This update for python-lxml_html_clean fixes the following issues:
Changes in python-lxml_html_clean:
- CVE-2026-28348: improper keywords checking can allow external CSS loading (bsc#1259378)
- CVE-2026-28350: lack of base tag handling can allow the hijacking of the resolution of relative URLs (bsc#1259379)
MinGW Windows Libpng library.
Security Fix(es):
* libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API (CVE-2026-22801)
* libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read (CVE-2026-22695)
* libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple remote code execution vulnerabilities have been identified in GIMP, the GNU Image Manipulation Program, affecting its parsing of various image file formats including ICNS, PGM, XWD, and ICO. These vulnerabilities involve heap-based buffer overflow, uninitialized memory usage, and out-of-bounds writes. Red Hat has issued a security update for GIMP on Red Hat Enterprise Linux 9 to address these issues. The update is rated as Important by Red Hat Product Security. Users of affected Red Hat Enterprise Linux 9 variants should apply the update to mitigate these risks.
Multiple unspecified vulnerabilities affecting the MySQL 8.4 database server in Red Hat Enterprise Linux 10 have been addressed in a security update. These vulnerabilities impact components including the optimizer, InnoDB storage engine, DDL operations, and thread pooling. The update is rated with moderate severity by Red Hat Product Security. Detailed CVSS scores and specific impact information are not provided in the advisory. The update is available for Red Hat Enterprise Linux 10 and related CodeReady Linux Builder variants.
Multiple security vulnerabilities have been identified in Python components distributed by Red Hat, including command injection flaws in IMAP and POP3 commands, email header injection due to unquoted newlines, and a command injection vulnerability in the Python webbrowser.open() API. These issues could allow attackers to execute arbitrary code or commands under certain conditions. Red Hat has released updates for Python 3.14 packages in their Hardened Images RPMs to address these issues. Some vulnerabilities, such as the webbrowser.open() API flaw, currently lack effective mitigations that meet Red Hat's criteria. The overall severity is assessed as medium.
A security update for ImageMagick addresses multiple vulnerabilities including denial of service, heap buffer overflows, stack buffer overflows, memory leaks, information disclosure, code injection, and security policy bypasses. These issues arise from improper pointer initialization, crafted image files, malformed inputs, and integer overflows among others. The update fixes a broad range of vulnerabilities that could lead to crashes, memory corruption, or unauthorized access. No specific affected versions are stated in the provided data.
Multiple security vulnerabilities have been identified and fixed in the Linux kernel packages for Red Hat Enterprise Linux versions 9.4 and 9.6 Extended Update Support (EUS). These include use-after-free bugs, double free vulnerabilities, and a bug in IPv6 packet handling. The update addresses issues such as an in-kernel MMIO check flaw, RDMA/rxe use-after-free leading to potential arbitrary code execution, and a double free in the exFAT filesystem that can cause denial of service. The vendor rates the overall security impact as moderate. Systems must be updated and rebooted to apply these fixes.
Multiple heap and global buffer overflow vulnerabilities have been identified in FreeRDP, specifically affecting the xfreerdp client used to connect to various RDP servers. These vulnerabilities are tracked as CVE-2026-22855, CVE-2026-22858, and CVE-2026-22859. Red Hat has issued security advisories providing updated packages to address these issues in Red Hat Enterprise Linux 9.6 Extended Update Support and related products.
A security update for python-uv addresses CVE-2025-13327, a vulnerability where parsing differentials during processing of specially crafted ZIP archives in package installation can lead to arbitrary code execution. This issue affects SUSE products using python-uv. The vulnerability is rated as high severity. No specific affected versions or patch details are provided in the available data.
Multiple security vulnerabilities have been addressed in Roundcube Webmail stable version 1.6 through updates 1.6.11, 1.6.12, and 1.6.13. These include fixes for a post-authentication remote code execution via PHP object deserialization, cross-site scripting via SVG animate tags, information disclosure through the HTML style sanitizer, CSS injection, and remote image blocking bypass via SVG content. The vendor recommends updating all productive installations of Roundcube 1.6.x to version 1.6.13. Users should back up data before updating.
This update for gstreamer-rtsp-server, gstreamer-plugins-ugly, gstreamer-plugins-rs, gstreamer-plugins-libav, gstreamer-plugins-good, gstreamer-plugins-base, gstreamer-plugins-bad, gstreamer-docs, gstreamer-devtools, gstreamer fixes the following issues:
Changes in gstreamer-rtsp-server:
- Update to version 1.26.7:
+ Fix issues with G_DISABLE_CHECKS & G_DISABLE_ASSERT.
+ rtsp-server: tests: Switch to fixtures to ensure pool shutdown
+ rtsp-server: tests: Fix a few memory leaks
Changes in gstreamer-plugins-ugly:
- Update to version 1.26.7:
+ No changes, stable version bump only.
Changes in gstreamer-plugins-rs:
- Update to version 1.26.7+git0.6ab75814:
* tracers: Fix inverted append logic when writing log files
* threadshare:
- examples: standalone: also handle buffer lists
- Pad push_list: downgrade Pad flushing log level
- sinks: fix / handle query()
- backpressure: abort pending items on flush start
- udpsink: fix panic recalculating latency from certain
executors
- audiotestsrc:
. support more Audio formats
. use AudioInfo
. fix latency
. act as a pseudo live source by default
- runtime task: execute action in downward transition
- example cleanups
- udpsink: distinguish sync status for latency & report added
latency
- sink elements: implement `send_event`
- dataqueue elements: report min and max latency
* rtp:
- Add linear audio (L8, L16, L24) RTP payloaders / depayloaders
* rtp: basedepay: reuse last PTS, when possible
* skia: Update to skia-safe 0.89
* mp4: Update to mp4-atom 0.9
* Update dependencies
* webrtc: livekit: Drop connection lock after take()
* onvifmetadatapay: copy metadata from source buffer
* fallbacksrc: Fix custom source reuse case
* add `rust-tls-native-roots` feature to the `reqwest` dep
* rtpamrpay2:
- Actually forward the frame quality indicator
- Set frame quality indicator flag
- Add patch to fix reproducibility of package build (boo#1237097)
- Update to version 1.26.6+git20.e287e869:
* Fix some new clippy 1.90 warnings
* colordetect: Don't use deprecated color_name API
* deny: Update
* quinn: Update to web-transport-quinn 0.8
* skia: Update to skia-safe 0.88
* Update Cargo.lock
* Allow windows-sys 0.61 too
* intersink: add sync property
* meson: Fix .pc files installation and simplify build output
handling. This also fixes the .pc file install directory and
ensures that the .pc files are only installed when static
builds is enabled.
- Drop devel subpackage following upstream changes.
- Update to version 1.26.6:
+ aws: Ensure task stopping on paused-to-ready state change
+ fallbacksrc:
- Don't panic during retries if the element was shut down in
parallel
- Don't restart source if the element is just being shut down
- Fix some custom source deadlocks
- Fix sources only being restarted once
+ gtk4: Try importing dmabufs withouth DMA_DRM caps
+ inter: Give the appsrc/appsink a name that has the parent
element as prefix
+ mp4: Skip tests using x264enc if it does not exist
+ rtpgccbwe: avoid clamp() panic when min_bitrate > max_bitrate
+ rtpmp4gdepay2: allow only constantduration with neither
constantsize nor sizelength set
+ rtprecv: fix race condition on first buffer
+ speechmatics: Specify rustls as an explicit dependency
+ spotify: update to librespot 0.7
+ threadshare:
- add a blocking adapter element
- always use block_on_or_add_subtask
- audiotestsrc: fix setting samples-per-buffer...
- blocking_adapter: fix Since marker in docs
- fix resources not available when preparing asynchronously
- fix ts-inter test one_to_one_up_first
- have: have Task log its obj
- intersink: return from blocking tasks when stopping
- inter: update doc example
- runtime/pad: lower log level pushing Buffer to flushing pad
- separate blocking & throttling schedulers
- update examples
- Update to getifaddrs 0.5
- Fix macOS build post getifaddrs 0.5 update
- Bump up getiffaddrs to 0.1.5 and revert "udp: avoid
getifaddrs in android"
- Reapply "udp: avoid getifaddrs in android"
+ transcriberbin: Fix some deadlocks
+ Update dependencies
+ webrtc: Migrate to warp 0.4 and switch to tokio-rustls
+ webrtc/signalling: Fix setting of host address
+ ci: add script to check readme against plugins list
+ Fix various new clippy 1.89 warnings
+ Don't suggest running cargo cinstall after cargo cbuild
+ meson: Isolate built plugins from cargo target directory
- Update to version 1.26.5+git11.949807a4 (boo#1248053,
CVE-2025-55159):
+ rtprecv: fix race condition on first buffer
+ threadshare: intersink: return from blocking tasks when
stopping
+ threadshare: inter: store upstream latency in InterContext
+ threadshare: add a blocking adapter element
+ transcriberbin: Fix settings/state lock order vi
This update for python-joserfc fixes the following issues:
Changes in python-joserfc:
- CVE-2026-27932: unbounded PBKDF2 iteration count can lead to a denial of service (bsc#1259154)
This update for shim addresses multiple issues including a fix for CVE-2024-2312 related to SBAT metadata for grub.peimage. The update includes various bug fixes, improvements to network boot, loader protocol enhancements, and security improvements such as Authenticode generation and NX policy enforcement. No specific exploit details or active exploitation are reported.
Multiple security vulnerabilities have been identified in PostgreSQL 16 as packaged for Red Hat Enterprise Linux 10. These include missing validation of multibyte character length, missing validation of input type to the intarray selectivity estimator, and a heap buffer overflow in the pgcrypto module. These issues can lead to arbitrary code execution. Red Hat has released an important security update addressing these vulnerabilities for various architectures and variants of Red Hat Enterprise Linux 10 and CodeReady Linux Builder 10.
This update for salt fixes the following issues:
Changes in salt:
- Security issues fixed:
* CVE-2025-67724: fixed missing validation of supplied reason phrase (bsc#1254903)
* CVE-2025-67725: fixed DoS via malicious HTTP request (bsc#1254905)
* CVE-2025-67726: fixed HTTP header parameter parsing algorithm (bsc#1254904)
- Fixed KeyError in postgres module with PostgreSQL 17 (bsc#1254325)
- Use internal deb classes instead of external aptsource lib
- Improved performance of wheel key.finger call (bsc#1240532)
- Improved performance of utils.find_json function (bsc#1246130)
- Extend warn_until period to 2027
This security update for expat addresses two vulnerabilities: CVE-2026-24515, a NULL dereference caused by failure to copy encoding handler data, and CVE-2026-25210, an integer overflow due to lack of buffer size checking. Both vulnerabilities could lead to stability or security issues in affected systems. The update fixes these issues to improve software reliability and security.
A security update for the Rhino JavaScript engine addresses a vulnerability (CVE-2025-66453) related to the formatting of floating-point numbers to strings. This flaw could potentially lead to a denial-of-service (DoS) condition. The update to version 1.7.15.1 fixes this issue.
Two security vulnerabilities have been identified in cpp-httplib, affecting the SUSE product. CVE-2025-53629 allows arbitrary memory allocation via HTTP headers on the server, potentially leading to memory exhaustion. CVE-2025-53628 involves HTTP header smuggling caused by insecure merging of trailers. These issues are classified as high severity. No specific affected versions or patch information is provided in the available data.