This update for tree-sitter fixes the following issue
- CVE-2026-44216: wasmtime: allocation of a table exceeding the size of the host's address space leads to panic
(bsc#1265300).
Multiple security vulnerabilities have been identified and addressed in the php:8.2 module for Red Hat Enterprise Linux 9. These include a denial of service via improper handling of signed characters in ctype functions, a cross-site scripting vulnerability in PHP-FPM due to improper URL sanitation, a NULL pointer dereference in the SOAP apache:Map decoder, and a signed integer overflow in the metaphone() function. Red Hat has released an important security update to fix these issues.
This security update for PuTTY version 0.84 addresses multiple vulnerabilities including remotely triggerable double-free and crash issues in cryptographic operations, as well as a potential proxy authentication spoofing risk. Additional improvements include new features and bug fixes unrelated to security. The update fixes critical memory corruption and authentication issues that could be exploited remotely.
This update for roundcubemail fixes the following issues:
Changes in roundcubemail:
- update to 1.6.16
+ Fix potential too long value in IMAP ID command (#10136)
+ Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog [CVE-2026-48849] [bsc#1266337]
+ Security: Fix CSS injection bypass in HTML sanitizer via SVG 'animate attributeName="style"' [CVE-2026-48848] [bsc#1266336]
+ Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass [CVE-2026-48842] [bsc#1266329]
+ Security: Fix SSRF bypass via specific local address URLs [CVE-2026-48843] [bsc#1266331]
+ Security: Fix bypass of remote image blocking via CSS var() [CVE-2026-48846] [bsc#1266334]
+ Security: Fix local/private URL fetch bypass when remote resources were not allowed [CVE-2026-48845] [bsc#1266333]
+ Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass [CVE-2026-48847] [bsc#1266335]
+ Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option [CVE-2026-48844] [bsc#1266332]
This update for python-urllib3 fixes the following issue
- CVE-2026-44431: sensitive information disclosure due to sensitive headers being forwarded across origins in proxied
low-level redirects (bsc#1265267).
This update for postgresql14 fixes the following issues
Update to version 14.23.
Security issues:
- CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
- CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
- CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
- CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
- CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
- CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
- CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
- CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
Non security issue:
- Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and transactional
updates (jsc#PED-14823).
- /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).
A security update for csync2 addresses CVE-2026-41051, which involves the use of insecure temporary directories when the software is compiled with C99 or later standards. This vulnerability affects specific SUSE versions of csync2 on aarch64 and i586 architectures. The issue could potentially lead to security risks related to temporary file handling. The severity is assessed as medium. No known exploits are reported in the wild. A patch or update has been issued by the SUSE Product Security Team to fix this vulnerability.
This update for openexr fixes the following issue
- CVE-2026-41142: integer overflow in `ImageChannel: resize` can lead to a heap out-of-bounds write via OpenEXRUtil
public API (bsc#1264356).
Multiple vulnerabilities in perl-Net-CIDR-Lite can lead to IP ACL bypass due to improper validation of IP address formats and CIDR mask values. These include issues with trailing newlines or non-ASCII digits, extraneous leading zeros in CIDR masks, missing validation of IPv6 group counts, and mishandling of IPv4 mapped IPv6 addresses. The vulnerabilities affect SUSE Linux Enterprise Module for Development Tools 15 SP7 and related versions. No known exploits are reported in the wild. A security update addressing these issues has been released by the SUSE Product Security Team.
This update for python-python-multipart fixes the following issues
- CVE-2026-40347: crafted `multipart/form-data` can cause a denial of service (bsc#1262403).
- CVE-2026-42561: denial of service vulnerability in multipart part header parsing (bsc#1265250).
A security update for python-Pillow addresses three vulnerabilities: an integer overflow in font processing causing denial of service, a heap buffer overflow when processing nested list coordinates, and an infinite loop with resource exhaustion triggered by specially crafted PDFs. These issues can lead to denial of service conditions. The vulnerabilities are identified as CVE-2026-42308, CVE-2026-42309, and CVE-2026-42310. No specific affected versions or patch details are provided in the input data.
This security update for Apptainer addresses multiple vulnerabilities, including CVE-2024-45310 and several CVE-2026 series issues. The update includes fixes for at least 13 CVEs and updates dependencies such as golang.org/x/crypto and golang.org/x/net to newer versions. The update also integrates vulnchecker optionally into the build process and synchronizes with the Factory version to ensure comprehensive vulnerability mitigation.
Multiple security vulnerabilities were found and fixed in the Vim text editor, including command injection flaws in the NetBeans interface, netrw plugin, and tar decompression, as well as a heap buffer overflow in spell file processing. These vulnerabilities could allow arbitrary file reads, writes, or code execution. The issues are resolved by updating Vim to version 9.2.0530.
This update for python-mistune fixes the following issues
- CVE-2026-33079: ReDoS in `LINK_TITLE_RE` can lead to denial of service via a crafted Markdown (bsc#1264347).
- CVE-2026-33441: processing of malformed reference links can lead to excessive resource consumption and denial of
service (bsc#1264752).
- CVE-2026-44708: improper HTML escaping in the math plugin can lead to XSS (bsc#1264751).
- CVE-2026-44896: improper escaping in `render_figure` can lead to attribute injection and XSS (bsc#1264754).
- CVE-2026-44897: improper sanitization of user-controlled input in `HTMLRenderer.heading` can lead to XSS
(bsc#1264750).
- CVE-2026-44898: improper sanitization of user-supplied HTML input in `render_toc_ul` can lead to XSS (bsc#1265052).
- CVE-2026-44899: improper input verification in Image directive plugin and improper escaping in `render_block_image`
can lead to CSS injection (bsc#1265053).
Two security vulnerabilities were identified in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. The first vulnerability (CVE-2026-34078) allows arbitrary code execution via crafted symlinks in sandbox-expose options. The second vulnerability (CVE-2026-34079) permits arbitrary file deletion on the host due to improper cache file path validation. These issues affect Red Hat Enterprise Linux Server Extended Life Cycle Support 7 on multiple architectures. Red Hat has issued a security update to address these vulnerabilities.
Multiple vulnerabilities in localsearch related to parsing MP3 files and ID3 tags could lead to denial of service or information disclosure. These include heap buffer overflows and issues triggered by malformed or crafted MP3 files. The vulnerabilities have been fixed in a security update by the SUSE Product Security Team.