AlmaLinux OS Errata System 0.0.1 5.10 2026-05-13T12:19:13 Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fix(es): * perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes (CVE-2024-56406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-56406 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38352 Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25749 Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim path traversal (CVE-2025-53906) * vim: Vim path traversial (CVE-2025-53905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-53905 CVE-2025-53906 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * podman: podman missing TLS verification (CVE-2025-6032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6032 Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices. Security Fix(es): * qtsvg: Uncontrolled recursion in Qt SVG module (CVE-2025-10728) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-10728 The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality. Security Fix(es): * mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests (CVE-2024-10306) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-10306 The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Vulnerability in GnuTLS certtool template parsing (CVE-2025-32990) * gnutls: Vulnerability in GnuTLS SCT extension parsing (CVE-2025-32989) * gnutls: Vulnerability in GnuTLS otherName SAN export (CVE-2025-32988) * gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() (CVE-2025-6395) Bug Fix(es) and Enhancement(s): * gnutls: Vulnerability in GnuTLS certtool template parsing (BZ#2359620) * gnutls: Vulnerability in GnuTLS SCT extension parsing (BZ#2359621) * gnutls: Vulnerability in GnuTLS otherName SAN export (BZ#2359622) * gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() (BZ#2376755) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6395 CVE-2025-32988 CVE-2025-32989 CVE-2025-32990 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028) * firefox: thunderbird: Memory safety bugs (CVE-2025-8035) * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031) * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027) * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030) * firefox: Memory safety bugs (CVE-2025-8034) * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033) * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032) * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8027 CVE-2025-8028 CVE-2025-8029 CVE-2025-8030 CVE-2025-8031 CVE-2025-8032 CVE-2025-8033 CVE-2025-8034 CVE-2025-8035 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.107 and .NET Runtime 9.0.6.Security Fix(es): * dotnet: .NET Remote Code Vulnerability (CVE-2025-30399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-30399 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client (CVE-2025-21605) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-21605 XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short. Security Fix(es): * xz: XZ has a heap-use-after-free bug in threaded .xz decoder (CVE-2025-31115) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-31115 The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * Ghostscript: NPDL device: Compression buffer overflow (CVE-2025-27832) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-27832 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.106 and .NET Runtime 9.0.5.Security Fix(es): * dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-26646 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.116 and .NET Runtime 8.0.16.Security Fix(es): * dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-26646 The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbounded name compression could lead to Denial of Service (CVE-2024-8508) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-8508 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Out-of-bounds access when resolving Promise objects (CVE-2025-4918) * firefox: Out-of-bounds access when optimizing linear sums (CVE-2025-4919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4918 CVE-2025-4919 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Denial of Service attack to websocket server (CVE-2025-32049) * libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header (CVE-2025-32907) * libsoup: Cookie domain validation bypass via uppercase characters in libsoup (CVE-2025-4035) * libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4035 CVE-2025-4948 CVE-2025-32049 CVE-2025-32907 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * libvpx: Heap buffer overflow in libvpx (CVE-2026-2447) * firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785) * firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793) * firefox: Undefined behavior in the DOM: Core & HTML component (CVE-2026-2771) * firefox: Integer overflow in the Audio/Video component (CVE-2026-2774) * firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776) * firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781) * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766) * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769) * firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787) * firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768) * firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783) * firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784) * firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026-2759) * firefox: Integer overflow in the JavaScript: Standard Library component (CVE-2026-2762) * firefox: Sandbox escape in the Graphics: WebRender component (CVE-2026-2761) * firefox: Privilege escalation in the Messaging System component (CVE-2026-2777) * firefox: Same-origin policy bypass in the Networking: JAR component (CVE-2026-2790) * firefox: Mitigation bypass in the DOM: HTML Parser component (CVE-2026-2775) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2763) * firefox: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2792) * firefox: Incorrect boundary conditions in the Web Audio component (CVE-2026-2773) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2786) * firefox: Use-after-free in the Graphics: ImageLib component (CVE-2026-2789) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component (CVE-2026-2757) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-2760) * firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-2772) * firefox: Incorrect boundary conditions in the Networking: JAR component (CVE-2026-2779) * firefox: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-2767) * firefox: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (CVE-2026-2764) * firefox: Privilege escalation in the Netmonitor component (CVE-2026-2782) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2765) * firefox: Privilege escalation in the Netmonitor component (CVE-2026-2780) * firefox: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component (CVE-2026-2778) * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-2758) * firefox: Mitigation bypass in the Networking: Cache component (CVE-2026-2791) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-2770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-2447 CVE-2026-2757 CVE-2026-2758 CVE-2026-2759 CVE-2026-2760 CVE-2026-2761 CVE-2026-2762 CVE-2026-2763 CVE-2026-2764 CVE-2026-2765 CVE-2026-2766 CVE-2026-2767 CVE-2026-2768 CVE-2026-2769 CVE-2026-2770 CVE-2026-2771 CVE-2026-2772 CVE-2026-2773 CVE-2026-2774 CVE-2026-2775 CVE-2026-2776 CVE-2026-2777 CVE-2026-2778 CVE-2026-2779 CVE-2026-2780 CVE-2026-2781 CVE-2026-2782 CVE-2026-2783 CVE-2026-2784 CVE-2026-2785 CVE-2026-2786 CVE-2026-2787 CVE-2026-2788 CVE-2026-2789 CVE-2026-2790 CVE-2026-2791 CVE-2026-2792 CVE-2026-2793 Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion (CVE-2025-25186) * CGI: Denial of Service in CGI::Cookie.parse (CVE-2025-27219) * uri: userinfo leakage in URI#join, URI#merge and URI#+ (CVE-2025-27221) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-25186 CVE-2025-27219 CVE-2025-27221 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909) * thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875) * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-3877) * thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-3875 CVE-2025-3877 CVE-2025-3909 CVE-2025-3932 GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-3887 Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: request smuggling attacks (CVE-2025-47905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-47905 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.117 and .NET Runtime 8.0.17.Security Fix(es): * dotnet: .NET Remote Code Vulnerability (CVE-2025-30399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-30399 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-5986) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5986 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: RDMA/mlx5: Fix page_size variable overflow (CVE-2025-22091) * kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121) * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797) * kernel: powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (CVE-2025-38088) * kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVE-2025-38110) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22091 CVE-2025-22121 CVE-2025-37797 CVE-2025-38088 CVE-2025-38110 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fix(es): * open-vm-tools:A malicious actor with non-administrative privileges on a guest virtual machine (VM) may tamper with the local files to trigger insecure file operations within that VM. (CVE-2025-22247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22247 SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. Security Fix(es): * SQLite: integer overflow in SQLite (CVE-2025-3277) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-3277 Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-23166 libblockdev is a C library supporting GObject introspection for manipulation of block devices. It has a plugin-based architecture where each technology (like LVM, Btrfs, MD RAID, Swap,...) is implemented in a separate plugin, possibly with multiple implementations (e.g. using LVM CLI or the new LVM DBus API). Security Fix(es): * libblockdev: Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. (CVE-2025-6019) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6019 The golang packages provide the Go programming language compiler. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Out-of-bounds access when resolving Promise objects (CVE-2025-4918) * firefox: thunderbird: Out-of-bounds access when optimizing linear sums (CVE-2025-4919) * firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267) * firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264) * firefox: thunderbird: Memory safety bugs (CVE-2025-5268) * firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266) * firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263) * firefox: thunderbird: Memory safety bug (CVE-2025-5269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4918 CVE-2025-4919 CVE-2025-5263 CVE-2025-5264 CVE-2025-5266 CVE-2025-5267 CVE-2025-5268 CVE-2025-5269 The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Double free in glibc (CVE-2025-8058) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8058 The golang packages provide the Go programming language compiler. Security Fix(es): * net/[http:](http:) Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4673 Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ice: Fix deinitializing VF in error path (CVE-2025-21883) * kernel: eth: bnxt: fix truesize for mb-xdp-pass case (CVE-2025-21961) * kernel: ibmvnic: Use kernel helpers for hex dumps (CVE-2025-22104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-21883 CVE-2025-21961 CVE-2025-22104 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-68285 GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. Security Fix(es): * gnome-remote-desktop: Uncontrolled Resource Consumption due to Malformed RDP PDUs (CVE-2025-5024) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5024 The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. Security Fix(es): * udisks: Missing Authorization Check Allows Unprivileged Users to Back Up LUKS Headers via udisks D-Bus API (CVE-2026-26104) * udisks: Missing Authorization Check Allows Unprivileged Users to Restore LUKS Headers via udisks D-Bus API (CVE-2026-26103) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26103 CVE-2026-26104 The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. Security Fix(es): * grub2: grub-core/gettext: Integer overflow leads to Heap OOB Write and Read. (CVE-2024-45776) * grub2: fs/ufs: OOB write in the heap (CVE-2024-45781) * grub2: command/gpg: Use-after-free due to hooks not being removed on module unload (CVE-2025-0622) * grub2: UFS: Integer overflow may lead to heap based out-of-bounds write when handling symlinks (CVE-2025-0677) * grub2: commands/dump: The dump command is not in lockdown when secure boot is enabled (CVE-2025-1118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-45776 CVE-2024-45781 CVE-2025-0622 CVE-2025-0677 CVE-2025-1118 The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794) * libxml: Null pointer dereference leads to Denial of service (DoS) (CVE-2025-49795) * libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796) * libxml2: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2 (CVE-2025-6021) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6021 CVE-2025-49794 CVE-2025-49795 CVE-2025-49796 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: padata: fix UAF in padata_reorder (CVE-2025-21727) * kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928) * kernel: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CVE-2025-21929) * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020) * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113) * kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085) * kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890) * kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052) * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086) * kernel: net/sched: fix use-after-free in taprio_dev_notifier (CVE-2025-38087) * kernel: nvme-tcp: sanitize request list handling (CVE-2025-38264) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-21727 CVE-2025-21928 CVE-2025-21929 CVE-2025-22020 CVE-2025-22085 CVE-2025-22113 CVE-2025-37890 CVE-2025-38052 CVE-2025-38086 CVE-2025-38087 CVE-2025-38264 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component (CVE-2025-10527) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2025-10532) * firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component (CVE-2025-10528) * firefox: thunderbird: Same-origin policy bypass in the Layout component (CVE-2025-10529) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 (CVE-2025-10537) * firefox: thunderbird: Information disclosure in the Networking: Cache component (CVE-2025-10536) * firefox: thunderbird: Integer overflow in the SVG component (CVE-2025-10533) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-10527 CVE-2025-10528 CVE-2025-10529 CVE-2025-10532 CVE-2025-10533 CVE-2025-10536 CVE-2025-10537 The libxml2 library is a development toolbox providing the implementation of various XML standards. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): The libxml2 library is a development toolbox providing the implementation of various XML standards. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: Out-of-Bounds Read in libxml2 (CVE-2025-32414) The libxml2 library is a development toolbox providing the implementation of various XML standards. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): The libxml2 library is a development toolbox providing the implementation of various XML standards. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: Out-of-Bounds Read in libxml2 (CVE-2025-32414) * libxml2: Out-of-bounds Read in xmlSchemaIDCFillNodeTables (CVE-2025-32415) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-32414 CVE-2025-32415 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759) * kernel: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CVE-2025-21991) * kernel: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (CVE-2025-37799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-21759 CVE-2025-21991 CVE-2025-37799 Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers. Security Fix(es): * avahi: Avahi Wide-Area DNS Uses Constant Source Port (CVE-2024-52615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-52615 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component (CVE-2025-10527) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2025-10532) * firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component (CVE-2025-10528) * firefox: thunderbird: Same-origin policy bypass in the Layout component (CVE-2025-10529) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 (CVE-2025-10537) * firefox: thunderbird: Information disclosure in the Networking: Cache component (CVE-2025-10536) * firefox: thunderbird: Integer overflow in the SVG component (CVE-2025-10533) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-10527 CVE-2025-10528 CVE-2025-10529 CVE-2025-10532 CVE-2025-10533 CVE-2025-10536 CVE-2025-10537 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * requests: Requests vulnerable to .netrc credentials leak via malicious URLs (CVE-2024-47081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-47081 A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding. Security Fix(es): * golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22869 The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Vector register overwrite bug in glibc (CVE-2025-5702) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5702 The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: Buffer Overflow vulnerability in libarchive (CVE-2025-25724) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-25724 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: exfat: fix random stack corruption after get_block (CVE-2025-22036) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22036 Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode (CVE-2025-49177) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-49175 CVE-2025-49176 CVE-2025-49177 CVE-2025-49178 CVE-2025-49179 CVE-2025-49180 The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts. Security Fix(es): * cloud-init: Cloud init permissions flaw (CVE-2024-6174) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-6174 Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988) * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125) * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976) * tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989) * tomcat: Apache Tomcat denial of service (CVE-2025-52520) * tomcat: Apache Tomcat denial of service (CVE-2025-52434) * tomcat: Apache Tomcat denial of service (CVE-2025-53506) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-48976 CVE-2025-48988 CVE-2025-48989 CVE-2025-49125 CVE-2025-52434 CVE-2025-52520 CVE-2025-53506 Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI. Security Fix(es): * nvidia-container-toolkit: Privilege Escalation via Hook Initialization in NVIDIA Container Toolkit (CVE-2025-23266) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-23266 Exiv2 is a C++ library to access image metadata, supporting read and write access to the Exif, IPTC and XMP metadata, Exif MakerNote support, extract and delete methods for Exif thumbnails, classes to access Ifd, and support for various image formats. Security Fix(es): * exiv2: Use After Free in Exiv2 (CVE-2025-26623) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-26623 The Qt 6 Quick3D library. Security Fix(es): * assimp: Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflow (CVE-2025-11277) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11277 The OpenJDK 21 runtime environment. Security Fix(es): * openjdk: Enhance Buffered Image handling (Oracle CPU 2025-04) (CVE-2025-30698) * openjdk: Improve compiler transformations (Oracle CPU 2025-04) (CVE-2025-30691) * openjdk: Better TLS connection support (Oracle CPU 2025-04) (CVE-2025-21587) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-21587 CVE-2025-30691 CVE-2025-30698 OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fix(es): * openjpeg: OpenJPEG OOB heap memory write (CVE-2025-54874) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-54874 Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-24813 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881) * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-52881 CVE-2025-58183 Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316) * tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677) * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-52316 CVE-2024-54677 CVE-2025-24813 Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337) * tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-56337 CVE-2025-31650 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-30204 FastCGI Perl bindings. Security Fix(es): * perl-fcgi: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library (CVE-2025-40907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-40907 Expat is a C library for parsing XML documents. Security Fix(es): * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-8176 Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection. Security Fix(es): * git: The sideband payload is passed unfiltered to the terminal in git (CVE-2024-52005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-52005 Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines. Security Fix(es): * libtpms: Libtpms Out-of-Bounds Read Vulnerability (CVE-2025-49133) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-49133 This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. Security Fix(es): * JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-40928 The iputils packages contain basic utilities for monitoring a network, including ping. Security Fix(es): * iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (CVE-2025-47268) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-47268 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Privilege escalation in Firefox Updater (CVE-2025-2817) * firefox: thunderbird: Unsafe attribute access during XPath parsing (CVE-2025-4087) * firefox: thunderbird: Process isolation bypass using "javascript:" URI links in cross-origin frames (CVE-2025-4083) * firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 (CVE-2025-4091) * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10 (CVE-2025-4093) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-2817 CVE-2025-4083 CVE-2025-4087 CVE-2025-4091 CVE-2025-4093 The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c (CVE-2025-5914) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5914 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: User Interface (UI) Misrepresentation of attachment URL (CVE-2025-3523) * thunderbird: Information Disclosure of /tmp directory listing (CVE-2025-2830) * thunderbird: Leak of hashed Window credentials via crafted attachment URL (CVE-2025-3522) * firefox: thunderbird: Privilege escalation in Firefox Updater (CVE-2025-2817) * firefox: thunderbird: Unsafe attribute access during XPath parsing (CVE-2025-4087) * firefox: thunderbird: Process isolation bypass using "javascript:" URI links in cross-origin frames (CVE-2025-4083) * firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 (CVE-2025-4091) * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10 (CVE-2025-4093) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-2817 CVE-2025-2830 CVE-2025-3522 CVE-2025-3523 CVE-2025-4083 CVE-2025-4087 CVE-2025-4091 CVE-2025-4093 The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: LPE via host option (CVE-2025-32462) * sudo: LPE via chroot option (CVE-2025-32463) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-32462 CVE-2025-32463 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * gnome-remote-desktop: freerdp: Unauthenticated RDP Packet Causes Segfault in FreeRDP Leading to Denial of Service (CVE-2025-4478) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4478 Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection. Security Fix(es): * git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349) * git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006) * git: Git arbitrary code execution (CVE-2025-48384) * git: Git arbitrary file writes (CVE-2025-48385) * gitk: Git file creation flaw (CVE-2025-27613) * gitk: git script execution flaw (CVE-2025-27614) * git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-50349 CVE-2024-52006 CVE-2025-27613 CVE-2025-27614 CVE-2025-46835 CVE-2025-48384 CVE-2025-48385 The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-31492 DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon. Security Fix(es): * kea: Loading a malicious hook library can lead to local privilege escalation (CVE-2025-32801) * kea: Insecure handling of file paths allows multiple local attacks (CVE-2025-32802) * kea: Insecure file permissions can result in confidential information leakage (CVE-2025-32803) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-32801 CVE-2025-32802 CVE-2025-32803 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * podman: Podman kube play command may overwrite host files (CVE-2025-9566) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9566 A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling. Security Fix(es): * qt5: qt6: QtCore Assertion Failure Denial of Service (CVE-2025-5455) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5455 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-27144 HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. Security Fix(es): * libxslt: Use-After-Free in libxslt numbers.c (CVE-2025-24855) * libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) (CVE-2024-55549) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-55549 CVE-2025-24855 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Double-free in libvpx encoder (CVE-2025-5283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5283 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * jinja2: Jinja sandbox breakout through attr filter selecting format method (CVE-2025-27516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-27516 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-47287 Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-27144 yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * yggdrasil: Local privilege escalation in yggdrasil (CVE-2025-3931) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-45336 CVE-2025-3931 GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: Integer overflow in in g_escape_uri_string() (CVE-2025-13601) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-13601 SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. Security Fix(es): * sqlite: Integer Truncation in SQLite (CVE-2025-6965) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6965 The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Uncontrolled Recursion in Wireshark (CVE-2025-1492) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-1492 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144) * golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22869 CVE-2025-27144 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: Redis Stack Buffer Overflow (CVE-2025-27151) * redis: Redis Unauthenticated Denial of Service (CVE-2025-48367) * redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-27151 CVE-2025-32023 CVE-2025-48367 The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module (CVE-2025-49630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-49630 The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound Cache poisoning (CVE-2025-5994) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5994 The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-30472 PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217) * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736) * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734) * php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219) * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861) * php: Reference counting in php_request_shutdown causes Use-After-Free (CVE-2024-11235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-11235 CVE-2025-1217 CVE-2025-1219 CVE-2025-1734 CVE-2025-1736 CVE-2025-1861 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028) * firefox: thunderbird: Memory safety bugs (CVE-2025-8035) * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031) * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027) * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030) * firefox: Memory safety bugs (CVE-2025-8034) * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033) * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032) * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8027 CVE-2025-8028 CVE-2025-8029 CVE-2025-8030 CVE-2025-8031 CVE-2025-8032 CVE-2025-8033 CVE-2025-8034 CVE-2025-8035 The libblockdev packages provide a C library with GObject introspection support used for low-level operations on block devices. The library serves as a thin wrapper around plug-ins for specific functionality, such as LVM, Btrfs, LUKS, or MD RAID. Security Fix(es): * libblockdev: LPE from allow_active to root in libblockdev via udisks (CVE-2025-6019) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6019 The International Components for Unicode (ICU) library provides robust and full-featured Unicode services. Security Fix(es): * icu: Stack buffer overflow in the SRBRoot::addTag function (CVE-2025-5222) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5222 Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (CVE-2024-45341) * golang: net/[http:](http:) net/[http:](http:) sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336) * crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-45336 CVE-2024-45341 CVE-2025-22866 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435) * cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718) * cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330) * python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517) * cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-12718 CVE-2025-4138 CVE-2025-4330 CVE-2025-4435 CVE-2025-4517 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182) * thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179) * thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180) * thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9179 CVE-2025-9180 CVE-2025-9181 CVE-2025-9182 CVE-2025-9185 The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: heap buffer over-read in header_gnu_longlink (CVE-2024-57970) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-57970 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net_sched: ets: Fix double list add in class with netem as child qdisc (CVE-2025-37914) * kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200) * kernel: ice: fix eswitch code memory leak in reset scenario (CVE-2025-38417) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-37914 CVE-2025-38200 CVE-2025-38417 Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC). Security Fix(es): * krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions (CVE-2025-3576) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-3576 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267) * firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264) * firefox: thunderbird: Memory safety bugs (CVE-2025-5268) * firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266) * firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263) * firefox: thunderbird: Memory safety bug (CVE-2025-5269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5263 CVE-2025-5264 CVE-2025-5266 CVE-2025-5267 CVE-2025-5268 CVE-2025-5269 CVE-2025-5283 AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4404 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: uvcvideo: Remove dangling pointers (CVE-2024-58002) * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980) * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905) * kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958) * kernel: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (CVE-2025-38089) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-57980 CVE-2024-58002 CVE-2025-21905 CVE-2025-37958 CVE-2025-38089 The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Better Glyph drawing (CVE-2025-30749) * JDK: Enhance TLS protocol support (CVE-2025-30754) * JDK: Improve HTTP client header handling (CVE-2025-50059) * JDK: Better Glyph drawing redux (CVE-2025-50106) Bug Fix(es): * In AlmaLinuxand AlmaLinux systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (AlmaLinux-102683, AlmaLinux-102684, AlmaLinux-102685) * On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In the G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code assumes that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling can lead to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the G1AllocRegion being used changes mid-operation. This update resolves this issue by always using the same NUMA node and associated G1AllocRegion object throughout an operation. (AlmaLinux-90307, AlmaLinux-90308, AlmaLinux-90311) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-30749 CVE-2025-30754 CVE-2025-50059 CVE-2025-50106 Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-31498 The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: insufficient escaping of user-supplied data in mod_ssl (CVE-2024-47252) * httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption (CVE-2025-23048) * httpd: HTTP Session Hijack via a TLS upgrade (CVE-2025-49812) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-47252 CVE-2025-23048 CVE-2025-49812 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784) * libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906) * libsoup: Denial of service on libsoup through HTTP/2 server (CVE-2025-32908) * libsoup: NULL pointer dereference in client when server omits the "nonce" parameter in an Unauthorized response with Digest authentication (CVE-2025-32912) * libsoup: OOB Read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process (CVE-2025-32914) * libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server (CVE-2025-46421) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-2784 CVE-2025-32906 CVE-2025-32908 CVE-2025-32912 CVE-2025-32914 CVE-2025-46421 The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of arbitrary JavaBeans. Security Fix(es): * commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (CVE-2025-48734) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-48734 Advanced Intrusion Detection Environment (AIDE) is a utility that creates a database of files on the system, and then uses that database to ensure file integrity and detect system intrusions. Security Fix(es): * aide: improper output neutralization enables bypassing (CVE-2025-54389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-54389 The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS (CVE-2025-58364) * cups: Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58060 CVE-2025-58364 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396) * kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527) * kernel: cifs: Fix the smbd_response slab to allow usercopy (CVE-2025-38523) * kernel: tls: fix handling of zero-length records on the rx_list (CVE-2025-39682) * kernel: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698) * kernel: s390/sclp: Fix SCCB present check (CVE-2025-39694) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38396 CVE-2025-38523 CVE-2025-38527 CVE-2025-39682 CVE-2025-39694 CVE-2025-39698 PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL executes arbitrary code in restore operation (CVE-2025-8715) * postgresql: PostgreSQL code execution in restore operation (CVE-2025-8714) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8714 CVE-2025-8715 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (CVE-2025-21867) * kernel: net: fix udp gso skb_segment after pull from frag_list (CVE-2025-38124) * kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CVE-2025-38250) * kernel: i2c/designware: Fix an initialization issue (CVE-2025-38380) * kernel: tls: always refresh the queue when reading sock (CVE-2025-38471) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-21867 CVE-2025-38124 CVE-2025-38250 CVE-2025-38380 CVE-2025-38471 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182) * thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179) * thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180) * thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9179 CVE-2025-9180 CVE-2025-9181 CVE-2025-9182 CVE-2025-9185 The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. Security Fix(es): * udisks: Out-of-bounds read in UDisks Daemon (CVE-2025-8067) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8067 MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * openssl: Timing side-channel in ECDSA signature computation (CVE-2024-13176) * mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688) * mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699) * mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683) * mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715) * mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585) * mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21588) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687) * mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580) * mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696) * mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705) * mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575) * mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685) * mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693) * mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684) * curl: libcurl: WebSocket endless loop (CVE-2025-5399) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092) * mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077) * mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085) * mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082) * mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087) * mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084) * mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) (CVE-2025-50100) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50094) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50098) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50096) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50102) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-13176 CVE-2025-5399 CVE-2025-21574 CVE-2025-21575 CVE-2025-21577 CVE-2025-21579 CVE-2025-21580 CVE-2025-21581 CVE-2025-21584 CVE-2025-21585 CVE-2025-21588 CVE-2025-30681 CVE-2025-30682 CVE-2025-30683 CVE-2025-30684 CVE-2025-30685 CVE-2025-30687 CVE-2025-30688 CVE-2025-30689 CVE-2025-30693 CVE-2025-30695 CVE-2025-30696 CVE-2025-30699 CVE-2025-30703 CVE-2025-30704 CVE-2025-30705 CVE-2025-30715 CVE-2025-30721 CVE-2025-30722 CVE-2025-50077 CVE-2025-50078 CVE-2025-50079 CVE-2025-50080 CVE-2025-50081 CVE-2025-50082 CVE-2025-50083 CVE-2025-50084 CVE-2025-50085 CVE-2025-50086 CVE-2025-50087 CVE-2025-50088 CVE-2025-50091 CVE-2025-50092 CVE-2025-50093 CVE-2025-50094 CVE-2025-50096 CVE-2025-50097 CVE-2025-50098 CVE-2025-50099 CVE-2025-50100 CVE-2025-50101 CVE-2025-50102 CVE-2025-50104 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097) * kernel: udmabuf: fix a buf size overflow issue during udmabuf creation (CVE-2025-37803) * kernel: net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350) * kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22097 CVE-2025-37803 CVE-2025-38350 CVE-2025-38449 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-47273 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ublk: make sure ubq->canceling is set when queue is frozen (CVE-2025-22068) * kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332) * kernel: idpf: convert control queue mutex to a spinlock (CVE-2025-38392) * kernel: tcp: Correct signedness in skb remaining space calculation (CVE-2025-38463) * kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498) * kernel: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500) * kernel: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CVE-2025-38550) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22068 CVE-2025-38332 CVE-2025-38392 CVE-2025-38463 CVE-2025-38498 CVE-2025-38500 CVE-2025-38550 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts (CVE-2025-67733) * valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-67733 CVE-2026-21863 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: usb: dwc3: gadget: check that event count does not exceed event buffer length (CVE-2025-37810) * kernel: sunrpc: fix handling of server side tls alerts (CVE-2025-38566) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-37810 CVE-2025-38566 The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fix(es): * open-vm-tools: Local privilege escalation in open-vm-tools (CVE-2025-41244) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-41244 The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: Libtiff Write-What-Where (CVE-2025-9900) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9900 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8194 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026) * kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22026 CVE-2025-38718 The zziplib is a lightweight library to easily extract data from zip files. Security Fix(es): * zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2018-17828 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udp: Fix memory accounting leak. (CVE-2025-22058) * kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823) * kernel: ext4: only dirty folios when data journaling regular files (CVE-2025-38220) * kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211) * kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464) * kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461) * kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22058 CVE-2025-37823 CVE-2025-38211 CVE-2025-38220 CVE-2025-38461 CVE-2025-38464 CVE-2025-38472 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Content-Disposition header ignored when a file is included in an embed or object tag (CVE-2025-6430) * firefox: Use-after-free in FontFaceSet (CVE-2025-6424) * firefox: Incorrect parsing of URLs could have allowed embedding of youtube.com (CVE-2025-6429) * firefox: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID (CVE-2025-6425) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6424 CVE-2025-6425 CVE-2025-6429 CVE-2025-6430 The golang packages provide the Go programming language compiler. Security Fix(es): * cmd/go: Go VCS Command Execution Vulnerability (CVE-2025-4674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4674 Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * net/[http:](http:) Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4673 libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: out-of-bounds read in sftp_handle() (CVE-2025-5318) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5318 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11021 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556) * kernel: wifi: ath12k: Decrement TID on RX peer frag setup error handling (CVE-2025-39761) * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38556 CVE-2025-39757 CVE-2025-39761 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (CVE-2025-38351) * kernel: sunrpc: fix client side handling of tls alerts (CVE-2025-38571) * kernel: eventpoll: Fix semi-unbounded recursion (CVE-2025-38614) * kernel: ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572) * kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817) * kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38351 CVE-2025-38571 CVE-2025-38572 CVE-2025-38614 CVE-2025-39817 CVE-2025-39841 Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229) * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230) * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-62229 CVE-2025-62230 CVE-2025-62231 The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fix(es): * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise (CVE-2024-56433) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Low Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-56433 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817) * Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818) * Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819) * Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 CVE-2025-49844 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * thunderbird: firefox: Memory safety bugs (CVE-2025-11714) * thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures (CVE-2025-11709) * thunderbird: firefox: Cross-process information leaked due to malicious IPC messages (CVE-2025-11710) * thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708) * thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type (CVE-2025-11712) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVE-2025-11715) * thunderbird: firefox: Some non-writable Object properties could be modified (CVE-2025-11711) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11708 CVE-2025-11709 CVE-2025-11710 CVE-2025-11711 CVE-2025-11712 CVE-2025-11714 CVE-2025-11715 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es): * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315) * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-55247 CVE-2025-55248 CVE-2025-55315 Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fix(es): * squid-cache: Squid vulnerable to information disclosure via authentication credential leakage in error handling (CVE-2025-62168) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-62168 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466) (CVE-2024-53241) * kernel: exfat: fix out-of-bounds access of directory entries (CVE-2024-53147) * kernel: zram: fix NULL pointer in comp_algorithm_show() (CVE-2024-53222) * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216) * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662) * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675) * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY (CVE-2024-56690) * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332) * kernel: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK (CVE-2024-57901) * kernel: af_packet: fix vlan_get_tci() vs MSG_PEEK (CVE-2024-57902) * kernel: io_uring/sqpoll: zero sqd->thread on tctx errors (CVE-2025-21633) * kernel: ipvlan: Fix use-after-free in ipvlan_get_iflink(). (CVE-2025-21652) * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647) * kernel: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (CVE-2025-21655) * kernel: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled (CVE-2024-57941) * kernel: netfs: Fix ceph copy to cache on write-begin (CVE-2024-57942) * kernel: zram: fix potential UAF of zram table (CVE-2025-21671) * kernel: pktgen: Avoid out-of-bounds access in get_imix_entries (CVE-2025-21680) * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693) * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691) * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696) * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702) * kernel: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (CVE-2025-21732) * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795) * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456) * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987) * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014) * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988) * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570) * kernel: media: intel/ipu6: remove cpu latency qos request on error (CVE-2024-58004) * kernel: usbnet: ipheth: use static NDP16 location in URB (CVE-2025-21742) * kernel: usbnet: ipheth: fix possible overflow in DPE length check (CVE-2025-21743) * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989) * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015) * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995) * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796) * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786) * kernel: tpm: Change to kvalloc() in eventlog/acpi.c (CVE-2024-58005) * kernel: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (CVE-2024-58013) * kernel: ring-buffer: Validate the persistent meta data subbuf array (CVE-2025-21777) * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738) * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections (CVE-2024-57986) * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726) * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791) * kernel: HID: multitouch: Add NULL check in mt_input_configured (CVE-2024-58020) * kernel: i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition (CVE-2024-57984) * kernel: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (CVE-2025-21761) * kernel: sched_ext: Fix incorrect autogroup migration detection (CVE-2025-21771) * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981) * kernel: memcg: fix soft lockup in the OOM process (CVE-2024-57977) * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790) * kernel: usbnet: ipheth: fix DPE OoB read (CVE-2025-21741) * kernel: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CVE-2025-21785) * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765) * kernel: PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() (CVE-2024-58006) * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012) * kernel: wifi: brcmfmac: Check the return value of of_property_read_string_index() (CVE-2025-21750) * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072) * kernel: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CVE-2024-58069) * kernel: wifi: mac80211: prohibit deactivating all links (CVE-2024-58061) * kernel: idpf: convert workqueues to unbound (CVE-2024-58057) * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828) * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826) * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077) * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075) * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837) * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350) * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357) * kernel: net/sched: cls_api: fix error handling causing NULL dereference (CVE-2025-21857) * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851) * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855) * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844) * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853) * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847) * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864) * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088) * kernel: acct: perform last write from workqueue (CVE-2025-21846) * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() (CVE-2025-21861) * kernel: io_uring: prevent opcode speculation (CVE-2025-21863) * kernel: fbdev: hyperv_fb: Allow graceful removal of framebuffer (CVE-2025-21976) * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056) * kernel: net: ppp: Add bound checking for skb data on ppp_sync_txmung (CVE-2025-37749) * microcode_ctl: From CVEorg collector (CVE-2024-28956) * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994) * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116) * kernel: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (CVE-2025-38412) * kernel: dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (CVE-2025-38369) * kernel: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (CVE-2025-38468) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-28956 CVE-2024-36350 CVE-2024-36357 CVE-2024-49570 CVE-2024-52332 CVE-2024-53147 CVE-2024-53216 CVE-2024-53222 CVE-2024-53241 CVE-2024-54456 CVE-2024-56662 CVE-2024-56675 CVE-2024-56690 CVE-2024-57901 CVE-2024-57902 CVE-2024-57941 CVE-2024-57942 CVE-2024-57977 CVE-2024-57981 CVE-2024-57984 CVE-2024-57986 CVE-2024-57987 CVE-2024-57988 CVE-2024-57989 CVE-2024-57995 CVE-2024-58004 CVE-2024-58005 CVE-2024-58006 CVE-2024-58012 CVE-2024-58013 CVE-2024-58014 CVE-2024-58015 CVE-2024-58020 CVE-2024-58057 CVE-2024-58061 CVE-2024-58069 CVE-2024-58072 CVE-2024-58075 CVE-2024-58077 CVE-2024-58088 CVE-2025-21633 CVE-2025-21647 CVE-2025-21652 CVE-2025-21655 CVE-2025-21671 CVE-2025-21680 CVE-2025-21691 CVE-2025-21693 CVE-2025-21696 CVE-2025-21702 CVE-2025-21726 CVE-2025-21732 CVE-2025-21738 CVE-2025-21741 CVE-2025-21742 CVE-2025-21743 CVE-2025-21750 CVE-2025-21761 CVE-2025-21765 CVE-2025-21771 CVE-2025-21777 CVE-2025-21785 CVE-2025-21786 CVE-2025-21790 CVE-2025-21791 CVE-2025-21795 CVE-2025-21796 CVE-2025-21826 CVE-2025-21828 CVE-2025-21837 CVE-2025-21844 CVE-2025-21846 CVE-2025-21847 CVE-2025-21851 CVE-2025-21853 CVE-2025-21855 CVE-2025-21857 CVE-2025-21861 CVE-2025-21863 CVE-2025-21864 CVE-2025-21976 CVE-2025-22056 CVE-2025-37749 CVE-2025-37994 CVE-2025-38116 CVE-2025-38369 CVE-2025-38412 CVE-2025-38468 DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon. Security Fix(es): * kea: Invalid characters cause assert (CVE-2025-11232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11232 The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance Path Factories (CVE-2025-53066) * JDK: Enhance Certificate Handling (CVE-2025-53057) * JDK: Enhance String Handling (CVE-2025-61748) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-53057 CVE-2025-53066 CVE-2025-61748 libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: out-of-bounds read in sftp_handle() (CVE-2025-5318) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5318 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: firefox: Memory safety bugs (CVE-2025-11714) * thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures (CVE-2025-11709) * thunderbird: firefox: Cross-process information leaked due to malicious IPC messages (CVE-2025-11710) * thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708) * thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type (CVE-2025-11712) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVE-2025-11715) * thunderbird: firefox: Some non-writable Object properties could be modified (CVE-2025-11711) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11708 CVE-2025-11709 CVE-2025-11710 CVE-2025-11711 CVE-2025-11712 CVE-2025-11714 CVE-2025-11715 The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830) * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770) * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771) * rack: Rack memory exhaustion denial of service (CVE-2025-61772) * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion (CVE-2025-61919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-59830 CVE-2025-61770 CVE-2025-61771 CVE-2025-61772 CVE-2025-61919 The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: Libtiff Write-What-Where (CVE-2025-9900) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9900 Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim path traversal (CVE-2025-53906) * vim: Vim path traversial (CVE-2025-53905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-53905 CVE-2025-53906 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730) * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-39730 CVE-2025-39955 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es): * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315) * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-55247 CVE-2025-55248 CVE-2025-55315 Expat is a C library for parsing XML documents. Security Fix(es): * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-59375 AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-7493 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945) * libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4945 CVE-2025-11021 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778) * bind: Cache poisoning due to weak PRNG (CVE-2025-40780) * bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8677 CVE-2025-40778 CVE-2025-40780 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: cifs: Fix oops due to uninitialised variable (CVE-2025-38737) * kernel: can: j1939: implement NETDEV_UNREGISTER notification handler (CVE-2025-39925) * kernel: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CVE-2025-39982) * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981) * kernel: net/mlx5: fs, fix UAF in flow counter release (CVE-2025-39979) * kernel: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CVE-2025-39983) * kernel: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (CVE-2025-40047) * kernel: iommu/vt-d: Disallow dirty tracking if incoherent page walk (CVE-2025-40058) * kernel: ice: ice_adapter: release xa entry on adapter allocation failure (CVE-2025-40185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38737 CVE-2025-39925 CVE-2025-39979 CVE-2025-39981 CVE-2025-39982 CVE-2025-39983 CVE-2025-40047 CVE-2025-40058 CVE-2025-40185 Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fix(es): * linux-pam: Linux-pam directory Traversal (CVE-2025-6020) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6020 OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9230 The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities. Security Fix(es): * binutils: GNU Binutils ld elflink.c elf_gc_sweep memory corruption (CVE-2025-5244) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5244 The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fix(es): * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11230 OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH SSHD Agent Forwarding and X11 Forwarding (CVE-2025-32728) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-32728 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-27877 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ublk: make sure ubq->canceling is set when queue is frozen (CVE-2025-22068) * kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724) * kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883) * kernel: e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898) * kernel: wifi: mt76: fix linked list corruption (CVE-2025-39918) * kernel: i40e: fix idx validation in config queues msg (CVE-2025-39971) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22068 CVE-2025-38724 CVE-2025-39883 CVE-2025-39898 CVE-2025-39918 CVE-2025-39971 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088) * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-59088 CVE-2025-59089 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018) * firefox: Use-after-free in the Audio/Video component (CVE-2025-13014) * firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016) * firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019) * firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020) * firefox: Race condition in the Graphics component (CVE-2025-13012) * firefox: Spoofing issue in Firefox (CVE-2025-13015) * firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013) * firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-13012 CVE-2025-13013 CVE-2025-13014 CVE-2025-13015 CVE-2025-13016 CVE-2025-13017 CVE-2025-13018 CVE-2025-13019 CVE-2025-13020 MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * mysql: DML unspecified vulnerability (CPU Oct 2025) (CVE-2025-53053) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53044) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53062) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53054) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53045) * mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53040) * mysql: Components Services unspecified vulnerability (CPU Oct 2025) (CVE-2025-53069) * mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53042) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-53040 CVE-2025-53042 CVE-2025-53044 CVE-2025-53045 CVE-2025-53053 CVE-2025-53054 CVE-2025-53062 CVE-2025-53069 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Heap Use-After-Free in libsoup message queue handling during HTTP/2 read completion (CVE-2025-12105) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-12105 Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651) * tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-31651 CVE-2025-55752 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-52881 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 (CVE-2025-14333) * firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2025-14322) * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328) * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329) * firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331) * firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14321 CVE-2025-14322 CVE-2025-14323 CVE-2025-14324 CVE-2025-14325 CVE-2025-14328 CVE-2025-14329 CVE-2025-14330 CVE-2025-14331 CVE-2025-14333 Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651) * tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service (CVE-2025-61795) * tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-31651 CVE-2025-55752 CVE-2025-61795 The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Access of Uninitialized Pointer in Wireshark (CVE-2025-13499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-13499 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58183 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * database/sql: Postgres Scan Race Condition (CVE-2025-47907) * podman: Podman kube play command may overwrite host files (CVE-2025-9566) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9566 CVE-2025-47907 Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61729 CVE-2025-68121 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702) * kernel: kernfs: Fix UAF in polling when open file is released (CVE-2025-39881) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-39702 CVE-2025-39881 A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-27144 The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) Bug Fix(es): * When using a P11SecretKey for both signing and encryption in FIPS mode, the FIPS PKCS11 provider would fail with a CKR_ATTRIBUTE_VALUE_INVALID error. This was due to the default configuration not applying the CKA_ENCRYPT=true attribute to the key. The configuration in this release is updated to include this attribute. (AlmaLinux-142860, AlmaLinux-142876, AlmaLinux-142877, AlmaLinux-142878, AlmaLinux-142879, AlmaLinux-142880) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-64720 CVE-2025-65018 CVE-2026-21925 CVE-2026-21933 CVE-2026-21945 Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices. Security Fix(es): * qtsvg: Use-after-free vulnerability in Qt SVG (CVE-2025-10729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-10729 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817) * Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818) * Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819) * Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 CVE-2025-49844 libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: Invalid return code for chacha20 poly1305 with OpenSSL backend (CVE-2025-5987) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5987 OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand (CVE-2025-61984) * openssh: OpenSSH: Null character in ssh:// URI can lead to code execution via ProxyCommand (CVE-2025-61985) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61984 CVE-2025-61985 The Go Programming Language. Security Fix(es): * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58183 Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229) * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230) * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-62229 CVE-2025-62230 CVE-2025-62231 The golang packages provide the Go programming language compiler. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61729 PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004) * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-2004 CVE-2026-2005 CVE-2026-2006 Expat is a C library for parsing XML documents. Security Fix(es): * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-59375 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778) * bind: Cache poisoning due to weak PRNG (CVE-2025-40780) * bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8677 CVE-2025-40778 CVE-2025-40780 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018) * firefox: Use-after-free in the Audio/Video component (CVE-2025-13014) * firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016) * firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019) * firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020) * firefox: Race condition in the Graphics component (CVE-2025-13012) * firefox: Spoofing issue in Firefox (CVE-2025-13015) * firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013) * firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-13012 CVE-2025-13013 CVE-2025-13014 CVE-2025-13015 CVE-2025-13016 CVE-2025-13017 CVE-2025-13018 CVE-2025-13019 CVE-2025-13020 The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58183 Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution. Security Fix(es): * keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-13609 This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning. Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal. Security Fix(es): * mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-55753 The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files. Security Fix(es): * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) * libpng: LIBPNG out-of-bounds read in png_image_read_composite (CVE-2025-66293) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-64720 CVE-2025-65018 CVE-2025-66293 The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive (CVE-2026-4111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4111 Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * git-lfs: Git LFS may write to arbitrary files via crafted symlinks (CVE-2025-26625) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-26625 The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fix(es): * tar: Tar path traversal (CVE-2025-45582) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-45582 The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems (CVE-2025-11561) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11561 Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61729 CVE-2025-68121 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58183 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 (CVE-2025-14333) * firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2025-14322) * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328) * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329) * firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331) * firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14321 CVE-2025-14322 CVE-2025-14323 CVE-2025-14324 CVE-2025-14325 CVE-2025-14328 CVE-2025-14329 CVE-2025-14330 CVE-2025-14331 CVE-2025-14333 The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities. Security Fix(es): * binutils: GNU Binutils Linker heap-based overflow (CVE-2025-11082) * binutils: GNU Binutils Linker heap-based overflow (CVE-2025-11083) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11082 CVE-2025-11083 The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools, which provides better performance than the traditional Linux NFS server used by most users. These packages also contain the mount.nfs, umount.nfs, and showmount programs. Security Fix(es): * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-12801 Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression. Security Fix(es): * Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS (CVE-2025-6176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6176 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CVE-2025-38499) * kernel: net: tun: Update napi->skb after XDP process (CVE-2025-39984) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38499 CVE-2025-39984 Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * resolv: Denial of Service in resolv gem (CVE-2025-24294) * rexml: REXML denial of service (CVE-2025-58767) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-24294 CVE-2025-58767 CVE-2025-61594 The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082) * httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200) * httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58098 CVE-2025-65082 CVE-2025-66200 gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. Security Fix(es): * gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing (CVE-2025-67269) * gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling (CVE-2025-67268) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-67268 CVE-2025-67269 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8291 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-66418 CVE-2025-66471 CVE-2026-21441 Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation (CVE-2025-68156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-68156 The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter. Security Fix(es): * gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-5201 The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915) * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58436 CVE-2025-61915 Binutils is a collection of binary utilities, including ar (for creating, modifying and extracting from archives), as (a family of GNU assemblers), gprof (for displaying call graph profile data), ld (the GNU linker), nm (for listing symbols from object files), objcopy (for copying and translating object files), objdump (for displaying information from object files), ranlib (for generating an index for the contents of an archive), readelf (for displaying detailed information about binary files), size (for listing the section sizes of an object or archive file), strings (for listing printable strings from files), strip (for discarding symbols), and addr2line (for converting addresses to file and line). Security Fix(es): * binutils: GNU Binutils Linker heap-based overflow (CVE-2025-11083) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11083 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (First- vs Last-Value Wins) (CVE-2025-14523) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14523 MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21941) * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21948) * mysql: InnoDB unspecified vulnerability (CPU Jan 2026) (CVE-2026-21936) * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21968) * mysql: DDL unspecified vulnerability (CPU Jan 2026) (CVE-2026-21937) * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2026) (CVE-2026-21964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-21936 CVE-2026-21937 CVE-2026-21941 CVE-2026-21948 CVE-2026-21964 CVE-2026-21968 PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-12818 The vsftpd packages include a Very Secure File Transfer Protocol (FTP) daemon, which is used to serve files over a network. Security Fix(es): * vsftpd: vsftpd: Denial of service via integer overflow in ls command parameter parsing (CVE-2025-14242) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14242 The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser. Security Fix(es): * net-snmp: buffer overflow via a specially crafted packet can cause a crash in snmptrapd (CVE-2025-68615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-68615 Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-32365 The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fix(es): * postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-12818 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806) * kernel: audit: fix out-of-bounds read in audit_compare_dname_path() (CVE-2025-39840) * kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843) * kernel: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver (CVE-2025-39905) * kernel: iommufd: Fix race during abort for file descriptors (CVE-2025-39966) * kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176) * kernel: sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240) * kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CVE-2025-40277) * kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CVE-2025-68287) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-39806 CVE-2025-39840 CVE-2025-39843 CVE-2025-39905 CVE-2025-39966 CVE-2025-40176 CVE-2025-40240 CVE-2025-40277 CVE-2025-68287 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-47913 MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490) * mariadb: MariaDB Server Crash Due to Empty Backtrace Log (CVE-2023-52969) * mariadb: MariaDB Server Crash (CVE-2023-52971) * mariadb: MariaDB Server Crash via Item_direct_view_ref (CVE-2023-52970) * mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693) * mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation (CVE-2025-13699) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2023-52969 CVE-2023-52970 CVE-2023-52971 CVE-2025-13699 CVE-2025-21490 CVE-2025-30693 CVE-2025-30722 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-47913 HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61729 The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-64720 CVE-2025-65018 CVE-2026-21925 CVE-2026-21933 CVE-2026-21945 The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fix(es): * util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames (CVE-2025-14104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14104 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Excessive read buffering DoS in http.client (CVE-2025-13836) * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (CVE-2025-12084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-12084 CVE-2025-13836 OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file (CVE-2025-11187) * openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing (CVE-2025-15467) * openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling (CVE-2025-15468) * openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation (CVE-2025-15469) * openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression (CVE-2025-66199) * openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter (CVE-2025-68160) * openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418) * openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419) * openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing (CVE-2025-69421) * openssl: OpenSSL: Denial of Service via malformed TimeStamp Response (CVE-2025-69420) * openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing (CVE-2026-22795) * openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification (CVE-2026-22796) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11187 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469 CVE-2025-66199 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420 CVE-2025-69421 CVE-2026-22795 CVE-2026-22796 The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards. Security Fix(es): * GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write (CVE-2025-68973) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-68973 The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9086 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking (CVE-2026-24049) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-24049 Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-68121 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819) * kernel: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CVE-2025-38022) * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349) * kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453) * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568) * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731) * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154) * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170) * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135) * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158) * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248) * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258) * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251) * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service. (CVE-2025-40271) * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and denial of service (CVE-2025-40294) * kernel: Linux kernel: Information disclosure and denial of service in Bluetooth HCI event handling (CVE-2025-40301) * kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318) * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301) * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-37819 CVE-2025-38022 CVE-2025-38349 CVE-2025-38453 CVE-2025-38568 CVE-2025-38731 CVE-2025-40135 CVE-2025-40154 CVE-2025-40158 CVE-2025-40170 CVE-2025-40248 CVE-2025-40251 CVE-2025-40258 CVE-2025-40271 CVE-2025-40294 CVE-2025-40301 CVE-2025-40318 CVE-2025-68301 CVE-2025-68305 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service due to data race in vmalloc's show_numa_info function (CVE-2025-38383) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38383 PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: heap-based buffer overflow in array_merge() (CVE-2025-14178) * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177) * php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14177 CVE-2025-14178 CVE-2025-14180 The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Integer overflow in memalign leads to heap corruption (CVE-2026-0861) * glibc: glibc: Information disclosure via zero-valued network query (CVE-2026-0915) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-0861 CVE-2026-0915 Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-2026-21637) * nodejs: Nodejs denial of service (CVE-2025-59466) * nodejs: Nodejs denial of service (CVE-2025-59465) * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131) * nodejs: Nodejs file permissions bypass (CVE-2025-55130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-55130 CVE-2025-55131 CVE-2025-55132 CVE-2025-59465 CVE-2025-59466 CVE-2026-21637 Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: iperf Heap Buffer Overflow (CVE-2025-54349) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-54349 Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-2026-21637) * nodejs: Nodejs denial of service (CVE-2025-59466) * nodejs: Nodejs denial of service (CVE-2025-59465) * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131) * nodejs: Nodejs file permissions bypass (CVE-2025-55130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-55130 CVE-2025-55131 CVE-2025-55132 CVE-2025-59465 CVE-2025-59466 CVE-2026-21637 The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: Sudo: Privilege escalation due to failure in privilege drop calls (CVE-2026-35535) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-35535 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication (CVE-2026-0719) * libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response (CVE-2026-1761) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-0719 CVE-2026-1761 A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58183 Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11234 The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * Wireshark: NULL Pointer Dereference in Wireshark (CVE-2025-9817) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9817 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting (CVE-2025-38141) * kernel: Linux kernel io_uring: Local privilege escalation, information disclosure, or denial of service via use-after-free (CVE-2025-38106) * kernel: drm/xe: Make dma-fences compliant with the safe access rules (CVE-2025-38703) * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing (CVE-2025-39760) * kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CVE-2025-39818) * kernel: Kernel: Use-after-free in GPIO character device allows privilege escalation or denial of service (CVE-2025-40249) * kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085) * kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001) * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097) * kernel: Linux kernel: Information disclosure in efivarfs via incorrect error propagation (CVE-2026-23156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38106 CVE-2025-38141 CVE-2025-38703 CVE-2025-39760 CVE-2025-39818 CVE-2025-40249 CVE-2025-71085 CVE-2026-23001 CVE-2026-23097 CVE-2026-23156 Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61729 The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-23490 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327) * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147 (CVE-2026-0891) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-0878) * firefox: Use-after-free in the IPC component (CVE-2026-0882) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884) * firefox: Information disclosure in the Networking component (CVE-2026-0883) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877) * firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890) * firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879) * firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880) * firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14327 CVE-2026-0877 CVE-2026-0878 CVE-2026-0879 CVE-2026-0880 CVE-2026-0882 CVE-2026-0883 CVE-2026-0884 CVE-2026-0885 CVE-2026-0886 CVE-2026-0887 CVE-2026-0890 CVE-2026-0891 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327) * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147 (CVE-2026-0891) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-0878) * firefox: Use-after-free in the IPC component (CVE-2026-0882) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884) * firefox: Information disclosure in the Networking component (CVE-2026-0883) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877) * firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890) * firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879) * firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880) * firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14327 CVE-2026-0877 CVE-2026-0878 CVE-2026-0879 CVE-2026-0880 CVE-2026-0882 CVE-2026-0883 CVE-2026-0884 CVE-2026-0885 CVE-2026-0886 CVE-2026-0887 CVE-2026-0890 CVE-2026-0891 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response (CVE-2026-1761) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-1761 The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4800 Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution. Security Fix(es): * keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication (CVE-2026-1709) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Critical Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-1709 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. (CVE-2026-23530) * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability (CVE-2026-23884) * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883) * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution (CVE-2026-23533) * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution. (CVE-2026-23531) * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow (CVE-2026-23534) * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow (CVE-2026-23532) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-23530 CVE-2026-23531 CVE-2026-23532 CVE-2026-23533 CVE-2026-23534 CVE-2026-23883 CVE-2026-23884 The golang packages provide the Go programming language compiler. Security Fix(es): * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61728 CVE-2025-61732 CVE-2025-68121 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es): * .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127) * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26127 CVE-2026-26130 The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards. Security Fix(es): * GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution (CVE-2026-24882) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-24882 The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-13465 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es): * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26130 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation (CVE-2025-38415) * kernel: vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403) * kernel: Linux kernel: Data corruption and system instability due to improper io_uring/net buffer handling (CVE-2025-38730) * kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length (CVE-2025-39933) * kernel: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable() (CVE-2025-40133) * kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. (CVE-2025-40304) * kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling (CVE-2025-40322) * kernel: svcrdma: use rc_pageoff for memcpy byte offset (CVE-2025-68811) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38403 CVE-2025-38415 CVE-2025-38730 CVE-2025-39933 CVE-2025-40133 CVE-2025-40304 CVE-2025-40322 CVE-2025-68811 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es): * .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127) * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26127 CVE-2026-26130 Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-34982 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross?Dashboard Privilege Escalation (CVE-2026-21721) * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61728 CVE-2025-61729 CVE-2025-68121 CVE-2026-21721 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (CVE-2023-53034) * kernel: Linux kernel erofs: Use-After-Free due to device type mismatch (CVE-2025-38172) * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064) * kernel: Bluetooth: ISO: Fix possible UAF on iso_conn_free (CVE-2025-40141) * kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service (CVE-2025-40269) * kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349) * kernel: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CVE-2026-22998) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2023-53034 CVE-2025-38172 CVE-2025-40064 CVE-2025-40141 CVE-2025-40269 CVE-2025-68349 CVE-2026-22998 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libvpx: Heap buffer overflow in libvpx (CVE-2026-2447) * firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785) * firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793) * firefox: Undefined behavior in the DOM: Core & HTML component (CVE-2026-2771) * firefox: Integer overflow in the Audio/Video component (CVE-2026-2774) * firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776) * firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781) * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766) * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769) * firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787) * firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768) * firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783) * firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784) * firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026-2759) * firefox: Integer overflow in the JavaScript: Standard Library component (CVE-2026-2762) * firefox: Sandbox escape in the Graphics: WebRender component (CVE-2026-2761) * firefox: Privilege escalation in the Messaging System component (CVE-2026-2777) * firefox: Same-origin policy bypass in the Networking: JAR component (CVE-2026-2790) * firefox: Mitigation bypass in the DOM: HTML Parser component (CVE-2026-2775) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2763) * firefox: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2792) * firefox: Incorrect boundary conditions in the Web Audio component (CVE-2026-2773) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2786) * firefox: Use-after-free in the Graphics: ImageLib component (CVE-2026-2789) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component (CVE-2026-2757) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-2760) * firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-2772) * firefox: Incorrect boundary conditions in the Networking: JAR component (CVE-2026-2779) * firefox: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-2767) * firefox: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (CVE-2026-2764) * firefox: Privilege escalation in the Netmonitor component (CVE-2026-2782) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2765) * firefox: Privilege escalation in the Netmonitor component (CVE-2026-2780) * firefox: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component (CVE-2026-2778) * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-2758) * firefox: Mitigation bypass in the Networking: Cache component (CVE-2026-2791) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-2770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-2447 CVE-2026-2757 CVE-2026-2758 CVE-2026-2759 CVE-2026-2760 CVE-2026-2761 CVE-2026-2762 CVE-2026-2763 CVE-2026-2764 CVE-2026-2765 CVE-2026-2766 CVE-2026-2767 CVE-2026-2768 CVE-2026-2769 CVE-2026-2770 CVE-2026-2771 CVE-2026-2772 CVE-2026-2773 CVE-2026-2774 CVE-2026-2775 CVE-2026-2776 CVE-2026-2777 CVE-2026-2778 CVE-2026-2779 CVE-2026-2780 CVE-2026-2781 CVE-2026-2782 CVE-2026-2783 CVE-2026-2784 CVE-2026-2785 CVE-2026-2786 CVE-2026-2787 CVE-2026-2788 CVE-2026-2789 CVE-2026-2790 CVE-2026-2791 CVE-2026-2792 CVE-2026-2793 FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279) * fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269) * fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-15269 CVE-2025-15275 CVE-2025-15279 The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Security Fix(es): * python: protobuf: Protobuf: Denial of Service due to recursion depth bypass (CVE-2026-0994) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-0994 The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Heap buffer overflow in libvpx (CVE-2026-2447) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-2447 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721) * firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698) * firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716) * firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684) * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705) * firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710) * firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690) * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708) * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691) * firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699) * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693) * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719) * firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694) * firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720) * firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707) * firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4684 CVE-2026-4685 CVE-2026-4686 CVE-2026-4687 CVE-2026-4688 CVE-2026-4689 CVE-2026-4690 CVE-2026-4691 CVE-2026-4692 CVE-2026-4693 CVE-2026-4694 CVE-2026-4695 CVE-2026-4696 CVE-2026-4697 CVE-2026-4698 CVE-2026-4699 CVE-2026-4700 CVE-2026-4701 CVE-2026-4702 CVE-2026-4704 CVE-2026-4705 CVE-2026-4706 CVE-2026-4707 CVE-2026-4708 CVE-2026-4709 CVE-2026-4710 CVE-2026-4711 CVE-2026-4712 CVE-2026-4713 CVE-2026-4714 CVE-2026-4715 CVE-2026-4716 CVE-2026-4717 CVE-2026-4718 CVE-2026-4719 CVE-2026-4720 CVE-2026-4721 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61729 CVE-2025-68121 nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-1642 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in IPv6 address deletion may lead to a denial of service (CVE-2026-23010) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-23010 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow (CVE-2025-14905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14905 The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files. Security Fix(es): * libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API (CVE-2026-22801) * libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read (CVE-2026-22695) * libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-22695 CVE-2026-22801 CVE-2026-25646 HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-68121 Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-33999 CVE-2026-34001 CVE-2026-34003 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22855) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22853) * freerdp: FreeRDP global-buffer-overflow (CVE-2026-22858) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22859) * freerdp: FreeRDP: Denial of Service via use after free in ecam_channel_write (CVE-2026-24678) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-22853 CVE-2026-22855 CVE-2026-22858 CVE-2026-22859 CVE-2026-24678 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865) * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366) * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367) * cpython: email header injection due to unquoted newlines (CVE-2026-1299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-15366 CVE-2025-15367 CVE-2026-0865 CVE-2026-1299 The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61729 CVE-2025-68121 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Kernel: Double free vulnerability in exFAT filesystem can lead to denial of service (CVE-2025-38206) * kernel: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (CVE-2025-40096) * kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168) * kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38206 CVE-2025-40096 CVE-2025-40168 CVE-2025-68800 The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. Security Fix(es): * grub2: Missing unregister call for gettext command may lead to use-after-free (CVE-2025-61662) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61662 MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods. Security Fix(es): * MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVE-2026-25506) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25506 The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities. Security Fix(es): * openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following (CVE-2026-23893) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-23893 This package provides build-stage rpm automation to simplify the creation of Go language (golang) packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only. Security Fix(es): * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function (CVE-2025-9820) * gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification (CVE-2025-14831) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9820 CVE-2025-14831 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-23490 The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61729 CVE-2025-68121 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61728 CVE-2025-61729 CVE-2025-68121 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772) * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754) * firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752) * firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757) * firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753) * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759) * firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747) * firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749) * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766) * firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761) * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771) * firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764) * firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765) * firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-6746 CVE-2026-6747 CVE-2026-6748 CVE-2026-6749 CVE-2026-6750 CVE-2026-6751 CVE-2026-6752 CVE-2026-6753 CVE-2026-6754 CVE-2026-6757 CVE-2026-6759 CVE-2026-6761 CVE-2026-6762 CVE-2026-6763 CVE-2026-6764 CVE-2026-6765 CVE-2026-6766 CVE-2026-6767 CVE-2026-6769 CVE-2026-6770 CVE-2026-6771 CVE-2026-6772 CVE-2026-6776 CVE-2026-6785 CVE-2026-6786 A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61728 CVE-2025-61729 CVE-2025-68121 yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61729 CVE-2025-68121 yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4519 The ncurses (new curses) library routines are a terminal-independent method of updating character screens with reasonable optimization. The ncurses packages contain support utilities including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo. Security Fix(es): * ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. (CVE-2025-69720) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-69720 yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fix(es): * squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526) * Squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-32748 CVE-2026-33526 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721) * firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698) * firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716) * firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684) * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705) * firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710) * firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690) * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708) * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691) * firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699) * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693) * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719) * firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694) * firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720) * firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707) * firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687) * thunderbird: Out of bounds read in IMAP parsing (CVE-2026-4371) * thunderbird: Spoofing issue in Thunderbird (CVE-2026-3889) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-3889 CVE-2026-4371 CVE-2026-4684 CVE-2026-4685 CVE-2026-4686 CVE-2026-4687 CVE-2026-4688 CVE-2026-4689 CVE-2026-4690 CVE-2026-4691 CVE-2026-4692 CVE-2026-4693 CVE-2026-4694 CVE-2026-4695 CVE-2026-4696 CVE-2026-4697 CVE-2026-4698 CVE-2026-4699 CVE-2026-4700 CVE-2026-4701 CVE-2026-4702 CVE-2026-4704 CVE-2026-4705 CVE-2026-4706 CVE-2026-4707 CVE-2026-4708 CVE-2026-4709 CVE-2026-4710 CVE-2026-4711 CVE-2026-4712 CVE-2026-4713 CVE-2026-4714 CVE-2026-4715 CVE-2026-4716 CVE-2026-4717 CVE-2026-4718 CVE-2026-4719 CVE-2026-4720 CVE-2026-4721 giflib is a library for reading and writing gif images. Security Fix(es): * giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-23868 Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 CVE-2026-27137 The golang packages provide the Go programming language compiler. Security Fix(es): * cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61731 CVE-2026-25679 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Arbitrary code execution via heap out-of-bounds write in RLE planar decode path (CVE-2026-26965) * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline (CVE-2026-26955) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26955 CVE-2026-26965 This package provides build-stage rpm automation to simplify the creation of Go language (golang) packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() (CVE-2026-23231) * kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential privilege escalation. (CVE-2025-71238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-71238 CVE-2026-23231 The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-10158 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4786 CVE-2026-6100 Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Security Fix(es): * capstone: Capstone: Memory corruption via unchecked vsnprintf return (CVE-2025-68114) * capstone: Capstone: Heap buffer overflow via skipdata callback allows denial of service or arbitrary code execution. (CVE-2025-67873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-67873 CVE-2025-68114 This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time. Security Fix(es): * perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003) * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2006-10002 CVE-2006-10003 The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance TLS connection handling (CVE-2026-34282) * JDK: Enhance key generation (CVE-2026-34268) Bug Fix(es): * When copying files, OpenJDK 21 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 21 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in this release. (AlmaLinux-169617, AlmaLinux-169951, AlmaLinux-169952, AlmaLinux-169942, AlmaLinux-169953, AlmaLinux-169945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-22007 CVE-2026-22013 CVE-2026-22016 CVE-2026-22018 CVE-2026-22021 CVE-2026-23865 CVE-2026-34268 CVE-2026-34282 FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-15270 The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service (CVE-2023-52356) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2023-52356 Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-1525 CVE-2026-1526 CVE-2026-1528 CVE-2026-2229 CVE-2026-21710 CVE-2026-25547 CVE-2026-26996 CVE-2026-27135 CVE-2026-27904 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772) * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754) * firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752) * firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757) * firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753) * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759) * firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747) * firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749) * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766) * firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761) * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771) * firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764) * firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765) * firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-6746 CVE-2026-6747 CVE-2026-6748 CVE-2026-6749 CVE-2026-6750 CVE-2026-6751 CVE-2026-6752 CVE-2026-6753 CVE-2026-6754 CVE-2026-6757 CVE-2026-6759 CVE-2026-6761 CVE-2026-6762 CVE-2026-6763 CVE-2026-6764 CVE-2026-6765 CVE-2026-6766 CVE-2026-6767 CVE-2026-6769 CVE-2026-6770 CVE-2026-6771 CVE-2026-6772 CVE-2026-6776 CVE-2026-6785 CVE-2026-6786 GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920) * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082) * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085) * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921) * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-2920 CVE-2026-2921 CVE-2026-2922 CVE-2026-2923 CVE-2026-3082 CVE-2026-3083 CVE-2026-3085 crun is a OCI runtime Security Fix(es): * crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-30892 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-1519 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852) * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732) * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676) * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491) * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948) * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684) * freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681) * freerdp: FreeRDP has a Heap-buffer-overflow in audio_formats_free (CVE-2026-24682) * freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683) * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679) * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675) * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages (CVE-2026-31806) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-22852 CVE-2026-22854 CVE-2026-22856 CVE-2026-23732 CVE-2026-23948 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676 CVE-2026-24679 CVE-2026-24681 CVE-2026-24682 CVE-2026-24683 CVE-2026-24684 CVE-2026-31806 OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables (CVE-2026-3497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-3497 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.116 and .NET Runtime 9.0.15.Security Fix(es): * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171) * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203) * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116) * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26171 CVE-2026-32178 CVE-2026-32203 CVE-2026-33116 The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing (CVE-2026-4424) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4424 nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files (CVE-2026-32647) * NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module (CVE-2026-27654) * NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file (CVE-2026-27784) * NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled (CVE-2026-27651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-27651 CVE-2026-27654 CVE-2026-27784 CVE-2026-32647 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984) * FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-33983 CVE-2026-33984 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.126 and .NET Runtime 8.0.26.Security Fix(es): * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171) * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203) * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116) * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26171 CVE-2026-32178 CVE-2026-32203 CVE-2026-33116 Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities. Security Fix(es): * libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4878 The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4775 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-31431 The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Buffer Over-read in Wireshark (CVE-2026-3203) * wireshark: Improperly Controlled Sequential Memory Allocation in Wireshark (CVE-2026-3201) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-3201 CVE-2026-3203 OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode (CVE-2026-35385) * OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option (CVE-2026-35414) * OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage (CVE-2026-35387) * OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions (CVE-2026-35388) * OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username (CVE-2026-35386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388 CVE-2026-35414 The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improved Arena allocations (CVE-2026-22008) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance TLS connection handling (CVE-2026-34282) * JDK: Enhance key generation (CVE-2026-34268) This release also updates a number of third-party libraries included in the JDK. The libraries themselves are affected by the following CVEs, but this is not a statement that the JDK itself is affected: * giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740) * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) Bug Fix(es): * When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 25 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in this release. (AlmaLinux-169939, AlmaLinux-169937) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-22007 CVE-2026-22008 CVE-2026-22013 CVE-2026-22016 CVE-2026-22018 CVE-2026-22021 CVE-2026-23865 CVE-2026-26740 CVE-2026-33416 CVE-2026-33636 CVE-2026-34268 CVE-2026-34282 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731) * firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-5731 CVE-2026-5732 CVE-2026-5734 CVE-2026-33416 CVE-2026-33636 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-39766 CVE-2025-68741 A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fix(es): * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58183 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958) * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-31958 CVE-2026-35536 DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon. Security Fix(es): * Kea: Kea: Denial of Service via maliciously crafted message (CVE-2026-3608) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-3608 Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-59032 CVE-2026-27857 CVE-2026-27858 A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61729 CVE-2025-68121 Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Critical Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4631 The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-33554 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel (net/mlx5): Use-after-free in ECVF vports unload leads to denial of service (CVE-2025-38109) * kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure (CVE-2026-23144) * kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution (CVE-2026-23171) * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193) * kernel: macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209) * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204) * kernel: ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38109 CVE-2026-23144 CVE-2026-23171 CVE-2026-23191 CVE-2026-23193 CVE-2026-23204 CVE-2026-23209 The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es): * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-29111 A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402) * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-23270 CVE-2026-31402 CVE-2026-31419 CVE-2026-31431 libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-27135 The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597) * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-30922 CVE-2026-32597 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731) * firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-5731 CVE-2026-5732 CVE-2026-5734 CVE-2026-33416 CVE-2026-33636 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-43284 OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-27622 GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14087 CVE-2025-14512 The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-35091 CVE-2026-35092 HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417) * vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421) * vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-28417 CVE-2026-28421 CVE-2026-33412 Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * nodejs: Nodejs denial of service (CVE-2026-21637) * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581) * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710) * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715) * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716) * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711) * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713) * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714) * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-1525 CVE-2026-1526 CVE-2026-1527 CVE-2026-1528 CVE-2026-2229 CVE-2026-2581 CVE-2026-21637 CVE-2026-21710 CVE-2026-21711 CVE-2026-21712 CVE-2026-21713 CVE-2026-21714 CVE-2026-21715 CVE-2026-21716 CVE-2026-21717 CVE-2026-25547 CVE-2026-26996 CVE-2026-27135 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect (CVE-2026-25997) * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952) * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986) * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775) * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885) * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884) * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883) * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985) * FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read (CVE-2026-33982) * FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution (CVE-2026-33987) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25952 CVE-2026-25997 CVE-2026-26986 CVE-2026-29775 CVE-2026-31883 CVE-2026-31884 CVE-2026-31885 CVE-2026-33982 CVE-2026-33985 CVE-2026-33987 The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files. Security Fix(es): * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-33636 Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679