Red Hat has issued a security advisory for nodejs26 on Red Hat Enterprise Linux 10 addressing three vulnerabilities in the undici HTTP client library. These include an authentication bypass via cross-origin cache poisoning (CVE-2026-85152), a TLS certificate validation bypass in BalancedPool due to dropped connect options (CVE-2026-84961), and a denial of service via an unrequested WebSocket subprotocol (CVE-2026-19534). The update rebases nodejs26 to the latest Node.js 26 release and includes bug fixes and enhancements. The vulnerabilities are rated as important by Red Hat Product Security. The advisory provides updated packages to remediate these issues.
Two denial of service vulnerabilities have been identified in the python-jwcrypto library used in Red Hat Enterprise Linux 10. One vulnerability involves malformed JWE tokens causing denial of service (CVE-2026-80179), and the other involves an O(n^2) duplicate check on an unbounded JWK key_ops array leading to denial of service (CVE-2026-92091). Red Hat has issued a security update to address these issues.
Intel and AMD disclosed over 200 vulnerabilities across their products, including critical flaws in Intel's TDX software and multiple high-severity bugs in AMD graphics and firmware components. Intel's advisories cover more than 100 vulnerabilities with three critical issues in TDX MigTD software, including one that could allow remote code execution. AMD's advisories include high-severity vulnerabilities affecting Radeon and Instinct graphics products, UEFI firmware, and Secure Encrypted Virtualization. While fixes are available for most vulnerabilities, some AMD mitigations remain pending, and Intel has discontinued one affected product with no patches planned.
Red Hat has issued a security advisory for OpenSSH addressing three vulnerabilities: an SFTP security bypass due to a command-line argument parsing flaw (CVE-2026-59997), an undocumented GSSAPIStrictAcceptorCheck behavior affecting Windows Active Directory security (CVE-2026-59998), and a denial of service via excessive GSSAPI authentication attempts (CVE-2026-60000). These issues impact OpenSSH implementations on Red Hat Enterprise Linux 10 across multiple architectures. The update is rated as having a moderate security impact.
CVE-2026-126626 is a vulnerability in Progressive Robot Ltd's hMailServer versions 6.3.3 through 6.3.7 involving an overly restrictive account lockout mechanism. The web services listener counts failed sign-in attempts from trusted proxies against the proxy's own IP address rather than the individual client IPs. This can cause legitimate mail clients behind the proxy to be auto-banned from accessing SMTP, POP3, IMAP, and ManageSieve services for a default period of 60 minutes after three failed attempts within 30 minutes. The issue affects setups using trusted proxies, including those on the same machine or listed in WebServicesTrustedProxies, and results in denial of service for legitimate users behind those proxies.
CVE-2026-126621 is a high-severity vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0-B1 through 6.3.7 on Windows. It involves improper certificate validation due to how OpenSSL handles TLS file names encoded as Latin-1 bytes versus UTF-8. This discrepancy allows a local attacker with file creation privileges to substitute certificate files, enabling unauthorized client certificate authentication, interception and modification of stored messages, access to private keys used by the ACME client, or denial of TLS port startup. The vulnerability requires non-default configurations with non-ASCII file names and enabled client certificates or object store/ACME features. Linux builds are not affected.
A path traversal vulnerability (CVE-2026-79655) exists in the sos package used by Red Hat Enterprise Linux 10. The flaw occurs during tar extraction in the sos clean utility, where unvalidated symlink and hardlink targets can lead to arbitrary file writes. This security issue has been addressed in an update to the sos package.
A critical security vulnerability (CVE-2026-53939) was identified in the cjose C library, which implements Javascript Object Signing and Encryption (JOSE). The flaw involves the use of an all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption, potentially compromising encryption security. Red Hat has issued an update for cjose in Red Hat Enterprise Linux 10 to address this issue.
The humbility-shared PyPI package versions 0.0.1 and 0.0.2 contain malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
A security vulnerability in the hickory-resolver component of the rust-sequoia-sq package for Red Hat Enterprise Linux 10 allows DNSSEC validation bypass, which can enable attackers to forge DNS records. This issue is tracked as CVE-2026-93657 and has been rated with an important security impact by Red Hat. An update is available to address this vulnerability.
CVE-2026-126619 is a vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0-B1 through 6.3.7. It involves misinterpretation of SQL statement text in the database layer, causing failed database writes to be reported as successful under certain conditions. This can lead to message deliveries being falsely acknowledged without actual database records, auto-ban IP ranges not being properly applied, and loss of message metadata or log entries without error notification. The flaw does not allow altering statement behavior or privilege escalation.
CVE-2026-126617 is a high-severity SQL injection vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0-B1 through 6.2.18. It affects the database layer when using MySQL, MariaDB, or PostgreSQL as the backend. The vulnerability arises because parameters are not properly bound, allowing crafted input to alter SQL statements executed by the server. This can be triggered by authenticated users sending mail or by unauthenticated remote senders via certain automated server messages. The flaw allows execution of SQL with the database account's privileges, with PostgreSQL allowing multiple statements per call. SQL Server and SQL Server Compact are not affected. No known exploits are reported in the wild, and no patch links are provided.
CVE-2026-126618 is a vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0-B1 through 6.3.7 that allows an attacker to bypass the auto-ban mechanism designed to restrict excessive authentication attempts. Due to a flaw in how the server names and stores IP ban ranges based on user names, attackers can avoid bans by using user names of certain lengths or containing special characters, enabling repeated password guessing attempts over multiple protocols without being blocked.
CVE-2026-126616 is a vulnerability in Progressive Robot Ltd's hMailServer versions 6.2.0 through 6.3.3 that affects the auto-ban mechanism for repeated failed logon attempts when using MySQL or MariaDB databases. Due to character encoding mismatches between the server and the database, the server fails to save ban entries for certain usernames containing characters outside the Basic Multilingual Plane, allowing an attacker to bypass the auto-ban and continue guessing passwords from a single IP address without being blocked.
CVE-2026-126615 is an authentication bypass vulnerability in Progressive Robot Ltd hMailServer versions 6.2.22-pre2 through 6.3.7. The issue arises because the server's database comparison allows multiple alternate spellings of account names, which are treated as distinct for lockout and compromised-account hold mechanisms but map to the same underlying account password check. This enables attackers to bypass per-name lockout thresholds by guessing passwords under different name spellings and allows signing in with a valid password under alternate spellings even if the account is held for review. The vulnerability affects multiple database backends with varying behaviors in name comparison and folding.
Progressive Robot Ltd hMailServer versions 6.3.3 through 6.3.7 have a vulnerability in the web services listener where IP-based auto-ban restrictions are not applied. This allows remote unauthenticated attackers to continue guessing account passwords via the listener's sign-in interface even after their IP address has been banned on other protocols. The listener does not enforce IP bans properly, enabling repeated authentication attempts behind TLS-terminating proxies or from banned IPs. The flaw affects the CardDAV, CalDAV, and Outlook Autodiscover services over HTTPS. The vulnerability has a medium severity with a CVSS score of 5.3 and does not have known exploits in the wild. The listener is off by default, and no official patch information is provided in the data.
CVE-2026-126625 is a vulnerability in Progressive Robot Ltd's hMailServer 6.3.7 Windows installer where incorrect default permissions during installation allow a local authenticated user to execute code with administrator privileges. This occurs if the software is installed into a new program folder located in a directory with permissive write access, such as the root of a drive. The installer temporarily creates the program folder with inherited permissions before restricting them, allowing an attacker to place malicious files that run with elevated rights during setup. The default installation location under Program Files is not affected.
CVE-2026-126624 is a high-severity vulnerability in Progressive Robot Ltd's hMailServer version 6.3.7. It involves unverified ownership in the Windows installer, allowing a local authenticated user to execute code with elevated privileges if the installation or upgrade occurs in a folder writable by non-administrators. The default installation under Program Files is not affected. This flaw arises because the installer does not change ownership or permissions of pre-existing files or folders that may be controlled by other accounts, enabling privilege escalation via malicious binaries or scripts loaded by the service.
CVE-2026-126623 is a high-severity vulnerability in Progressive Robot Ltd's hMailServer versions 6.3.6 and 6.3.7. It involves inefficient algorithmic complexity in the JSON reader, which can be exploited remotely by unauthenticated attackers to hold mail delivery threads or REST API worker threads. This results in denial of service by making mail delivery, the REST API, and webmail unavailable. The issue arises from the JSON reader's hash set implementation, which can be forced to degrade performance quadratically with specially crafted JSON objects up to 16 MB in size.
CVE-2026-126622 is a vulnerability in Progressive Robot Ltd's hMailServer version 6.3.7 involving incorrect default permissions in the Windows installer. When the server is installed into a pre-existing program folder writable by non-administrators, or during upgrade/repair, a local authenticated user can execute code with administrator privileges. This occurs because setup initially copies files into a Bin folder with write permissions for all users and runs elevated programs before restricting permissions, allowing malicious libraries to be loaded. The default installation under Program Files is not affected.