This update includes the following RPMs:
grafana12.4:
* grafana12.4-12.4.13-0.2.hum1 (aarch64, x86_64)
* grafana12.4-12.4.13-0.2.hum1.src (src)
Security Fix(es):
grafana12.4:
* CVE-2026-111943
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through 1.13.22.
e107 CMS versions from 2.2.0 up to but not including 2.3.13 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious HTML and JavaScript by manipulating the author GET parameter in search.php. The vulnerability arises because the author parameter is parsed and concatenated unescaped into an HTML input tag, enabling script injection. The issue is fixed in version 2.3.13.
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 10.0.113
Runtime version: 10.0.13
Security Fix(es):
* dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)
* dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
* dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
* dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
* dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)
* dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
* dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
* dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
* dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183)
* dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
* dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
* dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
* dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
* dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707)
* dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
* dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230)
* dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
* dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)
* dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)
* dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
* dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)
* dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957)
Bug Fix(es) and Enhancement(s):
* Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [rhel-9.8.z] (JIRA:RHEL-277808)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-113730 is a medium severity vulnerability in the OGNL (Object Graph Navigation Library) for Java affecting specific versions 2.7.3-5 through 2.7.3-9. The vulnerability has a CVSS score of 5.6, indicating a network attack vector with high attack complexity and no privileges or user interaction required, impacting confidentiality, integrity, and availability to a low extent. No public exploit or known active exploitation is reported. The affected versions are explicitly identified, but no patch or remediation details are provided in the available data.
A high-severity vulnerability (CVE-2026-113726) affects multiple specific versions of the Python virtualenv tool, which is used to create isolated Python environments. The vulnerability has a CVSS 3.1 score of 7.8, indicating significant impact on confidentiality, integrity, and availability. It requires local access with low attack complexity and no privileges but user interaction. The vulnerability is published but no official patch or remediation details are provided in the available data.
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 10.0.113
Runtime version: 10.0.13
Security Fix(es):
* dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)
* dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
* dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
* dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
* dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)
* dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
* dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
* dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
* dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183)
* dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
* dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
* dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
* dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
* dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707)
* dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
* dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230)
* dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
* dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)
* dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)
* dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
* dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)
* dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957)
Bug Fix(es) and Enhancement(s):
* Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 (JIRA:RHEL-277805)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 contain a vulnerability where the software binds to an unrestricted IP address. This flaw could allow a remote attacker to obtain sensitive information. The vulnerability is identified as CWE-1327 and has a critical CVSS score of 9.8.
CVE-2026-91517 is a vulnerability in the Oracle Management Pack for Oracle GoldenGate (EM Plugin component) affecting versions 13.4.1.0.1 through 13.5.2.0.6. It allows an unauthenticated attacker with physical access to the communication segment attached to the hardware running the product to compromise it. Successful exploitation requires human interaction by someone other than the attacker and can lead to full takeover of the Oracle Management Pack for Oracle GoldenGate. The vulnerability has a CVSS 3.1 base score of 8.0, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-101549 is a vulnerability in Oracle Application Testing Suite version 13.3.0.1 affecting the OpenScript component. It allows a low privileged attacker with access to the infrastructure where the suite runs to compromise the application, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-101548 is a vulnerability in Oracle Application Testing Suite version 13.3.0.1, specifically in the OpenScript component. It allows a low privileged attacker with logon access to the infrastructure where the suite runs to potentially compromise the application. Exploitation is difficult but can lead to full takeover of Oracle Application Testing Suite. The vulnerability has a CVSS 3.1 base score of 7.0, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-101529 is a critical vulnerability in Oracle Enterprise Manager for Oracle Database, specifically in the Data Guard Management component. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability affects versions 13.5 and 24.1. The CVSS 3.1 base score is 9.9, indicating severe confidentiality, integrity, and availability impacts. Attacks exploiting this flaw may also impact additional Oracle products due to scope change. Oracle has released patches addressing this vulnerability in their October 2026 Critical Patch Update.
CVE-2026-101528 is a critical vulnerability in Oracle Enterprise Manager for Oracle Database, specifically in the Data Guard Management component. It affects versions 13.5 and 24.1. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 9.9, indicating severe confidentiality, integrity, and availability impacts. Attacks exploiting this vulnerability may also affect additional Oracle products due to scope change. Oracle has released patches for this and many other vulnerabilities in its October 2026 Critical Patch Update advisory.
CVE-2026-101527 is a high-severity vulnerability in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1. It allows a low privileged attacker with logon access to the infrastructure where the platform runs to compromise the platform, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains multiple security patches across various products. Users are strongly advised to apply the relevant patches promptly to mitigate this risk.
CVE-2026-101526 is a high-severity vulnerability in Oracle Enterprise Manager for Siebel, specifically in the Configuration Management component. It affects versions 13.5 and 24.1. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches addressing this vulnerability as part of its October 2026 Critical Patch Update.