A security vulnerability (CVE-2026-8932) in libcurl, part of the curl packages provided by Red Hat, allows a security feature bypass due to improper mutual TLS (mTLS) connection reuse. This issue affects Red Hat Enterprise Linux 9 and related variants. The vulnerability has been rated as moderate in severity by Red Hat Product Security. An update addressing this issue is available in Red Hat Enterprise Linux 9.8 and Extended Update Support 9.8 packages.
CVE-2026-15466 is a use-after-free vulnerability in Imagination Technologies Graphics DDK. It arises from a race condition in the destruction path of hardware performance counters buffer, where improper GPU system calls by non-privileged users can cause the reference counter to be decremented non-atomically. This allows other code paths to access freed kernel heap memory, leading to potential read and/or write use-after-free conditions.
CVE-2026-91920 is a vulnerability in the ChunkReader component of the Undertow web server used by Red Hat build of Apache Camel for Spring Boot 4. The flaw arises from an incomplete bounds check on chunk sizes in HTTP chunked transfer encoding, allowing a crafted 15-digit chunk size to overflow internal state flags. This can cause premature termination of the request body and interpretation of remaining data as a separate smuggled HTTP request. Exploitation requires precise TCP segmentation control. The vulnerability is rated medium severity with a CVSS score of 6.5.
A vulnerability identified as CVE-2026-113724 affects version 3.0 of the Microsoft product virtualenv. The issue involves deletion recovery processes that can alter the mode (permissions) of a symlink target. No CVSS score or detailed impact information is provided.
A vulnerability identified as CVE-2026-97313 affects Microsoft software version 3.0, where specific Response Policy Zone (RPZ) configurations and query patterns may cause the software to exit unexpectedly. No CVSS score or detailed impact information is provided.
A vulnerability exists in Microsoft product version 3.0 where the Named service may terminate unexpectedly when a redirect zone is used with strict QNAME minimization enabled. This issue could cause service disruption due to unexpected termination.
A vulnerability identified as CVE-2026-94300 affects Microsoft software version 3.0, involving concurrent GSS-TSIG messages that can corrupt memory. This issue is categorized under CWE-415, which relates to double free or similar memory corruption errors. No CVSS score or detailed impact information is provided, and no patch or remediation details are available at this time.
CVE-2026-19630 is a vulnerability in Microsoft software version 3.0 involving amplified resource exhaustion during inbound message processing. The issue relates to inefficient handling of incoming messages that could lead to excessive consumption of system resources.
CVE-2026-93536 is a use-after-free vulnerability in the GestureBuildSprite component of the X.Org Server version 3.0. The vulnerability has been publicly disclosed but lacks detailed technical information and a CVSS score. No known exploits in the wild or patches are currently documented.
CVE-2026-93524 is an out-of-bounds read vulnerability in the X.Org Server related to XKB SetMap key width and action count desynchronization. This flaw involves improper handling of key width and action count data, potentially leading to memory access issues.
CVE-2026-93523 is an out-of-bounds write vulnerability in the X.Org Server's XInput2 PassiveUngrabDevice functionality. This vulnerability could allow an attacker to write outside the intended memory bounds, potentially leading to memory corruption.
CVE-2026-93521 is a heap buffer overflow vulnerability in the X.Org Server's RandR ChangeProviderProperty functionality affecting version 3.0. The vulnerability is categorized under CWE-122, indicating a heap-based buffer overflow issue. No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild. No patch or remediation information is currently available.
CVE-2026-93520 is a heap out-of-bounds write vulnerability in the X.Org Server component related to the XKB ChangeKeycodeRange functionality. This flaw could potentially lead to memory corruption. No CVSS score or detailed impact information is provided. The affected version is exactly 3.0. No public exploit or patch information is currently available.
CVE-2026-93519 is a buffer overflow vulnerability in the X.Org Server's XFixes Pointer Barrier Event List component affecting version 3.0. The vulnerability is identified as a heap-based buffer overflow (CWE-122). No CVSS score or detailed impact information is provided. There is no indication of known exploitation in the wild or available patches.
CVE-2026-93518 is a vulnerability in the X.Org Server related to the XKB ResizeKeyType that involves numeric truncation. The vulnerability is identified with CWE-122, which typically relates to a heap-based buffer overflow or similar memory corruption issues. The affected version explicitly stated is version 3.0. No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild.
CVE-2026-93517 is a heap buffer overflow vulnerability in the GLX RenderLarge component of the X.Org Server, specifically affecting version 3.0. The vulnerability is categorized under CWE-122, indicating a classic heap-based buffer overflow issue. No CVSS score or detailed impact information is provided, and there are no known exploits in the wild. No patch or remediation information is available from the vendor at this time.
CVE-2026-93516 is a use-after-free vulnerability in the .Org Server XInput Passive Grab component of Microsoft software version 3.0. The vulnerability is publicly disclosed but lacks detailed technical or impact information and no CVSS score is provided.
CVE-2026-93515 is a use-after-free vulnerability in the .Org Server Present Extension affecting Microsoft product version 3.0. The vulnerability is publicly known but lacks detailed technical or impact information and has no CVSS score assigned.
CVE-2026-92709 is a vulnerability in Rsyslog version 3.0 involving a path traversal flaw in DynFile that allows arbitrary file write as root, potentially leading to remote code execution (RCE).
Red Hat has released a security update for the java-21-openjdk packages in Red Hat Enterprise Linux 8 and 9. This update addresses multiple security vulnerabilities across various components of the OpenJDK 21 Java Runtime Environment and Software Development Kit, including enhancements to PKCS5 padding, TLS certificate handling, LDAP logins, SASL authentication, HTTP client and server handling, XML processing, and more. The update is rated as Important by Red Hat Product Security. Users should apply this update to mitigate the addressed vulnerabilities.