A security update for the Transmission software addresses CVE-2026-38978 by adding clickjacking safeguards when serving HTTP responses. This update mitigates the risk of clickjacking attacks by implementing protective measures in the HTTP response handling. No specific affected versions are provided. The vulnerability is assessed as medium severity based on the impact description.
Multiple security issues were addressed in the python3-onionshare package version 2.6.4-1.1 for openSUSE Tumbleweed. These vulnerabilities affect versions prior to 2.6.4. The issues are related to CWE-59, indicating potential symbolic link (symlink) attacks or similar file path vulnerabilities. The package update fixes these security problems to improve the software's security posture.
A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service.
A Rancher FleetWorkspace admission path allowed side effects to occur in
the Rancher webhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to 0.8.7, 0.9.0 up to 0.9.6 and 0.10.0 up to 0.10.7. An unauthenticated attacker with network access to
the in-cluster rancher-webhook service
could submit a crafted admission payload and cause workspace-related
Kubernetes objects to be created with attacker-chosen identity data.
A missing clean-up in the legacy Project Role Template Binding (PRTB)
reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users to retain unauthorized Pod Security
Admission (PSA) permissions after an administrator removes those
permissions from a RoleTemplate.
A SAML authentication replay vulnerability in Rancher's Assertion
Consumer Service (ACS) handler did not enforce
one-time use of SAML assertion, potentially allowing person in the middle attacks against Rancher, affecting Rancher 2.14.0 before 2.14.3,
Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.
This security update for MuPDF addresses multiple issues including two specific vulnerabilities: CVE-2025-55780, a null pointer dereference in the function break_word_for_overflow_wrap(), and CVE-2026-25556, a double-free vulnerability in fz_fill_pixmap_from_display_list(). The update also introduces changes such as building MuPDF as a shared library instead of static-only, and numerous bug fixes and improvements across versions 1.25.4 through 1.27.2. These vulnerabilities could cause application crashes or memory corruption. The update is provided by the SUSE Product Security Team and is classified as high severity. No explicit patch links or affected versions are stated, and no CVSS score is available.
This security update for coturn addresses multiple issues through version upgrades from 4.10.0 to 4.14.0, including security hardening, bug fixes, and new features such as rate limiting unauthorized responses to reduce reflection attacks. The update includes fixes for memory leaks, out-of-bounds reads, format-string injection, and improvements in TLS and Redis support. No specific CVE details or exploit information are provided, but the update is classified as high severity.
This security update for lrzip addresses multiple vulnerabilities including use-after-free and NULL pointer dereference issues triggered by corrupt or malicious archives and improper command-line parameters. The update to version 0.660 fixes these issues by improving thread cleanup, handling of command-line options, and adding bounds and sanity checks. Additional portability and build fixes are also included.
This security update for python-pytest-html addresses vulnerabilities in its dependencies shell-quote and js-yaml. The shell-quote vulnerability (CVE-2026-13311) involves inefficient input parsing that can lead to denial of service. The js-yaml vulnerability (CVE-2026-53550) involves quadratic complexity when processing crafted YAML documents, potentially causing CPU exhaustion. Both issues are fixed by updating the respective dependencies.
This security update provides a functional equivalent of RHSA-2026:33514.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:33514.
This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.30.1 fixes various security issues
The following security issues were fixed:
- CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
- CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
- CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
- CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
- CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
- CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
- net/sched: fix pedit partial COW leading to page cache (bsc#1267625).
Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.
A security update for GIMP addresses a vulnerability identified as CVE-2026-40917 related to the cleanup of ICNS file loading in plug-ins. The update fixes issues that could potentially affect the security of the application. No specific affected versions are stated in the available information.
A security update for python-biopython addresses CVE-2025-68463, an information disclosure vulnerability caused by an XML External Entity (XXE) issue. This vulnerability could allow unauthorized disclosure of information. The update fixes this issue to prevent such disclosure. No specific affected versions are stated. No CVSS score is provided, but the severity is assessed as medium.