CVE-2026-25705 is a high-severity path traversal vulnerability in SUSE Rancher's Extensions component. It allows a malicious UI extension to inject code by exploiting the compressedEndpoint field in a UIPlugin deployment. Successful exploitation can lead to overwriting Rancher binaries or configurations, tampering with cluster state, writing to the host filesystem if hostPath volumes are mounted, and chaining with other attack vectors. The vulnerability affects Rancher versions 2.10.11, 2.12.0, 2.13.0, and 2.
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
* freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)
* freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)
* freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951)
* freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)
* freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)
* freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)
* freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)
* FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues
The following security issues were fixed:
Dirty Frag fixes:
- CVE-2026-43500: supported.conf: drop rxrpc completely (bsc#1264450)
- CVE-2026-43284: xfrm: esp: avoid in-place decrypt on shared skb frags (bsc#1264449).
A timing attack vulnerability (CVE-2025-59432) in SCRAM authentication was fixed in the ongres-scram component as part of updates to several related projects including maven and Red Hat build of Quarkus 3.20.5. The update addresses this moderate severity security issue by correcting the SCRAM authentication mechanism to prevent timing attacks. Additional bug fixes and improvements were included in the updated versions of maven, maven-doxia, and related components.
This security update for raylib addresses two vulnerabilities: a heap-based buffer overflow in the GenImageFontAtlas function (CVE-2025-15533) and an integer overflow in LoadFontData (CVE-2025-15534). These issues could lead to memory corruption or crashes when processing font data. The update also includes numerous new features and improvements unrelated to security. No affected versions are explicitly stated in the provided data.
This update for MozillaFirefox fixes the following issues
Updated to Firefox Extended Support Release 140.10.2 ESR (bsc#1264378,MFSA 2026-41):
- CVE-2026-8090: Use-after-free in the DOM: Networking component.
- CVE-2026-8091: Incorrect boundary conditions in the Audio/Video: Playback component.
- CVE-2026-8092: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2.
- CVE-2026-8094: Other issue in the WebRTC component.
A vulnerability in the lxml library used by recon-ng allows XML External Entity (XXE) attacks via the default configuration of iterparse() and ETCompatXMLParser(). This enables untrusted XML input to read local files. The issue is addressed in lxml 6.1.0 by changing the default resolve_entities setting to 'internal', preventing local file access. Users can also mitigate by explicitly setting resolve_entities to 'internal' or false.
This update for nginx fixes the following issues
- CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is enabled
(bsc#1260415).
- CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file (bsc#1260420).
- CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the `ssl_ocsp` directives
are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229).
- CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module` module
(bsc#1265231).
- CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module`
(bsc#1265232).
- CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module` and
`ngx_http_uwsgi_module` modules (bsc#1265233).
Multiple security vulnerabilities have been identified and fixed in cpp-httplib, including server-side request forgery via header injection, denial of service through unsafe handling of compressed HTTP requests and crafted POST requests, information leakage through exception handling, and payload size limit bypass via gzip decompression. These issues could allow attackers to cause denial of service or leak sensitive information. The update addresses these vulnerabilities to improve the security of cpp-httplib.
A use-after-free vulnerability in the Linux kernel's futex subsystem related to requeue-PI operations has been fixed in a SUSE Linux Enterprise 16 live patch. The flaw involves a race condition where futex_wait_requeue_pi() can exit without proper synchronization, causing use of freed memory. The patch ensures proper reading of futex_q::task before updating the requeue state to maintain valid references during wake-up calls.
A security update for perl-Text-CSV_XS addresses CVE-2026-7111, a use-after-free vulnerability triggered when registered callbacks extend the Perl argument stack. This flaw may lead to type confusion or memory corruption. The issue is identified by SUSE Product Security Team and classified as high severity. No specific affected versions or patch details are provided in the available data.
This security update for log4cxx addresses multiple issues including incorrect encoding of non-ASCII characters in JSON output, invalid characters in XML output, program termination caused by recursive XML configuration references, possible undefined behavior during configuration changes, message loss during logging, and incorrect lifetimes of ODBCAppender prepared statement value buffers. The update includes changes up to versions 1.6.0 and 1.7.0. No specific affected versions are stated. The severity is assessed as medium.
This update for openCryptoki fixes the following issues
Security issue:
- CVE-2026-40253: Updated fix for malformed BER-encoded cryptographic objects
(bsc#1262283).
Non security issue:
- Refactored .spec file to fully support transactional and immutable operating systems
(jsc#PED-14609):
* Migrated user and group creation (pkcs11, pkcsslotd) from imperative %pre shell commands to
declarative systemd-sysusers configuration.
* Replaced manual /var directory tracking and %ghost directives with
comprehensive systemd-tmpfiles configurations.
* Implemented dynamic, architecture-specific tmpfiles.d generation to properly provision
hardware-specific token directories (e.g., ccatok, ep11tok, lite, and HSM_MK_CHANGE).
- Fixed permissions for /run/opencryptoki within tmpfiles.d to ensure the
daemon can successfully drop privileges and bind its communication socket.
* Moved 32-bit and 64-bit shared library symlink creation (such as PKCS11_API.so, stdll, and methods)
from %post scriptlets into the %install phase,
ensuring they are correctly packaged and tracked on the read-only /usr partition.
* Removed legacy /etc/pkcs11 bash migration logic from %post,
replacing it with a declarative tmpfiles.d symlink rule.
- Cleaned up scriptlets to only execute transaction-safe macros
(such as ldconfig and systemd service handlers).
This update for c-ares fixes the following issue
- CVE-2025-62408: use after free in read_answers() (bsc#1254738).
Changes for c-ares:
- c-ares 1.35.6:
* Ignore Windows IDN Search Domains until proper IDN support is
added
* Various bug fixes
A security update for the Cairo graphics library addresses CVE-2025-50422, which causes a crash in the Poppler component when processing malformed input. The vulnerability has been rated as low severity. No specific affected versions or patch details are provided in the available data.
Red Hat has issued a security advisory for python3.11 addressing two vulnerabilities: a use-after-free flaw in decompression modules (CVE-2026-6100) and a command injection vulnerability in the webbrowser.open() API (CVE-2026-4786). Both issues could lead to arbitrary code execution or information disclosure. The advisory applies to Red Hat Enterprise Linux 9.6 Extended Update Support and related products. Red Hat rates the update as Important and provides updated packages to remediate these vulnerabilities.
This update for libtpms fixes the following issues:
- CVE-2025-49133: Fixed potential out of bounds (OOB) read vulnerability (bsc#1244528).
- CVE-2026-21444: Fixed remote data confidentiality compromise via incorrect Initialization Vector (IV) handling
(bsc#1260439).
This security update for python-Django addresses three vulnerabilities: a potential denial-of-service via ASGI request file upload limit bypass, session fixation through public cached pages combined with SESSION_SAVE_EVERY_REQUEST, and potential exposure of private data due to incorrect handling of Vary: * header in UpdateCacheMiddleware. These issues could impact application stability, session security, and data privacy. The update fixes these vulnerabilities to improve overall security.
A security update for kf6-kcoreaddons addresses a vulnerability identified as CVE-2026-41526. The issue involves improper shell argument quoting that could allow arbitrary code execution. This vulnerability has been fixed in the update provided by the SUSE Product Security Team. No specific affected versions are stated. No known exploits are reported in the wild.