Guava is a suite of core and expanded libraries that include utility classes, Google’s collections, io classes, and much much more. This project is a complete packaging of all the Guava libraries into a single jar. Individual portions of Guava can be used by downloading the appropriate module and its dependencies.
Security Fix(es):
* com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization (CVE-2026-102554)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A heap buffer overflow vulnerability exists in the gstreamer1-plugins-base package due to unvalidated GstVideoMeta plane extents in the functions gst_video_frame_map_id and video_meta_deserialize. This issue affects Red Hat Enterprise Linux 10 across multiple architectures. A security update addressing this vulnerability has been released by Red Hat.
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
Security Fix(es):
* pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266)
* pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268)
* pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271)
* pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267)
* pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat has issued a security advisory for Grafana addressing three vulnerabilities: an Azure Monitor data source could leak its Azure access token (CVE-2026-88967), a denial of service vulnerability in the klauspost/compress zstd library via crafted compressed input (CVE-2026-116591), and an information disclosure issue via a legacy schema switch in contact points (CVE-2026-100105). These issues affect Red Hat Enterprise Linux 10 across multiple architectures. The update to Grafana version 12.4.3-3.el10_3.6 resolves these vulnerabilities.
A denial of service vulnerability (CVE-2026-19248) exists in the XML parsing component of the Qt6 QtBase toolkit. This vulnerability affects Red Hat Enterprise Linux 10 packages of qt6-qtbase. The issue could cause applications using this library to become unresponsive or crash when processing crafted XML data. Red Hat has issued a security advisory and released updated packages to address this moderate severity flaw.
The Author Image plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'display_name' parameter. This affects all versions up to and including 4.9.3. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
The Reset Database plugin for WordPress, versions up to and including 1.1.3, contains a privilege escalation vulnerability. The flaw arises from the process_reset() function being triggered without proper capability checks, combined with a nonce that is computed but unused, and a gating condition that allows the reset process if no administrator named 'admin' exists. Additionally, the identity verification checks the attacker's own password rather than an administrator's, enabling authenticated users with subscriber-level access or higher to reset the database, become the sole administrator, and delete the uploads directory.
The 6Storage Rentals WordPress plugin up to version 2.31.0 contains an authentication bypass vulnerability allowing users with Subscriber-level access or higher to authenticate as any existing WordPress user, including administrators. This occurs due to missing capability checks and nonce verification in AJAX handlers that allow attacker-controlled data to influence authentication state, leading to full site compromise. The issue is a partial fix of a prior vulnerability and remains exploitable.
Multiple security vulnerabilities have been identified in the cockpit-files component of Red Hat Enterprise Linux 10. These include arbitrary file ownership and permission modifications via symlink race conditions and privileged paste operations. The issues allow local attackers to hijack file ownership through symlink races. Red Hat has released updates to address these vulnerabilities.
Bay is a newly launched company that provides a control plane for enterprise AI agents to manage and restrict their actions. Founded by ex-IDF Unit 8200 officers, Bay offers a solution that inventories AI agents and evaluates their actions in real-time to prevent unintended or risky behaviors. The system uses AI-driven policies to enforce controls and ensure safe operation of AI agents within organizations.
Multiple security vulnerabilities have been identified in the libxml2 library used in Red Hat Enterprise Linux 10. These include arbitrary code execution via buffer overflows, data integrity issues from integer overflow, heap-based buffer overflow, information disclosure, SSRF, denial of service, and double-free/use-after-free in Python bindings. Red Hat has issued an important security update addressing these issues.
Multiple security vulnerabilities have been identified in the Expat XML parsing library used by Red Hat Enterprise Linux 10. These include denial of service via quadratic complexity in attribute processing, XML injection through malformed UTF-16 input, denial of service via integer overflow in memory reallocation, and information disclosure due to heap buffer over-read. Red Hat has issued an important security advisory with updates addressing these issues in Expat version 2.7.3-2.el10_3.4 for various architectures.
Multiple security vulnerabilities affecting the Grafana plugin for Performance Co-Pilot in Red Hat Enterprise Linux 10 have been addressed. These include denial of service issues in various Go libraries (encoding/asn1, net/url, net/http, crypto/tls, net/textproto), a cross-site scripting vulnerability in html/template, and a man-in-the-middle attack vector via untrusted intermediate certificates in crypto/x509. The update also includes bug fixes and enhancements for the vLLM AI dashboard. The vulnerabilities are rated as important by Red Hat Product Security.
Multiple security vulnerabilities have been identified in OpenSSL, including several denial of service (DoS) issues via excessive memory allocation, QUIC protocol weaknesses, and out-of-bounds writes. Additionally, private key recovery is possible through timing side-channel attacks on elliptic curve operations and SM2 scalar multiplication. These vulnerabilities affect OpenSSL as implemented in Red Hat Enterprise Linux 10. The update also addresses bugs related to FIPS mode and thread initialization.
A security vulnerability in NetworkManager allows bypassing the private_user restriction for 802.1x ca-path and phase2-ca-path, which can lead to WPA-Enterprise server validation bypass. This issue is an incomplete fix for a previous vulnerability (CVE-2025-9615) and affects Red Hat Enterprise Linux 10 and related products. Red Hat has released an update to address this vulnerability.
A vulnerability in Apache XML Graphics FOP allows creation of temporary files with insecure permissions. This affects versions up to and including 2.11. Users should upgrade to version 2.12 to resolve the issue.
A denial of service vulnerability exists in the gcc-toolset-16-gcc package due to a use-after-free flaw in the binary heap erase_if function. This issue affects the GNU Compiler Collection version 16 as provided by Red Hat. The vulnerability is rated as moderate severity by Red Hat Product Security. An update is available for Red Hat Enterprise Linux 10 to address this issue.
CVE-2026-124743 is a vulnerability in BusyBox affecting the volume identification component when processing HFS+ filesystem metadata. Improper validation of header values can lead to a divide-by-zero error, causing an application crash and resulting in a local denial of service (DoS). Exploitation requires local access to attach a specially crafted storage device or filesystem image. The impact is limited to DoS without confidentiality or integrity loss. Red Hat notes that BusyBox is typically used only in rescue or initramfs environments, reducing exposure in standard enterprise workflows. No mitigation or patch currently meets Red Hat's criteria for widespread deployment.
A divide-by-zero vulnerability exists in the BusyBox volume identification component when analyzing specially crafted FAT filesystems. This flaw can cause partition scanning utilities to crash unexpectedly, leading to a denial of service that may disrupt device discovery and system boot operations. The vulnerability requires local access or the ability to present a crafted storage device. It primarily affects recovery environments or minimal container images using BusyBox rather than standard Red Hat Enterprise Linux installations. No effective mitigation or patch is currently available that meets Red Hat's criteria.
A use-after-free vulnerability exists in BusyBox's udhcpc6 DHCPv6 client used in Red Hat Hardened Images. A malicious local network DHCPv6 server can trigger this flaw by sending a crafted reply packet without usable address options, causing the client to read stale heap memory. This can lead to a denial of service due to application crash or disclosure of previously assigned network address data. The vulnerability is rated medium severity with a CVSS score of 4.3. It affects environments where BusyBox udhcpc6 is explicitly used, such as custom containers or minimal recovery images, but not standard Red Hat Enterprise Linux installations which use NetworkManager by default. No official fix or mitigation is currently available that meets Red Hat's criteria for deployment and stability.