CVE-2026-75803 is a low severity vulnerability affecting certain Node.js packages in Red Hat Hardened Images RPMs, related to Ruby 3.4 packages. It involves improper control of code generation (CWE-354). The advisory references OpenSSL vulnerabilities but does not provide detailed exploit or impact information specific to the Ruby packages. No known exploits are reported in the wild. A patch is available to address this issue.
CVE-2026-42770 is a low severity vulnerability affecting FFC-DH peer validation in Microsoft products including Azure Linux and OpenSSL 3.0. The issue involves improper use of an attacker-supplied parameter 'q' during cryptographic validation, potentially weakening the security of Diffie-Hellman key exchanges.
The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries from the 1.1.1 version and is provided for compatibility with previous releases.
Security Fix(es):
* openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A NULL pointer dereference vulnerability exists in the QUIC server initial packet handling in Microsoft products. This type of vulnerability can cause the affected software to crash or behave unexpectedly when processing certain network packets. No CVSS score or detailed technical exploit information is provided. There is no indication of known exploits in the wild or a confirmed patch at this time.
CVE-2026-42769 describes a vulnerability involving trust-anchor substitution due to a certificate or issuer typo in the CMP rootCaKeyUpdate process. This issue relates to improper validation of certificate or issuer names, potentially allowing an attacker to substitute a trusted root certificate. The vulnerability is associated with Microsoft products and related components including Azure Linux and OpenSSL versions mentioned. No CVSS score or detailed technical impact is provided. No patch or remediation information is currently available.
CVE-2025-2486 is a low-severity vulnerability in Ubuntu's edk2 UEFI firmware packages that allowed unintended access to the UEFI Shell in Secure Boot environments, potentially bypassing Secure Boot restrictions. The issue stems from active debug code that permitted the UEFI Shell to run despite Secure Boot protections. Versions 2024.05-2ubuntu0.3 and 2024.02-2ubuntu0.3 disable the Shell to mitigate this risk. This vulnerability builds on an incomplete fix for CVE-2023-48733. Exploitation requires local access and user interaction, with high attack complexity and no known exploits in the wild. The vulnerability primarily affects systems running Ubuntu with affected edk2 versions, and its impact on confidentiality, integrity, and availability is limited due to the constraints on exploitation.