The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.
In the Linux kernel, the following vulnerability has been resolved:
smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
smc_clc_prfx_match() is called from smc_listen_work() and
not under RCU nor RTNL.
Using sk_dst_get(sk)->dev could trigger UAF.
Let's use __sk_dst_get() and dst_dev_rcu().
Note that the returned value of smc_clc_prfx_match() is not
used in the caller.
This update for libpng16 fixes the following issues:
- CVE-2026-22695: Fixed heap buffer over-read in png_image_finish_read (bsc#1256525).
- CVE-2026-22801: Fixed integer truncation causing heap buffer over-read in png_image_write_* (bsc#1256526).
This update for python-azure-core fixes the following issues:
- CVE-2026-21226: Fixed deserialization of untrusted data which may allow an authorized attacker to execute code over a network. (bsc#1257703)
A security update for fluidsynth addresses a vulnerability identified as CVE-2025-56225, which involves a NULL pointer dereference triggered by loading an invalid MIDI file. This flaw could cause application crashes or denial of service. The update fixes this issue to improve stability and security.
A security update for SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernels addresses multiple vulnerabilities across various kernel subsystems including block device throttling, multipath TCP, SCSI, NVMe, networking, and file systems. The fixes resolve issues such as race conditions, use-after-free bugs, memory leaks, and null pointer dereferences. These vulnerabilities are identified by CVEs ranging from CVE-2025-40147 to CVE-2025-68814. The update aims to improve kernel stability and security by mitigating these defects.
This security update introduces initial livepatches for the kernel of SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2. The update addresses vulnerabilities in the kernel via livepatch technology, allowing patching without rebooting. No specific details about the vulnerabilities or affected kernel versions are provided.
A security update for libsoup2 addresses a stack-based buffer overflow vulnerability (CVE-2026-1761) caused by incorrect length calculation when parsing multipart HTTP responses. This vulnerability is rated as high severity. The issue affects multiple versions of libsoup2 in SUSE and Red Hat Enterprise Linux distributions. A patch is available and should be applied to mitigate the risk.
A security update for kubevirt addresses multiple vulnerabilities fixed in version 1.7.0. These include logic flaws causing denial of service, improper handling of symbolic links allowing arbitrary file read/write, bypass of RBAC controls due to TLS certificate validation errors, and potential impersonation of privileged components. These issues collectively pose a high risk to the confidentiality, integrity, and availability of affected systems. The update also includes other bug fixes and improvements.
This security update for 7zip addresses multiple issues including a heap buffer overflow (CVE-2025-53816) and a null pointer dereference (CVE-2025-53817) that could lead to denial of service. The update also improves symbolic link handling for greater security and introduces a command line switch to bypass default security checks when creating symbolic links. Performance improvements for compression algorithms and archive format support are included as well.
A security update for the autogen tool addresses CVE-2025-8746, which involves improper input validation and memory bounds checking when processing certain malformed configuration files. This vulnerability could potentially lead to memory-related issues. The severity is assessed as low. No specific affected versions or patch details are provided in the available data.
A security update for GIMP addresses a heap buffer overflow vulnerability identified as CVE-2026-2239 in the psd-util.c component. This flaw could potentially lead to memory corruption. The issue has been fixed in the update provided by the SUSE Product Security Team. No CVSS score is available, but the severity is assessed as low based on the information provided.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Kernel: Double free vulnerability in exFAT filesystem can lead to denial of service (CVE-2025-38206)
* kernel: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (CVE-2025-40096)
* kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168)
* kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple heap and global buffer overflow vulnerabilities have been identified in FreeRDP, a free implementation of the Remote Desktop Protocol client. These vulnerabilities affect the freerdp package in Red Hat Enterprise Linux 8 across multiple architectures. Red Hat has issued an important security advisory with updates to address these issues. The vulnerabilities are tracked under CVE-2026-22855, CVE-2026-22858, and CVE-2026-22859. No CVSS scores are provided, but the issues are rated as having a high security impact. The advisory includes updated freerdp packages to remediate the vulnerabilities.
This security update for mosquitto addresses multiple stability and crash issues, including fixes for handling disconnected sessions, OpenSSL function return checks to prevent crashes, and protection against crashes from malicious or corrupt persistence files. Additional fixes cover bridge functionality, client disconnection reporting, TLS error handling, and systemd service startup. The update includes versions 2.0.21 through 2.0.23 with various bug and crash fixes.
Multiple heap buffer overflow and use-after-free vulnerabilities have been identified in FreeRDP, a free implementation of the Remote Desktop Protocol client. These vulnerabilities can lead to denial of service and potential arbitrary code execution when connecting to malicious RDP servers. The issues affect client-side components and involve crafted RDPGFX surface updates and other client interactions. Red Hat has issued security updates addressing these vulnerabilities in FreeRDP packages for Red Hat Enterprise Linux 9.6 Extended Update Support and related products.
FreeRDP versions prior to 3.20.1 contain a heap buffer overflow vulnerability in the RDPEAR NDR array reader due to lack of bounds checking on the on-wire element count. This flaw allows writing past the allocated heap buffer in the ndr_read_uint8Array function. The vulnerability has a high CVSS score of 9.8 and affects multiple Red Hat Enterprise Linux and Ubuntu package versions. It is fixed in FreeRDP version 3.20.1 and later. No known exploits in the wild have been reported. System updates from Red Hat and Ubuntu provide patches to remediate this issue.