A reflected cross-site scripting (XSS) vulnerability (CVE-2026-15928) exists in the error page component of the xmlrpc-c library. This vulnerability affects xmlrpc-c versions from 9.0 up to but not including 9.8. Red Hat has released a security update for Red Hat Enterprise Linux 9 and related products to address this issue.
Two security vulnerabilities have been identified in the X.Org X11 libXfont2 runtime library affecting Red Hat Enterprise Linux 9 and related variants. These include an out-of-bounds read/write in the Font Server Client encoding (CVE-2026-59679) and a privilege escalation via a heap buffer overflow in the Font Server Client (CVE-2026-44950). Red Hat has released security updates addressing these issues. The vulnerabilities are rated as having an important security impact by Red Hat Product Security.
A buffer overflow vulnerability exists in GNU C Library (glibc) versions 2.38 to 2.44 when calling strfmon or strfmon_l with right-justified width padding. This can cause writes past the end of the caller-supplied output buffer. Exploitation requires specific application code paths and conditions. At the time of the advisory, no network-facing impact is known. Red Hat has issued a security update addressing this issue in their Hardened Images RPMs.
A local privilege escalation vulnerability (CVE-2026-7867) exists in udisks2 due to insufficient authorization checks on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This flaw affects certain versions of SUSE and Red Hat Enterprise Linux 10. Red Hat has released a security update to address this issue.
Multiple vulnerabilities have been identified and fixed in the gstreamer-devtools package by the SUSE Product Security Team. These include a race condition causing double-free and memory corruption, terminal manipulation via ANSI escape sequences, integer overflow leading to crashes, stack exhaustion from date parsing, process crashes from empty Range headers, and information disclosure from non-existing folder arguments. The issues affect versions prior to 1.26.7-160000.2.1. The severity of these combined issues is high.
This security update for python-cryptography addresses three vulnerabilities: CVE-2026-69247, involving a Bleichenbacher oracle exposure via PKCS#7 EnvelopedData decryption errors and timing; CVE-2026-69248, where the verifier improperly accepts wildcard DNS names allowing escape from permittedSubtrees; and CVE-2026-69249, where duplicate self-signed intermediates can cause exponential path-building. These vulnerabilities affect certain versions of python-cryptography in SUSE products. A patch is available to remediate these issues.
A vulnerability in librest's PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-random number generator (PRNG). This flaw allows attackers who can intercept the authorization code to reverse-engineer the PRNG seed, predict or reconstruct the code verifier string, and impersonate the client during the OAuth 2.0 authorization flow. The vulnerability has been rated with important severity and affects certain versions of librest. A security update is available to address this issue.
Multiple vulnerabilities in dhcpcd affecting DHCPv6 and related components have been addressed in version 10.5.0. These include denial of service, stack out-of-bounds write, memory leak, and heap use-after-free issues. The vulnerabilities can be triggered by crafted DHCPv6 messages and privileged commands, potentially causing service disruption or memory corruption. The update to version 10.5.0 includes these security fixes along with code improvements and new features.
Multiple security issues affecting the jupyter-jupyterlab package on openSUSE Tumbleweed have been addressed in version 4.5.10-1.1. These vulnerabilities are collectively fixed in this package update. No specific technical details or CVSS scores are provided. The severity is assessed as medium based on the available information.
Multiple security issues were addressed in the owasp-modsecurity-crs-4.29.0-1.1 package included in the GA media of openSUSE Tumbleweed. These fixes pertain to the SUSE distribution and specifically affect the owasp-modsecurity-crs package versions listed. No CVSS score is available for these vulnerabilities, but the severity is assessed as medium.
This update for cloudflared fixes the following issues:
Changes in cloudflared:
- Update version to 2026.8.2
* Update vendor archive to fix github.com/go-chi/chi/v5 (boo#1276196, CVE-2026-72815, CVE-2026-72816, CVE-2026-72817)
* Add OpenRC support
* Migrate config renovate.json
* Fix bugs
This security update for wicked addresses multiple out-of-bounds (OOB) read vulnerabilities in the UDP header inspection and DHCP option parsing code. The fixes prevent size underflows and buffer over-reads by improving packet length validation and handling of DHCP options without length fields. These issues were reported by Daniel Birtwhistle and are tracked as CVE-2026-71401 and CVE-2026-71402. The vulnerabilities could lead to memory safety issues during packet processing.
This update for file-roller fixes the following issues:
Changes in file-roller:
- CVE-2026-78322: Check line length when parsing command output (bsc#1276442).
This security update for suseconnect-ng upgrades the software to version 1.23.0, addressing multiple issues including improved product migration handling, updating the default Go version for building the package, fixing flag parsing errors, ensuring consistent interactive/noninteractive behavior during release package installation, adding an optional collector for installed SUSE RPM packages, and allowing deregistration when a subscribed registration code has expired.
A global buffer overflow vulnerability (CVE-2026-41992) exists in the LZH decompression logic of GNU gzip due to improper reuse of shared global state between different decompression formats. This flaw can lead to out-of-bounds reads, potentially causing information disclosure or denial of service. The vulnerability affects multiple gzip versions and has been addressed by security updates from vendors including Red Hat and SUSE.
Multiple security vulnerabilities have been fixed in wget, including server-side request forgery via unvalidated FTP PASV response IP addresses, heap buffer underread from Metalink documents with whitespace-only URLs, integer overflow from server-controlled Content-Range headers, heap memory corruption from character set conversion of server-supplied filenames, and heap buffer overflow from crafted HTML attributes requiring entity encoding. Additional bug fixes address segmentation faults and regressions related to Metalink processing. These issues have been addressed by the SUSE Product Security Team.
The coturn-4.17.2-1.1 package on openSUSE Tumbleweed addresses multiple security issues. These vulnerabilities have been fixed in this package version. No specific details about the individual vulnerabilities or affected versions are provided.
A timing attack vulnerability was found in the Linux kernel SCTP implementation used by SUSE Linux Enterprise 16. The issue involved a non-constant-time comparison of message authentication codes (MACs), which could allow attackers to infer sensitive information through timing analysis. The vulnerability has been fixed by updating the MAC comparison to use a constant-time helper function, preventing timing attacks.