issue affects Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related variants. Red Hat has issued a security advisory with an update to address this vulnerability.
Multiple heap buffer overflow vulnerabilities have been identified in the libsoup HTTP client and server library for GNOME. These vulnerabilities arise from WebSocket handling issues including Pong signal type confusion, message reassembly, receive-buffer growth, and client-frame masking. Red Hat has issued security updates addressing these flaws in Red Hat Enterprise Linux 8.8 variants.