DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.
Security Fix(es):
* DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute (CVE-2026-19546)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.
CVE-2026-87876 is a low-severity vulnerability in the CUPS scheduler component of Red Hat Hardened Images and related products. It involves improper handling of case-insensitive username comparisons outside the main authorization path, specifically in printer ACL validation and private-attribute filtering. This flaw could allow an authenticated attacker on an adjacent network to bypass username-based access controls under certain configurations, resulting in limited confidentiality loss without affecting integrity or availability. A fix has been delivered for Red Hat Hardened Images, while fixes for other affected Red Hat products are deferred to future updates due to the low severity and exploitation prerequisites.
A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the
community.general Ansible collection. The shared OCAPI request helper disables
TLS certificate validation on every request and the modules expose no parameter
to re-enable it, while sending HTTP Basic-Auth credentials to an https endpoint.
An attacker positioned on the network path between the Ansible controller and the
OCAPI-managed storage/enclosure device can present any certificate, intercept the
session, capture the credentials, and tamper with responses.
CVE-2026-87875 is a medium severity vulnerability in Red Hat Hardened Images involving an out-of-bounds read in the cupsUTF32ToUTF8() function of CUPS. The flaw arises because the function lacks a source-length bound, allowing a heap out-of-bounds read triggered via SNMP supply-description parsing with attacker-controlled input. Red Hat has released updated RPM packages including cups-2.4.19-4.1.hum1 to address this issue.
CVE-2026-87853 is a vulnerability in the System Security Services Daemon (SSSD) of Red Hat Enterprise Linux 10. The flaw occurs in the IdP authentication provider where a partial string comparison is performed using strncmp(), allowing an attacker whose IdP identifier is a strict prefix of a target user's identifier to impersonate that user. This issue has a CVSS score of 7.5 and is rated as high severity. Red Hat has released an update to fix this vulnerability in SSSD.
CVE-2026-87874 is a high-severity vulnerability in the memcached cache plugin of the community.general Ansible collection. The plugin incorrectly relies on python-memcached's pickling for serialization, which allows an attacker with network access to an unauthenticated memcached instance to execute arbitrary code on the Ansible controller via crafted pickle payloads. This issue requires a non-default insecure deployment exposing memcached across trust boundaries. Mitigations include binding memcached to localhost and using alternative cache plugins that use explicit JSON serialization.
Virtuoso is a scalable cross-platform server that combines SQL/RDF/XML Data Management with Web Application Server and Web Services Platform functionality.
Security Fix(es):
* virtuoso-opensource: Openlink Virtuoso-opensource: Denial of Service via crafted SQL statements (CVE-2025-61021)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat Ansible Automation Platform versions 2.1 and 2.2 include Ansible plug-ins for Red Hat Developer Hub that enhance automation. A Red Hat security advisory (RHSA-2026:65118) lists multiple CVEs including CVE-2026-5079 but does not provide specific vulnerability details or confirm patches. Updated images with new features and bug fixes are available, but no explicit fixes for the listed CVEs are stated.
CVE-2026-87766 is a high severity vulnerability in bubblewrap used by Red Hat Enterprise Linux 10. It involves improper link resolution during sandbox setup, allowing symlink traversal via /oldroot. This flaw can cause files or directories to be created outside the sandbox with the launching user's privileges before the sandboxed process starts. The issue is fixed in bubblewrap version 0.12.0.
A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998)
* kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)
* kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)
* kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)
* kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
* kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
* kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
* kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)
Bug Fix(es) and Enhancement(s):
* [HPEMC RHEL 9 BUG] tick/sched: Limit non-timkeeper CPUs calling jiffies upda [rhel-9.6.z] (JIRA:RHEL-141460)
* ibmveth Adapter Freeze with Small MSS [rhel-9.6.z] (JIRA:RHEL-178307)
* RT scheduler livelock caused by missing backport of 94894c9c477e [rhel-9.6.z] (JIRA:RHEL-244409)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities affecting the Linux kernel in Red Hat Enterprise Linux versions 9.4 and 10.0.0 have been addressed. These include issues such as privilege escalation, use-after-free, heap overflow, double-free, and data corruption across various kernel components including vmci transport, netfilter, IPv6, Bluetooth, RDMA, USB serial, and crypto. A patch is available and applying it requires a system reboot. The update also includes non-security bug fixes and enhancements.
Multiple security vulnerabilities have been identified and fixed in the Linux kernel packages used by Red Hat. These include a use-after-free in Bluetooth SSP passkey handlers, a heap overflow in USB serial io_ti driver, and improper handling of I2C block transfers. The vulnerabilities affect specific Red Hat kernel versions and have been addressed in security updates.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.15. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:68550
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
* kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)
* kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)
* kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)
* kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
* kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
* kernel: can:bcm: arbitrary kernel code execution leading to escalate privileges (CVE-2026-17523)
* kernel: packet: use consistent hard_header_len in non-ring send paths ()
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-86564 is a low-severity vulnerability in Red Hat Fast Datapath for RHEL 10 involving an out-of-bounds read in the DPDK lib/vhost component. The flaw arises from missing length validation before reading command_data in the virtio-net control-queue handler, which can cause a host process crash. A malicious guest with access to the virtio-net control virtqueue can trigger this issue. No confidentiality or integrity impact is reported, only availability impact due to potential process crashes. Currently, no mitigation or patch is available from Red Hat.