This update for python-Mako fixes the following issue:
- CVE-2026-41205: Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal (bsc#1262716).
A security update for python-jwcrypto addresses a vulnerability (CVE-2026-39373) involving weak mitigation against a JWT bomb attack in the deserialize function. This flaw can lead to memory exhaustion when processing crafted compressed JWE tokens. The issue affects certain versions of python-jwcrypto distributed with Red Hat Enterprise Linux 10 and related SUSE products. Red Hat has released patches to fix this vulnerability and rated the security impact as low. No known exploits are reported in the wild.
A cryptographic bypass vulnerability in libsodium was addressed by a security update. The issue, identified as CVE-2025-15444, is caused by improper elliptic curve point validation, which could undermine the cryptographic guarantees of the library. The vulnerability has been fixed in libsodium versions 1.0.20-160000.3.1 and later.
Multiple vulnerabilities have been identified in webkit2gtk3, the GTK port of the WebKit web rendering engine, affecting Red Hat Enterprise Linux 9.6 Extended Update Support. These vulnerabilities include crashes, denial-of-service, information disclosure, bypass of security policies such as Same Origin Policy and Content Security Policy, user tracking via Safari web extensions, fingerprinting, and cross-site scripting attacks triggered by processing maliciously crafted web content or visiting malicious websites. Red Hat has issued an important security update addressing these issues.
A heap-based buffer overflow vulnerability exists in MariaDB's JSON_SCHEMA_VALID() function, identified as CVE-2026-32710. This flaw can lead to a crash or remote code execution. The issue affects MariaDB versions from 11.8.0 up to but not including 11.8.6. A security update to version 11.8.6 has been released to address this vulnerability. Red Hat has rated the impact as Moderate for their Enterprise Linux 10 distributions and has provided updated packages to remediate the issue.
Multiple security vulnerabilities have been fixed in freerdp2, a free implementation of the Remote Desktop Protocol (RDP). These include out-of-bounds reads and writes, buffer overflows, use-after-free errors, and denial of service issues. The update addresses a broad set of CVEs affecting various components such as clipboard handling, window management, audio processing, and smartcard functionality. Red Hat Enterprise Linux 9 and related distributions have released patches to remediate these issues.
A security update for the SUSE container-suseconnect component has been released, primarily involving a build environment change to Go 1.25. No specific vulnerability details or affected versions are provided.
A moderate severity vulnerability in the Common UNIX Printing System (CUPS) allows anonymous Print-Job requests to reach the 'lp' code execution over the network via a shared PostScript queue. This affects Red Hat Enterprise Linux versions 8 and 9 in specified ranges. A security update from Red Hat is available to address this vulnerability.
This update for rclone fixes the following issues:
Changes in rclone:
- Update to version 1.73.5:
* Version v1.73.5
* operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179
* rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176
* rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176
* s3: fix empty delimiter parameter rejected by Archiware P5 server
* azureblob/auth: add Microsoft Partner Network User-Agent prefix
* drime: fix User.EntryPermissions JSON unmarshalling
* filter: fix debug logs that fire before logger is configured - fixes #9291
* s3: fix TencentCOS CDN endpoint failing on bucket check
* iclouddrive: fix 'directory not found' error when the directory contains accent marks
* Start v1.73.5-DEV development
- Update to version 1.73.4:
* Version v1.73.4
* Update to go 1.25.9 to fix multiple CVEs
* build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
* docs: fix markdown issues in mount docs
* docs: fix header level for metadata option
* fix(docs): Fix link to not be language specific
* filen: update SDK version
* build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0
* docs: note macOS 10.15 (Catalina) support with version v1.70.3
* Start v1.73.4-DEV development
- Update to version 1.73.3: (CVE-2026-33186 GHSA-6g7g-w4f8-9c9x)
* Version v1.73.3
* build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2
* docs/jottacloud: fix broken link
* docs: clarify Filen password change requires updating both password and API key in rclone config
* docs: note that Filen API key changes on password change
* build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3
* s3: add multi tenant support for Cubbit
* lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching
* list: fix nil pointer panic in Sorter when temp file creation fails
* docs: update RELEASE procedure to avoid mistakes
* docs: added text to the label showing version-introduced info
* Start v1.73.3-DEV development
* docs: update sponsors
- Update to version 1.73.2:
* Version v1.73.2
* Update to go 1.25.8 to fix multiple CVEs
* build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220
* docs: fix new drive flag typo in changelog
* webdav: add missing headers for CORS
* docs: Document unsupported S3 object keys with double slashes
* docs: note that --use-server-modtime only works on some backends
* internxt: fix Entry doesn't belong in directory errors on windows
* drime: fix chunk-uploaded files ignoring workspace ID
* docs: Fix headers hierarchy for mount.md
* webdav: escape reserved characters in URL path segments
* bisync: add group Sync to the bisync command
* archive: extract: strip "./" prefix from tar entry paths
* docs: add instructions on how to update Go version
* buid: update github.com/cloudflare/circl to v1.6.3 to fix CVE-2026-1229
* Start v1.73.2-DEV development
- Update to version 1.73.1:
* Version v1.73.1
* build: fix build using go 1.26.0 instead of go 1.25.7
* fs/march: fix runtime: program exceeds 10000-thread limit
* accounting: fix missing server side stats from core/stats rc
* pacer: re-read the sleep time as it may be stale
* pacer: fix deadlock between pacer token and --max-connections
* build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167
* drime: fix files and directories being created in the default workspace
* docs: update sponsors
* copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.
* internxt: implement re-login under refresh logic, improve retry logic - fixes #9174
* docs: add ExchangeRate-API as a sponsor
* build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316
* Set list_version to 2 for FileLu S3 configuration
* filelu: add multipart upload support with configurable cutoff
* filelu: add multipart init response type
* filelu: add comment for response body wrapping
* filelu: avoid buffering entire file in memory
* docs: update sponsor logos
* filen: fix potential panic in case of error during upload
* filen: fix 32 bit targets not being able to list directories Fixes #9142
* Start v1.73.1-DEV development
- Update to version 1.73.0:
* Version v1.73.0
* drive: fix crash when trying to creating shortcut to a Google doc
* azureblob,azurefiles: factor the common auth into a library
* test: allow backends to return fs.ErrorCantListRoot to skip Root tests
* build: add privatebeta Makefile target
* docs: add Internxt as a sponsor
* internxt: remove use of CVE laden github.com/disintegration/imaging
* docs: fix Internxt docs after merge
* docs: update making a new backend docs
* docs: build overview page from the backend data
* docs: add tiering to the documentation - fixes #8873
* docs: add data about ea
This update for qt6-translations addresses unspecified issues by adding qt6-translations. No detailed technical information or specific vulnerabilities are described.
This is a security update for SUSE's dotnet8.0 product addressing the vulnerability identified as CVE-2026-26130. The update provides a functional equivalent to the Red Hat advisory RHSA-2026:10084. No specific affected versions or detailed technical information are provided in the input data.
This is a security update for SUSE related to dotnet9.0 that provides a functional equivalent of a Red Hat advisory RHSA-2026:10085. The update addresses vulnerabilities identified by CVE-2026-26127 and CVE-2026-26130. No specific affected versions are stated in the provided data. The severity is assessed as high. No CVSS score is available for these vulnerabilities.
The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.
This release of the Red Hat build of OpenJDK 25 (25.0.3) for portable Linux serves as a replacement for the Red Hat build of OpenJDK 25 (25.0.2) and includes security and bug fixes as well as enhancements. For further information, refer to the release notes linked to in the References section.
Security Fix(es):
* JDK: Enhance crypto algorithm support (CVE-2026-22007)
* JDK: Improved Arena allocations (CVE-2026-22008)
* JDK: Improve Kerberos credentialing (CVE-2026-22013)
* JDK: Enhance Path Factories Redux (CVE-2026-22016)
* JDK: Enhance Zip file reading (CVE-2026-22018)
* JDK: Enhance certificate chain validation (CVE-2026-22021)
* JDK: Updating FreeType 2.14.1 (CVE-2026-23865)
* JDK: Enhance TLS connection handling (CVE-2026-34282)
* JDK: Enhance key generation (CVE-2026-34268)
Bug Fix(es):
* When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 25 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in this release. (OPENJDK-4675)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update for ImageMagick addresses multiple vulnerabilities including stack and heap out-of-bounds writes, buffer overflows, integer truncation, off-by-one errors, and recursive execution without depth limits. These issues can lead to crashes, denial of service, memory corruption, or resource exhaustion. The vulnerabilities affect various components such as the sixel encoder, XML parsing, X11 display interaction, MVG decoder, FX expression parser, and multiple image encoders and decoders. No specific affected versions are provided. The severity is assessed as high due to the potential for denial of service and memory corruption.
This update for erlang fixes the following issues:
Security issues fixed:
- CVE-2026-21620: improper isolation and compartmentalization can lead to TFTP relative path traversal and remote
arbitrary reads/writes (bsc#1258663).
- CVE-2026-23941: improper handling of duplicate Content-Length headers in Erlang OTP can lead to HTTP request
smuggling (bsc#1259687).
- CVE-2026-23942: improper limitation of a pathname to a restricted directory in the SFTP server can lead to path
traversal (bsc#1259681).
- CVE-2026-23943: improper handling of highly compressed data in Erlang OTP ssh can lead to denial of service
(bsc#1259682).
- CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts (bsc#1261728).
- CVE-2026-28810: predictable DNS transaction IDs can lead to DNS cache poisoning (bsc#1261726).
- CVE-2026-32144: missing signature verification can lead to OCSP authorization bypass and information disclosure
(bsc#1261734).
Other updates and bugfixes:
- jinterface: allow to build determenistic OtpErlang.jar (bsc#1262288).
Multiple security vulnerabilities have been identified in the openexr library affecting image decoding. These include misaligned memory writes causing denial of service, integer overflow risks, out-of-bounds read and write, and potential arbitrary code execution from crafted EXR files. The issues are addressed in a security update by the SUSE Product Security Team.
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
* FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984)
* FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)
* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.