Cockpit component for managing libvirt virtual machines.
Security Fix(es):
* cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768)
* cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747)
* cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.
Security Fix(es):
* librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Core part of Jackson that defines Streaming API as well as basic shared abstractions.
Security Fix(es):
* com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)
* com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: golang security, bug fix, and enhancement update
The golang packages provide the Go programming language compiler.
Security Fix(es):
* net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
* crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
* net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
* golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)
Bug Fix(es) and Enhancement(s):
* Update Go to version 1.26.10+1 [rhel-9.8.z] (J
Critical: .NET 10.0 security, bug fix, and enhancement update
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 10.0.113
Runtime version: 10.0.13
Security Fix(es):
* dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)
* dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
* dotnet
Critical: .NET 9.0 security, bug fix, and enhancement update
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 9.0.122
Runtime version: 9.0.21
Security Fix(es):
* dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
* dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-6682
Critical: .NET 8.0 security, bug fix, and enhancement update
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 8.0.132
Runtime version: 8.0.32
Security Fix(es):
* dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
* dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-6682
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)
* kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)
* kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
* kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
* kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)
* kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-202
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.
Security Fix(es):
* openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw (CVE-2026-59997)
* openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (CVE-2026-59998)
* openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts (CVE-2026-60000)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)
* urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
* php: php: Out-of-bounds read via empty HTTP redirect Location header (CVE-2026-93682)
* php: PHP: Archive entry injection via integer overflow in TAR parser (CVE-2026-6103)
* php: PHP: Denial of Service via heap buffer overflow in SOAP client (CVE-2025-14181)
* php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765)
* php: php: Credential disclosure via cross-origin HTTP redirects (CVE-2026-91766)
* php: php: Information disclosure via crafted TLS server certificate (CVE-2026-91767)
* php: php: Denial o
Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.
Security Fix(es):
* fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and othe
Xwayland is an X server for running X clients under Wayland.
Security Fix(es):
* xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
* xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
* xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
* xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523)
* xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX
The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library.
Security Fix(es):
* librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Critical: .NET 8.0 security, bug fix, and enhancement update
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 8.0.132
Runtime version: 8.0.32
Security Fix(es):
* dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
* dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-6682
Critical: .NET 10.0 security, bug fix, and enhancement update
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 10.0.113
Runtime version: 10.0.13
Security Fix(es):
* dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)
* dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
* dotnet
Critical: .NET 9.0 security, bug fix, and enhancement update
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.
SDK version: 9.0.122
Runtime version: 9.0.21
Security Fix(es):
* dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
* dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-6682
The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations.
Security Fix(es):
* perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.