A denial of service vulnerability exists in the libpcap library due to an infinite loop in the BPF interpreter. This issue affects Red Hat Enterprise Linux 9.8 Extended Update Support and related products. The vulnerability is identified as CVE-2026-6554 and has been rated with an important security impact by Red Hat. A security update is available to address this issue.
A use-after-free vulnerability (CVE-2026-108094) was identified in the mutter compositing window manager, specifically in the Wayland color-management ICC image description path. Mutter manages desktop display through OpenGL and inherits window-management logic from Metacity. This vulnerability is client-triggered and affects Red Hat Enterprise Linux 10.2 Extended Update Support and related CodeReady Linux Builder products. Red Hat has issued a security advisory and released updates to address this issue.
CVE-2026-125637 is a vulnerability in the Konflux UI proxy where hostname values from the KonfluxUI custom resource are inserted into proxy configuration files without proper validation. An authenticated user with permission to modify this resource can inject malicious configuration directives to bypass authentication and authorization controls, potentially exposing internal backend services. Malformed input can also cause the proxy configuration generator to fail, resulting in a denial of service by preventing the proxy from starting.
A security vulnerability (CVE-2026-96541) was identified in GNOME Remote Desktop, a remote desktop and screen sharing service for the GNOME desktop environment. The issue involves unauthenticated RDP sockets lacking a handshake deadline, which could potentially lead to resource exhaustion. Red Hat has issued a security update for Red Hat Enterprise Linux 10.2 Extended Update Support to address this moderate severity flaw.
A security update for Mozilla Firefox and Thunderbird addresses multiple vulnerabilities including numerous use-after-free bugs, sandbox escapes, privilege escalations, information disclosures, spoofing, and site isolation issues across various components such as JavaScript GC, DOM, Graphics, Audio/Video, Networking, and Security. These vulnerabilities could allow attackers to escape sandbox restrictions, escalate privileges, disclose information, or bypass security mitigations. The update is rated as important by Red Hat Product Security and applies to Red Hat Enterprise Linux 8 Firefox packages.
A security vulnerability (CVE-2026-116591) affecting the Grafana plugin for Performance Co-Pilot in Red Hat Enterprise Linux 9 allows denial of service via crafted zstd compressed input. This issue is related to the klauspost/compress library used for zstd compression. Red Hat has issued an important security update to address this vulnerability.
A security vulnerability in GNU Emacs, specifically in Flymake mode, allows for arbitrary code execution. This issue is addressed by a security update released by Red Hat for Red Hat Enterprise Linux 9. The vulnerability is identified as CVE-2026-96442 and is rated as having an important security impact by Red Hat Product Security.
A security update for Grafana addresses two vulnerabilities: an Azure Monitor data source in Grafana could leak its Azure access token (CVE-2026-88967), and a denial of service vulnerability exists in the klauspost/compress zstd library via crafted compressed input (CVE-2026-116591). Red Hat has released patches for these issues in Red Hat Enterprise Linux 10.2 Extended Update Support and related variants.
A security vulnerability (CVE-2026-121629) exists in the gst-plugins-good component of the GStreamer multimedia framework used in Red Hat Enterprise Linux 10.2 Extended Update Support. The flaw involves local file disclosure through unvalidated file:// URIs in the adaptivedemux2 manifest handling. Red Hat has issued an important security update to address this issue.
A security advisory from Red Hat addresses multiple vulnerabilities in Apache Tomcat 9, including improper input validation, authentication bypass, HTTP/2 header validation issues, information disclosure during WebSocket authentication, improper authorization, case sensitivity handling flaws, security constraint bypass via URL encoding, and insufficient documentation that may lead to insecure configurations. These issues have been rated with moderate severity and affect Red Hat Enterprise Linux 10 distributions. Updates are available to remediate these vulnerabilities.
A stack buffer overflow vulnerability exists in the H.266/VVC parser of the gstreamer1-plugins-bad-free package used in Red Hat Enterprise Linux 10.2 Extended Update Support. This flaw is tracked as CVE-2026-119777 and has been rated with high severity by Red Hat Product Security. The issue is addressed by an update to the gstreamer1-plugins-bad-free package version 1.26.7-2.el10_2.8. The vulnerability could potentially allow an attacker to cause a denial of service or possibly execute arbitrary code via crafted media data. Red Hat has released patches for multiple architectures including x86_64, s390x, ppc64le, and aarch64. Users of affected Red Hat Enterprise Linux 10.2 Extended Update Support versions are advised to apply the update promptly.
A denial of service vulnerability (CVE-2026-102554) exists in Google Guava due to unthrottled memory allocation during deserialization. This flaw can cause excessive memory consumption leading to service disruption. Red Hat has issued a security advisory and released updates for Guava in Red Hat Enterprise Linux 9.8 Extended Update Support and related variants to address this issue.
A security vulnerability (CVE-2026-125712) was identified in the gst-plugins-base component of GStreamer, a streaming media framework. The flaw involves missing bounds checks in the parsing of RTCP SDES packets. Red Hat has issued an important security update for gstreamer1-plugins-base in Red Hat Enterprise Linux 10 to address this issue.
A security vulnerability (CVE-2026-43961) in Vim's netrw plugin allows arbitrary code execution via Vimscript injection through an unescaped filename in the s:NetrwMarkFile() filter() expression. This issue affects Red Hat Enterprise Linux 10.2 Extended Update Support and related variants. The vulnerability has been rated as important by Red Hat Product Security. An update fixing this vulnerability is available in the vim package version 9.1.083-26.el10_2 for affected Red Hat Enterprise Linux distributions.
Multiple security vulnerabilities were identified in the perl-CGI module used in Red Hat Enterprise Linux 10.2 Extended Update Support. These include a denial of service via unenforced request and upload limits, arbitrary file write through unsanitized upload filenames, and a security feature bypass via untainted request parameters. Red Hat has issued an important security advisory with updates to address these issues.
A use-after-free vulnerability (CVE-2026-33416) in the MinGW Windows Libpng library allows for arbitrary code execution. This security issue affects the mingw-libpng package in Red Hat Enterprise Linux 8. Red Hat has issued a security advisory rating this vulnerability as moderate impact and has released an update to address it.