PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.
Security Fix(es):
* php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)
* php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
* php: fatal error handling retains stale request state
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
* php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)
* php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
* php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Cockpit component for managing libvirt virtual machines.
Security Fix(es):
* cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)
* cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)
* cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.
Security Fix(es):
* librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Critical: .NET 10.0 security, bug fix, and enhancement update
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 10.0.113
Runtime version: 10.0.13
Security Fix(es):
* dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)
* dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
* dotnet
Critical: .NET 9.0 security, bug fix, and enhancement update
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 9.0.122
Runtime version: 9.0.21
Security Fix(es):
* dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
* dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-6682
Critical: .NET 8.0 security, bug fix, and enhancement update
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 8.0.132
Runtime version: 8.0.32
Security Fix(es):
* dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
* dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-6682
Important: golang security, bug fix, and enhancement update
The golang packages provide the Go programming language compiler.
Security Fix(es):
* net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
* crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
* net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
* golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)
Bug Fix(es) and Enhancement(s):
* Update Go to version 1.26.10+1 [rhel-10.2.z] (
Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.
Security Fix(es):
* fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and othe
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
* php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)
* php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
* php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt.
Security Fix(es):
* qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573)
* qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
* php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)
* php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
* php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
* php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)
* php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618)
* php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.
Security Fix(es):
* openexr: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544)
* openexr: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982)
* openexr: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184)
* openexr: OpenEXR: Information dis
Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.
Security Fix(es):
* fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and othe
Cockpit component for managing libvirt virtual machines.
Security Fix(es):
* cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)
* cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)
* cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.
Security Fix(es):
* librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Core part of Jackson that defines Streaming API as well as basic shared abstractions.
Security Fix(es):
* com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)
* com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: golang security, bug fix, and enhancement update
The golang packages provide the Go programming language compiler.
Security Fix(es):
* net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
* crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
* net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
* golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)
Bug Fix(es) and Enhancement(s):
* Update Go to version 1.26.10+1 [rhel-9.8.z] (J
Critical: .NET 10.0 security, bug fix, and enhancement update
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 10.0.113
Runtime version: 10.0.13
Security Fix(es):
* dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)
* dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
* dotnet