Multiple security vulnerabilities were identified in the curl and libcurl components provided by Red Hat Enterprise Linux 9.6 Extended Update Support. These include authentication bypasses, information disclosure through OAuth2 token leakage and Digest authentication header reuse, man-in-the-middle attacks via SSH host key bypass, security feature bypasses due to improper mutual TLS connection reuse, insecure TLS connection establishment, unauthorized connection reuse, cookie injection via malicious HTTP servers, and proxy authentication state leakage. Red Hat has issued an important security update addressing these issues.
Multiple security vulnerabilities have been identified in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include denial of service conditions via crafted commands and out-of-bounds reads, as well as remote code execution through heap buffer overflows and uninitialized heap memory disclosure. The vulnerabilities affect Red Hat Enterprise Linux 8.8 variants and have been rated with an important security impact by Red Hat. Updates addressing these issues are available.
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
Multiple security vulnerabilities have been identified and fixed in Apache Tomcat as distributed by Red Hat Enterprise Linux 9.8. These include security constraint bypass, access control bypass due to an off-by-one error, improper input validation allowing HTTP/2 no-authority bypass of strict SNI validation, improper authentication from principal lookup failure, authentication bypass via replay attack in DIGEST authenticator, unauthorized resource access via FORM authentication bypass, and denial of service via HTTP/2 allocation leak. Red Hat has released updated packages addressing these issues for various architectures and product variants.
Multiple security vulnerabilities have been identified in nginx, a widely used web and proxy server. These include code execution, denial of service, heap-based buffer overflow, heap buffer over-read, and memory disclosure issues affecting various nginx modules such as ngx_http_rewrite_module, HTTP/2 header processing, and ngx_http_slice_module. Red Hat has issued an important security advisory with updates for Red Hat Enterprise Linux 9.4 to address these vulnerabilities.
.NET 8.0 on Red Hat Enterprise Linux contains security vulnerabilities including an out-of-bounds write in the Google Brotli decoder (CVE-2026-111497) and an elevation of privilege vulnerability in ASP.NET Core (CVE-2026-114148). These issues have been addressed in updated SDK and runtime versions. The update is rated as important by Red Hat Product Security.
CVE-2026-120342 is a SQL injection vulnerability in the mathurvishal CloudClassroom-PHP-Project. The flaw exists in an unknown function within the file viewquery.php, where manipulation of the 'eid' argument allows remote attackers to execute SQL injection attacks. Exploit code is publicly available. The product uses a rolling release model, so specific affected or fixed versions are not provided. The vendor did not respond to early disclosure attempts.
CVE-2026-120341 is a security vulnerability in the mathurvishal CloudClassroom-PHP-Project affecting an unknown function within studentdetails.php. The flaw allows execution after a redirect, which can be exploited remotely without authentication. The vulnerability has been publicly disclosed, but no vendor response or patch information is available. The product uses a rolling release model, so specific affected or fixed versions are not provided.
A moderate security vulnerability (CVE-2025-11395) exists in the podman tool used for managing container pods and images. The flaw allows arbitrary file write during the import of an OCI archive. This vulnerability affects Red Hat Enterprise Linux 10 and related products. A security update addressing this issue is available from Red Hat.
A weakness has been identified in mathurvishal CloudClassroom-PHP-Project. This issue affects some unknown processing of the component Global Session Handler. Executing a manipulation can lead to session expiration. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been made available to the public and could be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
A security update for the Linux kernel in Red Hat Enterprise Linux 8 addresses multiple vulnerabilities including use-after-free bugs, improper pointer refreshes in IPv6 extension headers, privilege escalation, and input validation issues. The update fixes several CVEs such as CVE-2026-63922, CVE-2026-63924, CVE-2026-64109, CVE-2026-72083, CVE-2026-74283, and CVE-2026-93787. The kernel is a critical component of the operating system, and these fixes improve overall system security. Red Hat recommends applying the update and rebooting the system to ensure protection.
A stack overflow vulnerability (CVE-2026-14330) was identified in the Pulse Server component of PipeWire, a multimedia server for Linux and Unix-like systems. Red Hat has issued a security advisory for this vulnerability affecting Red Hat Enterprise Linux 10 and related variants. The vulnerability is rated as moderate in severity. An update to PipeWire is available to address this issue.
A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project. This vulnerability affects unknown code of the file updatedetailsfromfaculty.php. Performing a manipulation of the argument fname results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.
.NET 9.0 on Red Hat Enterprise Linux contains an elevation of privilege vulnerability in ASP.NET Core identified as CVE-2026-114148. This security issue affects multiple .NET versions including 8.0, 9.0, 10.0, and 11.0. Red Hat has released security updates for these versions as part of their Extended Update Support for RHEL 10.0. The vulnerability allows an attacker to gain elevated privileges, potentially compromising system security.
A denial of service vulnerability (CVE-2026-94286) exists in the X.Org X11 libXtst runtime library due to an out-of-bounds read in the RECORD reply parser. This issue affects Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related variants. Red Hat has issued a security advisory with an update to address this vulnerability.
Multiple heap buffer overflow vulnerabilities have been identified in the libsoup HTTP client and server library for GNOME. These vulnerabilities arise from WebSocket handling issues including Pong signal type confusion, message reassembly, receive-buffer growth, and client-frame masking. Red Hat has issued security updates addressing these flaws in Red Hat Enterprise Linux 8.8 variants.