A vulnerability in libsolv, a dependency-resolution library used by RPM-based package managers like dnf and zypper, allows an out-of-bounds memory write when processing specially crafted or corrupted .solv cache files. This flaw can cause the affected package management tools to crash, resulting in a denial of service. The vulnerability does not enable arbitrary code execution because the out-of-bounds write stores a fixed, non-attacker-controlled value.
A high-severity vulnerability (CVE-2026-13732) exists in the GNU Debugger (GDB) STABS debug format parser. It involves an out-of-bounds write triggered by a crafted ELF binary, affecting multiple GDB versions across various Linux distributions including Ubuntu and Red Hat Enterprise Linux. The vulnerability has a CVSS 3.1 base score of 7.8. Red Hat has issued an important security advisory with updated packages to address this issue. No known exploits are reported in the wild at this time.
Multiple security issues were identified in the libXi client-side library for the X Input Extension, leading to a high severity vulnerability (CVE-2026-109089). These issues affect versions of libXi prior to 1.8-5.oe2203sp4. The vulnerabilities have a CVSS 3.1 base score of 7.5, indicating high impact on confidentiality, integrity, and availability. Official security fixes have been released to address these problems.
CVE-2026-49264 is a medium severity vulnerability affecting multiple versions of the python-oauthlib package. It involves security issues fixed in the python313-oauthlib-4.0.0-1.1 package on openSUSE Tumbleweed. The vulnerability has a CVSS 3.1 base score of 6.1, indicating a network attack vector with low attack complexity, no privileges required, but requires user interaction. It results in partial confidentiality and integrity impact but no availability impact. The affected versions include >=0.6.1 <4.0.0, >=5.4.0 <5.5.0, and <3.1.1-5.oe2203sp4. A patch is available for this vulnerability. There are no known exploits in the wild at this time.
CVE-2026-11573 is a denial of service vulnerability in the Qt XML module (QtXml, qtbase) caused by uncontrolled recursion in the QDomDocument/QDomNode serialization path. The functions QDomElementPrivate::save() and QDomNodePrivate::save() recursively call each other without depth limits, leading to stack exhaustion when serializing deeply nested XML documents. This vulnerability affects multiple specific versions of qtbase-opensource-src. It does not allow code execution or memory disclosure. Red Hat has issued a security advisory with updates to address this issue in Red Hat Enterprise Linux 9.8 and related products.
A vulnerability in MIT Kerberos 5 (krb5) through version 1.22.2 allows authenticated clients to cause a denial of service by triggering a NULL pointer dereference. This occurs when mismatched KRB-CRED arrays are sent, specifically when forwarded credentials contain more tickets than ticket_info entries, crashing GSS-API acceptor services.
Red Hat has released a security update for multiple krb5-related packages in Red Hat Hardened Images RPMs addressing bugs and enhancements. The update references CVE-2026-107708 and CVE-2026-107778 but does not provide detailed vulnerability descriptions or specific impact information. The update is available for aarch64, s390x, and x86_64 architectures. A patch is available to remediate the issues.
ImageMagick versions prior to 6.9.13-58 and 7.x before 7.1.2-33 contain a vulnerability in the IsRightsAuthorizedByName security policy check. This flaw allows local attackers with the ability to create symbolic links to bypass configured policy restrictions by redirecting the symlink to a restricted path. The vulnerability is rated as low severity with limited impact on confidentiality and integrity, and no impact on availability. A patch is available to address this issue.
Multiple critical security vulnerabilities have been identified in the X.Org X server and Xwayland, including CVE-2025-62231 which involves an unsigned short overflow in the X Keyboard (Xkb) extension's XkbSetCompatMap() function. Other issues include out-of-bounds reads and stack-based buffer overflows in various XKB components, leading to potential memory corruption, information disclosure, or denial of service. These vulnerabilities affect versions prior to xorg-server 21.1.23 and xwayland 24.1.12. Fixes have been released in these versions to address the issues.
This update for xorg-x11-server fixes the following issues:
- CVE-2025-62229: Fixed use-after-free in XPresentNotify structures creation (bsc#1251958).
- CVE-2025-62230: Fixed use-after-free in Xkb client resource removal (bsc#1251959).
- CVE-2025-62231: Fixed value overflow in Xkb extension XkbSetCompatMap() (bsc#1251960).
A heap-based buffer overflow vulnerability (CVE-2026-88807) exists in the RenderQueryPictFormats Reply function of libXrender. This vulnerability has been rated as high severity and affects multiple specific versions of libXrender across various Linux distributions including Ubuntu and SUSE. The issue has been addressed by the SUSE Product Security Team through a security update.
Multiple security vulnerabilities have been identified in FFmpeg versions before 8.1.3 and 9.x before 9.0.2. These include improper certificate validation that skips hostname checks for IP-address hosts, missing host key verification in the SFTP protocol handler, and several denial of service vulnerabilities caused by infinite loops in the DASH demuxer, HLS demuxer, and RTSP redirect handling. Additionally, a protection mechanism failure in the HLS demuxer allows bypassing protocol restrictions. These issues can lead to interception and tampering of streams, impersonation of SFTP servers, denial of service through resource exhaustion, and unauthorized resource access. Patches are available to address these vulnerabilities.
Multiple critical vulnerabilities affect Apache HTTP Server versions from 2.4.0 through 2.4.68. These include unauthorized access to internal state files in mod_dav_fs, out-of-bounds write on Windows, improper privilege management in mod_ssl, FTP PASV reply address validation issues in mod_proxy_ftp, stack-based buffer overflow in mod_vhost_alias, NULL pointer dereference in mod_xml2enc, HTTP request smuggling via mod_proxy_uwsgi, path equivalence issues in mod_userdir, and integer overflow in mod_dav_fs. All these issues are fixed in version 2.4.69. Users are strongly recommended to upgrade to 2.4.69 to address these critical security flaws.
Multiple critical vulnerabilities have been identified in Apache HTTP Server versions from 2.4.0 through 2.4.68, including memory calculation bugs, NULL pointer dereferences, out-of-bounds writes, use-after-free conditions, information exposure, privilege management flaws, and HTTP request smuggling. These issues affect various modules such as mod_dav, mod_heartmonitor, mod_session_cookie, mod_charset_lite, mod_rewrite, mod_http2, mod_dav_fs, mod_ssl, mod_proxy_ftp, mod_vhost_alias, mod_xml2enc, mod_proxy_uwsgi, and mod_userdir. The vulnerabilities can lead to denial of service, information disclosure, arbitrary code execution, and privilege escalation. Users are strongly recommended to upgrade to Apache HTTP Server version 2.4.69, which addresses all these vulnerabilities.
Multiple critical vulnerabilities affect Apache HTTP Server versions from 2.4.0 through 2.4.68, including out-of-bounds writes, use-after-free, improper privilege management, and HTTP request smuggling. These flaws impact various modules such as mod_charset_lite, mod_rewrite, mod_http2, mod_dav_fs, mod_ssl, mod_proxy_ftp, mod_vhost_alias, mod_xml2enc, mod_proxy_uwsgi, and mod_userdir. The vulnerabilities can lead to remote code execution, denial of service, information disclosure, and privilege escalation. Users are strongly recommended to upgrade to version 2.4.69, which addresses all these issues.
Multiple critical vulnerabilities affect Apache HTTP Server versions from 2.4.0 through 2.4.68, including authentication bypass, denial of service, information disclosure, buffer overflow, and privilege management issues. These vulnerabilities impact various modules such as mod_auth_digest, mod_dav_fs, mod_ssl, mod_proxy_ftp, mod_vhost_alias, mod_xml2enc, mod_proxy_uwsgi, and mod_userdir. The issues allow unauthenticated remote attackers to cause denial of service, read unauthorized data, execute arbitrary code, or bypass authentication under certain configurations. Apache HTTP Server version 2.4.69 addresses all these vulnerabilities and is recommended for upgrade.
A path traversal vulnerability exists in the Kubernetes kubectl client's 'kubectl cp' command on Windows. This flaw allows a malicious tar binary inside a container to execute arbitrary code and write files to arbitrary paths on the local Windows machine when copying files from the container. The vulnerability is limited by the local user's system permissions and affects kubectl clients running on Windows prior to version 1.29.1-19.oe2403sp3.