A security update for python-Django addresses CVE-2026-25674, which fixes a race condition that could lead to incorrect permissions on newly created file system objects. This vulnerability could potentially allow unauthorized access due to improper permission settings. The issue has been fixed by the vendor. No CVSS score is provided, but the impact is assessed as medium severity.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Linux kernel: Use-after-free in IPv6 address deletion may lead to a denial of service (CVE-2026-23010)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple unspecified vulnerabilities affecting MySQL 8.4 on Red Hat Enterprise Linux 8 have been addressed in a security update. These vulnerabilities impact components such as the optimizer, InnoDB storage engine, DDL operations, and thread pooling. The update is rated as having a moderate security impact. Detailed CVE information is available for six vulnerabilities, but specific technical details and CVSS scores are not provided in the advisory. The update is available for Red Hat Enterprise Linux 8 across various architectures.
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error: BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107 CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200 kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510 __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10 regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10 [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0) Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access.
The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files.
Security Fix(es):
* libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API (CVE-2026-22801)
* libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read (CVE-2026-22695)
* libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)
* cpython: IMAP command injection in user-controlled commands (CVE-2025-15366)
* cpython: POP3 command injection in user-controlled commands (CVE-2025-15367)
* cpython: email header injection due to unquoted newlines (CVE-2026-1299)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This security update for Mozilla Firefox addresses multiple vulnerabilities across various components including WebRTC, JavaScript engine, graphics, storage, DOM, audio/video, networking, and more. The issues fixed include use-after-free bugs, incorrect boundary conditions, integer overflows, sandbox escapes, privilege escalations, mitigation bypasses, and information disclosure. The update specifically mentions fixes in Firefox Extended Support Release 140.8.0 ESR and other related products. These vulnerabilities collectively pose a high risk to the security and stability of affected Firefox versions.
A security update for rust-keylime addresses a vulnerability identified as CVE-2026-25727, which involves a date parser that can lead to stack exhaustion in the Time component. This issue was fixed by updating vendored crates in version 0.2.8+116. The vulnerability is rated as high severity. No specific affected versions were provided in the available data.
Multiple security issues were addressed in the python311-black-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities affecting the SUSE product.
This security update for QEMU addresses multiple medium severity vulnerabilities, including CVE-2025-14876, an unbounded allocation issue in virtio-crypto, and CVE-2026-0665, a PIRQ bounds check issue in xen_physdev_map_pirq. The update requires upgrading to QEMU version 10.0.8 on the aarch64 architecture. No CVSS scores are provided for these vulnerabilities.
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
* postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)
* postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)
* postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This update for python-lxml_html_clean fixes the following issues:
Changes in python-lxml_html_clean:
- CVE-2026-28348: improper keywords checking can allow external CSS loading (bsc#1259378)
- CVE-2026-28350: lack of base tag handling can allow the hijacking of the resolution of relative URLs (bsc#1259379)
Multiple remote code execution vulnerabilities have been identified in GIMP, the GNU Image Manipulation Program, affecting its parsing of various image file formats including ICNS, PGM, XWD, and ICO. These vulnerabilities involve heap-based buffer overflow, uninitialized memory usage, and out-of-bounds writes. Red Hat has issued a security update for GIMP on Red Hat Enterprise Linux 9 to address these issues. The update is rated as Important by Red Hat Product Security. Users of affected Red Hat Enterprise Linux 9 variants should apply the update to mitigate these risks.
A security update for ImageMagick addresses multiple vulnerabilities including denial of service, heap buffer overflows, stack buffer overflows, memory leaks, information disclosure, code injection, and security policy bypasses. These issues arise from improper pointer initialization, crafted image files, malformed inputs, and integer overflows among others. The update fixes a broad range of vulnerabilities that could lead to crashes, memory corruption, or unauthorized access. No specific affected versions are stated in the provided data.
Multiple security vulnerabilities have been identified and fixed in the Linux kernel packages for Red Hat Enterprise Linux versions 9.4 and 9.6 Extended Update Support (EUS). These include use-after-free bugs, double free vulnerabilities, and a bug in IPv6 packet handling. The update addresses issues such as an in-kernel MMIO check flaw, RDMA/rxe use-after-free leading to potential arbitrary code execution, and a double free in the exFAT filesystem that can cause denial of service. The vendor rates the overall security impact as moderate. Systems must be updated and rebooted to apply these fixes.