AlmaLinux OS Errata System 0.0.1 5.10 2026-08-13T10:44:12 Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fix(es): * perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes (CVE-2024-56406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-56406 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38352 Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25749 Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim path traversal (CVE-2025-53906) * vim: Vim path traversial (CVE-2025-53905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-53905 CVE-2025-53906 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998) * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209) * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244) * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) * kernel: kernel: ipv6 frag escape () Bug Fix(es) and Enhancement(s): * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [almalinux-10.2.z] (JIRA:AlmaLinux-182537) * [ThinkPad Avon/Mario +AlmaLinux 10.2]The OS hang up with CapsLock fliker (JIRA:AlmaLinux-185110) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-10263 CVE-2026-43112 CVE-2026-45998 CVE-2026-46209 CVE-2026-46244 CVE-2026-46316 CVE-2026-53362 CVE-2026-53366 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603) * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402) * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607) * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128) * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300) * kernel: Read root-owned files as an unprivileged user (CVE-2026-46333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-56603 CVE-2025-39766 CVE-2025-68724 CVE-2025-68741 CVE-2026-23270 CVE-2026-23401 CVE-2026-31402 CVE-2026-31408 CVE-2026-31607 CVE-2026-43128 CVE-2026-43284 CVE-2026-46300 CVE-2026-46333 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * podman: podman missing TLS verification (CVE-2025-6032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6032 Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices. Security Fix(es): * qtsvg: Uncontrolled recursion in Qt SVG module (CVE-2025-10728) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-10728 The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality. Security Fix(es): * mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests (CVE-2024-10306) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-10306 The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Vulnerability in GnuTLS certtool template parsing (CVE-2025-32990) * gnutls: Vulnerability in GnuTLS SCT extension parsing (CVE-2025-32989) * gnutls: Vulnerability in GnuTLS otherName SAN export (CVE-2025-32988) * gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() (CVE-2025-6395) Bug Fix(es) and Enhancement(s): * gnutls: Vulnerability in GnuTLS certtool template parsing (BZ#2359620) * gnutls: Vulnerability in GnuTLS SCT extension parsing (BZ#2359621) * gnutls: Vulnerability in GnuTLS otherName SAN export (BZ#2359622) * gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite() (BZ#2376755) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6395 CVE-2025-32988 CVE-2025-32989 CVE-2025-32990 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028) * firefox: thunderbird: Memory safety bugs (CVE-2025-8035) * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031) * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027) * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030) * firefox: Memory safety bugs (CVE-2025-8034) * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033) * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032) * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8027 CVE-2025-8028 CVE-2025-8029 CVE-2025-8030 CVE-2025-8031 CVE-2025-8032 CVE-2025-8033 CVE-2025-8034 CVE-2025-8035 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.107 and .NET Runtime 9.0.6.Security Fix(es): * dotnet: .NET Remote Code Vulnerability (CVE-2025-30399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-30399 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client (CVE-2025-21605) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-21605 XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short. Security Fix(es): * xz: XZ has a heap-use-after-free bug in threaded .xz decoder (CVE-2025-31115) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-31115 The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * Ghostscript: NPDL device: Compression buffer overflow (CVE-2025-27832) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-27832 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.106 and .NET Runtime 9.0.5.Security Fix(es): * dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-26646 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.116 and .NET Runtime 8.0.16.Security Fix(es): * dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-26646 The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbounded name compression could lead to Denial of Service (CVE-2024-8508) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-8508 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Out-of-bounds access when resolving Promise objects (CVE-2025-4918) * firefox: Out-of-bounds access when optimizing linear sums (CVE-2025-4919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4918 CVE-2025-4919 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Denial of Service attack to websocket server (CVE-2025-32049) * libsoup: Denial of service in server when client requests a large amount of overlapping ranges with Range header (CVE-2025-32907) * libsoup: Cookie domain validation bypass via uppercase characters in libsoup (CVE-2025-4035) * libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4035 CVE-2025-4948 CVE-2025-32049 CVE-2025-32907 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * libvpx: Heap buffer overflow in libvpx (CVE-2026-2447) * firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785) * firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793) * firefox: Undefined behavior in the DOM: Core & HTML component (CVE-2026-2771) * firefox: Integer overflow in the Audio/Video component (CVE-2026-2774) * firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776) * firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781) * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766) * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769) * firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787) * firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768) * firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783) * firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784) * firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026-2759) * firefox: Integer overflow in the JavaScript: Standard Library component (CVE-2026-2762) * firefox: Sandbox escape in the Graphics: WebRender component (CVE-2026-2761) * firefox: Privilege escalation in the Messaging System component (CVE-2026-2777) * firefox: Same-origin policy bypass in the Networking: JAR component (CVE-2026-2790) * firefox: Mitigation bypass in the DOM: HTML Parser component (CVE-2026-2775) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2763) * firefox: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2792) * firefox: Incorrect boundary conditions in the Web Audio component (CVE-2026-2773) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2786) * firefox: Use-after-free in the Graphics: ImageLib component (CVE-2026-2789) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component (CVE-2026-2757) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-2760) * firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-2772) * firefox: Incorrect boundary conditions in the Networking: JAR component (CVE-2026-2779) * firefox: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-2767) * firefox: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (CVE-2026-2764) * firefox: Privilege escalation in the Netmonitor component (CVE-2026-2782) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2765) * firefox: Privilege escalation in the Netmonitor component (CVE-2026-2780) * firefox: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component (CVE-2026-2778) * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-2758) * firefox: Mitigation bypass in the Networking: Cache component (CVE-2026-2791) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-2770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-2447 CVE-2026-2757 CVE-2026-2758 CVE-2026-2759 CVE-2026-2760 CVE-2026-2761 CVE-2026-2762 CVE-2026-2763 CVE-2026-2764 CVE-2026-2765 CVE-2026-2766 CVE-2026-2767 CVE-2026-2768 CVE-2026-2769 CVE-2026-2770 CVE-2026-2771 CVE-2026-2772 CVE-2026-2773 CVE-2026-2774 CVE-2026-2775 CVE-2026-2776 CVE-2026-2777 CVE-2026-2778 CVE-2026-2779 CVE-2026-2780 CVE-2026-2781 CVE-2026-2782 CVE-2026-2783 CVE-2026-2784 CVE-2026-2785 CVE-2026-2786 CVE-2026-2787 CVE-2026-2788 CVE-2026-2789 CVE-2026-2790 CVE-2026-2791 CVE-2026-2792 CVE-2026-2793 Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion (CVE-2025-25186) * CGI: Denial of Service in CGI::Cookie.parse (CVE-2025-27219) * uri: userinfo leakage in URI#join, URI#merge and URI#+ (CVE-2025-27221) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-25186 CVE-2025-27219 CVE-2025-27221 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909) * thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875) * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-3877) * thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-3875 CVE-2025-3877 CVE-2025-3909 CVE-2025-3932 GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-3887 Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: request smuggling attacks (CVE-2025-47905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-47905 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.117 and .NET Runtime 8.0.17.Security Fix(es): * dotnet: .NET Remote Code Vulnerability (CVE-2025-30399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-30399 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-5986) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5986 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: RDMA/mlx5: Fix page_size variable overflow (CVE-2025-22091) * kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121) * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797) * kernel: powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap (CVE-2025-38088) * kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVE-2025-38110) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22091 CVE-2025-22121 CVE-2025-37797 CVE-2025-38088 CVE-2025-38110 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fix(es): * open-vm-tools:A malicious actor with non-administrative privileges on a guest virtual machine (VM) may tamper with the local files to trigger insecure file operations within that VM. (CVE-2025-22247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22247 SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. Security Fix(es): * SQLite: integer overflow in SQLite (CVE-2025-3277) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-3277 Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-23166 libblockdev is a C library supporting GObject introspection for manipulation of block devices. It has a plugin-based architecture where each technology (like LVM, Btrfs, MD RAID, Swap,...) is implemented in a separate plugin, possibly with multiple implementations (e.g. using LVM CLI or the new LVM DBus API). Security Fix(es): * libblockdev: Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. (CVE-2025-6019) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6019 The golang packages provide the Go programming language compiler. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Out-of-bounds access when resolving Promise objects (CVE-2025-4918) * firefox: thunderbird: Out-of-bounds access when optimizing linear sums (CVE-2025-4919) * firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267) * firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264) * firefox: thunderbird: Memory safety bugs (CVE-2025-5268) * firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266) * firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263) * firefox: thunderbird: Memory safety bug (CVE-2025-5269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4918 CVE-2025-4919 CVE-2025-5263 CVE-2025-5264 CVE-2025-5266 CVE-2025-5267 CVE-2025-5268 CVE-2025-5269 The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Double free in glibc (CVE-2025-8058) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8058 The golang packages provide the Go programming language compiler. Security Fix(es): * net/[http:](http:) Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4673 Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ice: Fix deinitializing VF in error path (CVE-2025-21883) * kernel: eth: bnxt: fix truesize for mb-xdp-pass case (CVE-2025-21961) * kernel: ibmvnic: Use kernel helpers for hex dumps (CVE-2025-22104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-21883 CVE-2025-21961 CVE-2025-22104 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-68285 GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment. Security Fix(es): * gnome-remote-desktop: Uncontrolled Resource Consumption due to Malformed RDP PDUs (CVE-2025-5024) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5024 The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. Security Fix(es): * udisks: Missing Authorization Check Allows Unprivileged Users to Back Up LUKS Headers via udisks D-Bus API (CVE-2026-26104) * udisks: Missing Authorization Check Allows Unprivileged Users to Restore LUKS Headers via udisks D-Bus API (CVE-2026-26103) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26103 CVE-2026-26104 The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. Security Fix(es): * grub2: grub-core/gettext: Integer overflow leads to Heap OOB Write and Read. (CVE-2024-45776) * grub2: fs/ufs: OOB write in the heap (CVE-2024-45781) * grub2: command/gpg: Use-after-free due to hooks not being removed on module unload (CVE-2025-0622) * grub2: UFS: Integer overflow may lead to heap based out-of-bounds write when handling symlinks (CVE-2025-0677) * grub2: commands/dump: The dump command is not in lockdown when secure boot is enabled (CVE-2025-1118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-45776 CVE-2024-45781 CVE-2025-0622 CVE-2025-0677 CVE-2025-1118 The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794) * libxml: Null pointer dereference leads to Denial of service (DoS) (CVE-2025-49795) * libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796) * libxml2: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2 (CVE-2025-6021) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6021 CVE-2025-49794 CVE-2025-49795 CVE-2025-49796 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: padata: fix UAF in padata_reorder (CVE-2025-21727) * kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928) * kernel: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CVE-2025-21929) * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020) * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113) * kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085) * kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890) * kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052) * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086) * kernel: net/sched: fix use-after-free in taprio_dev_notifier (CVE-2025-38087) * kernel: nvme-tcp: sanitize request list handling (CVE-2025-38264) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-21727 CVE-2025-21928 CVE-2025-21929 CVE-2025-22020 CVE-2025-22085 CVE-2025-22113 CVE-2025-37890 CVE-2025-38052 CVE-2025-38086 CVE-2025-38087 CVE-2025-38264 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component (CVE-2025-10527) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2025-10532) * firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component (CVE-2025-10528) * firefox: thunderbird: Same-origin policy bypass in the Layout component (CVE-2025-10529) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 (CVE-2025-10537) * firefox: thunderbird: Information disclosure in the Networking: Cache component (CVE-2025-10536) * firefox: thunderbird: Integer overflow in the SVG component (CVE-2025-10533) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-10527 CVE-2025-10528 CVE-2025-10529 CVE-2025-10532 CVE-2025-10533 CVE-2025-10536 CVE-2025-10537 The libxml2 library is a development toolbox providing the implementation of various XML standards. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): The libxml2 library is a development toolbox providing the implementation of various XML standards. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: Out-of-Bounds Read in libxml2 (CVE-2025-32414) The libxml2 library is a development toolbox providing the implementation of various XML standards. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): The libxml2 library is a development toolbox providing the implementation of various XML standards. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: Out-of-Bounds Read in libxml2 (CVE-2025-32414) * libxml2: Out-of-bounds Read in xmlSchemaIDCFillNodeTables (CVE-2025-32415) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-32414 CVE-2025-32415 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759) * kernel: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CVE-2025-21991) * kernel: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (CVE-2025-37799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-21759 CVE-2025-21991 CVE-2025-37799 Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers. Security Fix(es): * avahi: Avahi Wide-Area DNS Uses Constant Source Port (CVE-2024-52615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-52615 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component (CVE-2025-10527) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2025-10532) * firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component (CVE-2025-10528) * firefox: thunderbird: Same-origin policy bypass in the Layout component (CVE-2025-10529) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 (CVE-2025-10537) * firefox: thunderbird: Information disclosure in the Networking: Cache component (CVE-2025-10536) * firefox: thunderbird: Integer overflow in the SVG component (CVE-2025-10533) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-10527 CVE-2025-10528 CVE-2025-10529 CVE-2025-10532 CVE-2025-10533 CVE-2025-10536 CVE-2025-10537 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * requests: Requests vulnerable to .netrc credentials leak via malicious URLs (CVE-2024-47081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-47081 A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding. Security Fix(es): * golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22869 The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Vector register overwrite bug in glibc (CVE-2025-5702) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5702 The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: Buffer Overflow vulnerability in libarchive (CVE-2025-25724) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-25724 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: exfat: fix random stack corruption after get_block (CVE-2025-22036) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22036 Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode (CVE-2025-49177) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-49175 CVE-2025-49176 CVE-2025-49177 CVE-2025-49178 CVE-2025-49179 CVE-2025-49180 The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts. Security Fix(es): * cloud-init: Cloud init permissions flaw (CVE-2024-6174) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-6174 Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988) * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125) * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976) * tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989) * tomcat: Apache Tomcat denial of service (CVE-2025-52520) * tomcat: Apache Tomcat denial of service (CVE-2025-52434) * tomcat: Apache Tomcat denial of service (CVE-2025-53506) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-48976 CVE-2025-48988 CVE-2025-48989 CVE-2025-49125 CVE-2025-52434 CVE-2025-52520 CVE-2025-53506 Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI. Security Fix(es): * nvidia-container-toolkit: Privilege Escalation via Hook Initialization in NVIDIA Container Toolkit (CVE-2025-23266) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-23266 Exiv2 is a C++ library to access image metadata, supporting read and write access to the Exif, IPTC and XMP metadata, Exif MakerNote support, extract and delete methods for Exif thumbnails, classes to access Ifd, and support for various image formats. Security Fix(es): * exiv2: Use After Free in Exiv2 (CVE-2025-26623) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-26623 The Qt 6 Quick3D library. Security Fix(es): * assimp: Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflow (CVE-2025-11277) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11277 The OpenJDK 21 runtime environment. Security Fix(es): * openjdk: Enhance Buffered Image handling (Oracle CPU 2025-04) (CVE-2025-30698) * openjdk: Improve compiler transformations (Oracle CPU 2025-04) (CVE-2025-30691) * openjdk: Better TLS connection support (Oracle CPU 2025-04) (CVE-2025-21587) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-21587 CVE-2025-30691 CVE-2025-30698 OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fix(es): * openjpeg: OpenJPEG OOB heap memory write (CVE-2025-54874) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-54874 Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-24813 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881) * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-52881 CVE-2025-58183 Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316) * tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677) * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-52316 CVE-2024-54677 CVE-2025-24813 Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337) * tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-56337 CVE-2025-31650 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-30204 FastCGI Perl bindings. Security Fix(es): * perl-fcgi: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library (CVE-2025-40907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-40907 Expat is a C library for parsing XML documents. Security Fix(es): * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-8176 Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection. Security Fix(es): * git: The sideband payload is passed unfiltered to the terminal in git (CVE-2024-52005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-52005 Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines. Security Fix(es): * libtpms: Libtpms Out-of-Bounds Read Vulnerability (CVE-2025-49133) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-49133 This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. Security Fix(es): * JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-40928 The iputils packages contain basic utilities for monitoring a network, including ping. Security Fix(es): * iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (CVE-2025-47268) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-47268 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Privilege escalation in Firefox Updater (CVE-2025-2817) * firefox: thunderbird: Unsafe attribute access during XPath parsing (CVE-2025-4087) * firefox: thunderbird: Process isolation bypass using "javascript:" URI links in cross-origin frames (CVE-2025-4083) * firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 (CVE-2025-4091) * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10 (CVE-2025-4093) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-2817 CVE-2025-4083 CVE-2025-4087 CVE-2025-4091 CVE-2025-4093 The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c (CVE-2025-5914) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5914 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: User Interface (UI) Misrepresentation of attachment URL (CVE-2025-3523) * thunderbird: Information Disclosure of /tmp directory listing (CVE-2025-2830) * thunderbird: Leak of hashed Window credentials via crafted attachment URL (CVE-2025-3522) * firefox: thunderbird: Privilege escalation in Firefox Updater (CVE-2025-2817) * firefox: thunderbird: Unsafe attribute access during XPath parsing (CVE-2025-4087) * firefox: thunderbird: Process isolation bypass using "javascript:" URI links in cross-origin frames (CVE-2025-4083) * firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 (CVE-2025-4091) * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10 (CVE-2025-4093) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-2817 CVE-2025-2830 CVE-2025-3522 CVE-2025-3523 CVE-2025-4083 CVE-2025-4087 CVE-2025-4091 CVE-2025-4093 The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: LPE via host option (CVE-2025-32462) * sudo: LPE via chroot option (CVE-2025-32463) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-32462 CVE-2025-32463 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * gnome-remote-desktop: freerdp: Unauthenticated RDP Packet Causes Segfault in FreeRDP Leading to Denial of Service (CVE-2025-4478) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4478 Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection. Security Fix(es): * git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349) * git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006) * git: Git arbitrary code execution (CVE-2025-48384) * git: Git arbitrary file writes (CVE-2025-48385) * gitk: Git file creation flaw (CVE-2025-27613) * gitk: git script execution flaw (CVE-2025-27614) * git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-50349 CVE-2024-52006 CVE-2025-27613 CVE-2025-27614 CVE-2025-46835 CVE-2025-48384 CVE-2025-48385 The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-31492 DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon. Security Fix(es): * kea: Loading a malicious hook library can lead to local privilege escalation (CVE-2025-32801) * kea: Insecure handling of file paths allows multiple local attacks (CVE-2025-32802) * kea: Insecure file permissions can result in confidential information leakage (CVE-2025-32803) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-32801 CVE-2025-32802 CVE-2025-32803 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * podman: Podman kube play command may overwrite host files (CVE-2025-9566) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9566 A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling. Security Fix(es): * qt5: qt6: QtCore Assertion Failure Denial of Service (CVE-2025-5455) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5455 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-27144 HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. Security Fix(es): * libxslt: Use-After-Free in libxslt numbers.c (CVE-2025-24855) * libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) (CVE-2024-55549) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-55549 CVE-2025-24855 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Double-free in libvpx encoder (CVE-2025-5283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5283 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * jinja2: Jinja sandbox breakout through attr filter selecting format method (CVE-2025-27516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-27516 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-47287 Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * net/[http:](http:) Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22871 The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-27144 yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * yggdrasil: Local privilege escalation in yggdrasil (CVE-2025-3931) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-45336 CVE-2025-3931 GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: Integer overflow in in g_escape_uri_string() (CVE-2025-13601) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-13601 SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. Security Fix(es): * sqlite: Integer Truncation in SQLite (CVE-2025-6965) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6965 The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Uncontrolled Recursion in Wireshark (CVE-2025-1492) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-1492 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144) * golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22869 CVE-2025-27144 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: Redis Stack Buffer Overflow (CVE-2025-27151) * redis: Redis Unauthenticated Denial of Service (CVE-2025-48367) * redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-27151 CVE-2025-32023 CVE-2025-48367 The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module (CVE-2025-49630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-49630 The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound Cache poisoning (CVE-2025-5994) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5994 The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-30472 PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217) * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736) * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734) * php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219) * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861) * php: Reference counting in php_request_shutdown causes Use-After-Free (CVE-2024-11235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-11235 CVE-2025-1217 CVE-2025-1219 CVE-2025-1734 CVE-2025-1736 CVE-2025-1861 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028) * firefox: thunderbird: Memory safety bugs (CVE-2025-8035) * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031) * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027) * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030) * firefox: Memory safety bugs (CVE-2025-8034) * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033) * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032) * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8027 CVE-2025-8028 CVE-2025-8029 CVE-2025-8030 CVE-2025-8031 CVE-2025-8032 CVE-2025-8033 CVE-2025-8034 CVE-2025-8035 The libblockdev packages provide a C library with GObject introspection support used for low-level operations on block devices. The library serves as a thin wrapper around plug-ins for specific functionality, such as LVM, Btrfs, LUKS, or MD RAID. Security Fix(es): * libblockdev: LPE from allow_active to root in libblockdev via udisks (CVE-2025-6019) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6019 The International Components for Unicode (ICU) library provides robust and full-featured Unicode services. Security Fix(es): * icu: Stack buffer overflow in the SRBRoot::addTag function (CVE-2025-5222) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5222 Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (CVE-2024-45341) * golang: net/[http:](http:) net/[http:](http:) sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336) * crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-45336 CVE-2024-45341 CVE-2025-22866 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435) * cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718) * cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330) * python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517) * cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-12718 CVE-2025-4138 CVE-2025-4330 CVE-2025-4435 CVE-2025-4517 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182) * thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179) * thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180) * thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9179 CVE-2025-9180 CVE-2025-9181 CVE-2025-9182 CVE-2025-9185 The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: heap buffer over-read in header_gnu_longlink (CVE-2024-57970) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-57970 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net_sched: ets: Fix double list add in class with netem as child qdisc (CVE-2025-37914) * kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200) * kernel: ice: fix eswitch code memory leak in reset scenario (CVE-2025-38417) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-37914 CVE-2025-38200 CVE-2025-38417 Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC). Security Fix(es): * krb5: Kerberos RC4-HMAC-MD5 Checksum Vulnerability Enabling Message Spoofing via MD5 Collisions (CVE-2025-3576) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-3576 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267) * firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264) * firefox: thunderbird: Memory safety bugs (CVE-2025-5268) * firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266) * firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263) * firefox: thunderbird: Memory safety bug (CVE-2025-5269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5263 CVE-2025-5264 CVE-2025-5266 CVE-2025-5267 CVE-2025-5268 CVE-2025-5269 CVE-2025-5283 AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4404 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: uvcvideo: Remove dangling pointers (CVE-2024-58002) * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980) * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905) * kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958) * kernel: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (CVE-2025-38089) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-57980 CVE-2024-58002 CVE-2025-21905 CVE-2025-37958 CVE-2025-38089 The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Better Glyph drawing (CVE-2025-30749) * JDK: Enhance TLS protocol support (CVE-2025-30754) * JDK: Improve HTTP client header handling (CVE-2025-50059) * JDK: Better Glyph drawing redux (CVE-2025-50106) Bug Fix(es): * In AlmaLinuxand AlmaLinux systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (AlmaLinux-102683, AlmaLinux-102684, AlmaLinux-102685) * On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In the G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code assumes that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling can lead to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the G1AllocRegion being used changes mid-operation. This update resolves this issue by always using the same NUMA node and associated G1AllocRegion object throughout an operation. (AlmaLinux-90307, AlmaLinux-90308, AlmaLinux-90311) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-30749 CVE-2025-30754 CVE-2025-50059 CVE-2025-50106 Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-31498 The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: insufficient escaping of user-supplied data in mod_ssl (CVE-2024-47252) * httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption (CVE-2025-23048) * httpd: HTTP Session Hijack via a TLS upgrade (CVE-2025-49812) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-47252 CVE-2025-23048 CVE-2025-49812 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784) * libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906) * libsoup: Denial of service on libsoup through HTTP/2 server (CVE-2025-32908) * libsoup: NULL pointer dereference in client when server omits the "nonce" parameter in an Unauthorized response with Digest authentication (CVE-2025-32912) * libsoup: OOB Read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process (CVE-2025-32914) * libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server (CVE-2025-46421) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-2784 CVE-2025-32906 CVE-2025-32908 CVE-2025-32912 CVE-2025-32914 CVE-2025-46421 The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of arbitrary JavaBeans. Security Fix(es): * commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (CVE-2025-48734) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-48734 Advanced Intrusion Detection Environment (AIDE) is a utility that creates a database of files on the system, and then uses that database to ensure file integrity and detect system intrusions. Security Fix(es): * aide: improper output neutralization enables bypassing (CVE-2025-54389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-54389 The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS (CVE-2025-58364) * cups: Authentication Bypass in CUPS Authorization Handling (CVE-2025-58060) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58060 CVE-2025-58364 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396) * kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527) * kernel: cifs: Fix the smbd_response slab to allow usercopy (CVE-2025-38523) * kernel: tls: fix handling of zero-length records on the rx_list (CVE-2025-39682) * kernel: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698) * kernel: s390/sclp: Fix SCCB present check (CVE-2025-39694) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38396 CVE-2025-38523 CVE-2025-38527 CVE-2025-39682 CVE-2025-39694 CVE-2025-39698 PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL executes arbitrary code in restore operation (CVE-2025-8715) * postgresql: PostgreSQL code execution in restore operation (CVE-2025-8714) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8714 CVE-2025-8715 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (CVE-2025-21867) * kernel: net: fix udp gso skb_segment after pull from frag_list (CVE-2025-38124) * kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CVE-2025-38250) * kernel: i2c/designware: Fix an initialization issue (CVE-2025-38380) * kernel: tls: always refresh the queue when reading sock (CVE-2025-38471) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-21867 CVE-2025-38124 CVE-2025-38250 CVE-2025-38380 CVE-2025-38471 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182) * thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179) * thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180) * thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9179 CVE-2025-9180 CVE-2025-9181 CVE-2025-9182 CVE-2025-9185 The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. Security Fix(es): * udisks: Out-of-bounds read in UDisks Daemon (CVE-2025-8067) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8067 MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * openssl: Timing side-channel in ECDSA signature computation (CVE-2024-13176) * mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688) * mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699) * mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683) * mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715) * mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585) * mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21588) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687) * mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580) * mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696) * mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705) * mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575) * mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685) * mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693) * mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684) * curl: libcurl: WebSocket endless loop (CVE-2025-5399) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092) * mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077) * mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085) * mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082) * mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087) * mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084) * mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) (CVE-2025-50100) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50094) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50098) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50096) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50102) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-13176 CVE-2025-5399 CVE-2025-21574 CVE-2025-21575 CVE-2025-21577 CVE-2025-21579 CVE-2025-21580 CVE-2025-21581 CVE-2025-21584 CVE-2025-21585 CVE-2025-21588 CVE-2025-30681 CVE-2025-30682 CVE-2025-30683 CVE-2025-30684 CVE-2025-30685 CVE-2025-30687 CVE-2025-30688 CVE-2025-30689 CVE-2025-30693 CVE-2025-30695 CVE-2025-30696 CVE-2025-30699 CVE-2025-30703 CVE-2025-30704 CVE-2025-30705 CVE-2025-30715 CVE-2025-30721 CVE-2025-30722 CVE-2025-50077 CVE-2025-50078 CVE-2025-50079 CVE-2025-50080 CVE-2025-50081 CVE-2025-50082 CVE-2025-50083 CVE-2025-50084 CVE-2025-50085 CVE-2025-50086 CVE-2025-50087 CVE-2025-50088 CVE-2025-50091 CVE-2025-50092 CVE-2025-50093 CVE-2025-50094 CVE-2025-50096 CVE-2025-50097 CVE-2025-50098 CVE-2025-50099 CVE-2025-50100 CVE-2025-50101 CVE-2025-50102 CVE-2025-50104 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097) * kernel: udmabuf: fix a buf size overflow issue during udmabuf creation (CVE-2025-37803) * kernel: net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350) * kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22097 CVE-2025-37803 CVE-2025-38350 CVE-2025-38449 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-47273 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ublk: make sure ubq->canceling is set when queue is frozen (CVE-2025-22068) * kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332) * kernel: idpf: convert control queue mutex to a spinlock (CVE-2025-38392) * kernel: tcp: Correct signedness in skb remaining space calculation (CVE-2025-38463) * kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498) * kernel: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500) * kernel: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CVE-2025-38550) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22068 CVE-2025-38332 CVE-2025-38392 CVE-2025-38463 CVE-2025-38498 CVE-2025-38500 CVE-2025-38550 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts (CVE-2025-67733) * valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-67733 CVE-2026-21863 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: usb: dwc3: gadget: check that event count does not exceed event buffer length (CVE-2025-37810) * kernel: sunrpc: fix handling of server side tls alerts (CVE-2025-38566) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-37810 CVE-2025-38566 The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fix(es): * open-vm-tools: Local privilege escalation in open-vm-tools (CVE-2025-41244) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-41244 The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: Libtiff Write-What-Where (CVE-2025-9900) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9900 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8194 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026) * kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22026 CVE-2025-38718 The zziplib is a lightweight library to easily extract data from zip files. Security Fix(es): * zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2018-17828 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udp: Fix memory accounting leak. (CVE-2025-22058) * kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823) * kernel: ext4: only dirty folios when data journaling regular files (CVE-2025-38220) * kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211) * kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464) * kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461) * kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22058 CVE-2025-37823 CVE-2025-38211 CVE-2025-38220 CVE-2025-38461 CVE-2025-38464 CVE-2025-38472 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Content-Disposition header ignored when a file is included in an embed or object tag (CVE-2025-6430) * firefox: Use-after-free in FontFaceSet (CVE-2025-6424) * firefox: Incorrect parsing of URLs could have allowed embedding of youtube.com (CVE-2025-6429) * firefox: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID (CVE-2025-6425) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6424 CVE-2025-6425 CVE-2025-6429 CVE-2025-6430 The golang packages provide the Go programming language compiler. Security Fix(es): * cmd/go: Go VCS Command Execution Vulnerability (CVE-2025-4674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4674 Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * net/[http:](http:) Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4673 libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: out-of-bounds read in sftp_handle() (CVE-2025-5318) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5318 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11021 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556) * kernel: wifi: ath12k: Decrement TID on RX peer frag setup error handling (CVE-2025-39761) * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38556 CVE-2025-39757 CVE-2025-39761 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (CVE-2025-38351) * kernel: sunrpc: fix client side handling of tls alerts (CVE-2025-38571) * kernel: eventpoll: Fix semi-unbounded recursion (CVE-2025-38614) * kernel: ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572) * kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817) * kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38351 CVE-2025-38571 CVE-2025-38572 CVE-2025-38614 CVE-2025-39817 CVE-2025-39841 OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-28390 Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229) * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230) * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-62229 CVE-2025-62230 CVE-2025-62231 The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fix(es): * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise (CVE-2024-56433) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Low Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-56433 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817) * Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818) * Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819) * Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 CVE-2025-49844 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * thunderbird: firefox: Memory safety bugs (CVE-2025-11714) * thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures (CVE-2025-11709) * thunderbird: firefox: Cross-process information leaked due to malicious IPC messages (CVE-2025-11710) * thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708) * thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type (CVE-2025-11712) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVE-2025-11715) * thunderbird: firefox: Some non-writable Object properties could be modified (CVE-2025-11711) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11708 CVE-2025-11709 CVE-2025-11710 CVE-2025-11711 CVE-2025-11712 CVE-2025-11714 CVE-2025-11715 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es): * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315) * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-55247 CVE-2025-55248 CVE-2025-55315 Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fix(es): * squid-cache: Squid vulnerable to information disclosure via authentication credential leakage in error handling (CVE-2025-62168) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-62168 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466) (CVE-2024-53241) * kernel: exfat: fix out-of-bounds access of directory entries (CVE-2024-53147) * kernel: zram: fix NULL pointer in comp_algorithm_show() (CVE-2024-53222) * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216) * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662) * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675) * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY (CVE-2024-56690) * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332) * kernel: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK (CVE-2024-57901) * kernel: af_packet: fix vlan_get_tci() vs MSG_PEEK (CVE-2024-57902) * kernel: io_uring/sqpoll: zero sqd->thread on tctx errors (CVE-2025-21633) * kernel: ipvlan: Fix use-after-free in ipvlan_get_iflink(). (CVE-2025-21652) * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647) * kernel: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (CVE-2025-21655) * kernel: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled (CVE-2024-57941) * kernel: netfs: Fix ceph copy to cache on write-begin (CVE-2024-57942) * kernel: zram: fix potential UAF of zram table (CVE-2025-21671) * kernel: pktgen: Avoid out-of-bounds access in get_imix_entries (CVE-2025-21680) * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693) * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691) * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696) * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702) * kernel: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (CVE-2025-21732) * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795) * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456) * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987) * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014) * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988) * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570) * kernel: media: intel/ipu6: remove cpu latency qos request on error (CVE-2024-58004) * kernel: usbnet: ipheth: use static NDP16 location in URB (CVE-2025-21742) * kernel: usbnet: ipheth: fix possible overflow in DPE length check (CVE-2025-21743) * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989) * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015) * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995) * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796) * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786) * kernel: tpm: Change to kvalloc() in eventlog/acpi.c (CVE-2024-58005) * kernel: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (CVE-2024-58013) * kernel: ring-buffer: Validate the persistent meta data subbuf array (CVE-2025-21777) * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738) * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections (CVE-2024-57986) * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726) * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791) * kernel: HID: multitouch: Add NULL check in mt_input_configured (CVE-2024-58020) * kernel: i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition (CVE-2024-57984) * kernel: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() (CVE-2025-21761) * kernel: sched_ext: Fix incorrect autogroup migration detection (CVE-2025-21771) * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981) * kernel: memcg: fix soft lockup in the OOM process (CVE-2024-57977) * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790) * kernel: usbnet: ipheth: fix DPE OoB read (CVE-2025-21741) * kernel: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CVE-2025-21785) * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765) * kernel: PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() (CVE-2024-58006) * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012) * kernel: wifi: brcmfmac: Check the return value of of_property_read_string_index() (CVE-2025-21750) * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072) * kernel: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CVE-2024-58069) * kernel: wifi: mac80211: prohibit deactivating all links (CVE-2024-58061) * kernel: idpf: convert workqueues to unbound (CVE-2024-58057) * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828) * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826) * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077) * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075) * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837) * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350) * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357) * kernel: net/sched: cls_api: fix error handling causing NULL dereference (CVE-2025-21857) * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851) * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855) * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844) * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853) * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847) * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864) * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088) * kernel: acct: perform last write from workqueue (CVE-2025-21846) * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() (CVE-2025-21861) * kernel: io_uring: prevent opcode speculation (CVE-2025-21863) * kernel: fbdev: hyperv_fb: Allow graceful removal of framebuffer (CVE-2025-21976) * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056) * kernel: net: ppp: Add bound checking for skb data on ppp_sync_txmung (CVE-2025-37749) * microcode_ctl: From CVEorg collector (CVE-2024-28956) * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994) * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116) * kernel: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks (CVE-2025-38412) * kernel: dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using (CVE-2025-38369) * kernel: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (CVE-2025-38468) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-28956 CVE-2024-36350 CVE-2024-36357 CVE-2024-49570 CVE-2024-52332 CVE-2024-53147 CVE-2024-53216 CVE-2024-53222 CVE-2024-53241 CVE-2024-54456 CVE-2024-56662 CVE-2024-56675 CVE-2024-56690 CVE-2024-57901 CVE-2024-57902 CVE-2024-57941 CVE-2024-57942 CVE-2024-57977 CVE-2024-57981 CVE-2024-57984 CVE-2024-57986 CVE-2024-57987 CVE-2024-57988 CVE-2024-57989 CVE-2024-57995 CVE-2024-58004 CVE-2024-58005 CVE-2024-58006 CVE-2024-58012 CVE-2024-58013 CVE-2024-58014 CVE-2024-58015 CVE-2024-58020 CVE-2024-58057 CVE-2024-58061 CVE-2024-58069 CVE-2024-58072 CVE-2024-58075 CVE-2024-58077 CVE-2024-58088 CVE-2025-21633 CVE-2025-21647 CVE-2025-21652 CVE-2025-21655 CVE-2025-21671 CVE-2025-21680 CVE-2025-21691 CVE-2025-21693 CVE-2025-21696 CVE-2025-21702 CVE-2025-21726 CVE-2025-21732 CVE-2025-21738 CVE-2025-21741 CVE-2025-21742 CVE-2025-21743 CVE-2025-21750 CVE-2025-21761 CVE-2025-21765 CVE-2025-21771 CVE-2025-21777 CVE-2025-21785 CVE-2025-21786 CVE-2025-21790 CVE-2025-21791 CVE-2025-21795 CVE-2025-21796 CVE-2025-21826 CVE-2025-21828 CVE-2025-21837 CVE-2025-21844 CVE-2025-21846 CVE-2025-21847 CVE-2025-21851 CVE-2025-21853 CVE-2025-21855 CVE-2025-21857 CVE-2025-21861 CVE-2025-21863 CVE-2025-21864 CVE-2025-21976 CVE-2025-22056 CVE-2025-37749 CVE-2025-37994 CVE-2025-38116 CVE-2025-38369 CVE-2025-38412 CVE-2025-38468 DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon. Security Fix(es): * kea: Invalid characters cause assert (CVE-2025-11232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11232 The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance Path Factories (CVE-2025-53066) * JDK: Enhance Certificate Handling (CVE-2025-53057) * JDK: Enhance String Handling (CVE-2025-61748) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-53057 CVE-2025-53066 CVE-2025-61748 libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: out-of-bounds read in sftp_handle() (CVE-2025-5318) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5318 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: firefox: Memory safety bugs (CVE-2025-11714) * thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures (CVE-2025-11709) * thunderbird: firefox: Cross-process information leaked due to malicious IPC messages (CVE-2025-11710) * thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708) * thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type (CVE-2025-11712) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVE-2025-11715) * thunderbird: firefox: Some non-writable Object properties could be modified (CVE-2025-11711) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11708 CVE-2025-11709 CVE-2025-11710 CVE-2025-11711 CVE-2025-11712 CVE-2025-11714 CVE-2025-11715 The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830) * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770) * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771) * rack: Rack memory exhaustion denial of service (CVE-2025-61772) * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion (CVE-2025-61919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-59830 CVE-2025-61770 CVE-2025-61771 CVE-2025-61772 CVE-2025-61919 The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: Libtiff Write-What-Where (CVE-2025-9900) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9900 Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim path traversal (CVE-2025-53906) * vim: Vim path traversial (CVE-2025-53905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-53905 CVE-2025-53906 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730) * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-39730 CVE-2025-39955 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es): * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315) * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-55247 CVE-2025-55248 CVE-2025-55315 Expat is a C library for parsing XML documents. Security Fix(es): * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-59375 AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-7493 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945) * libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-4945 CVE-2025-11021 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778) * bind: Cache poisoning due to weak PRNG (CVE-2025-40780) * bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8677 CVE-2025-40778 CVE-2025-40780 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: cifs: Fix oops due to uninitialised variable (CVE-2025-38737) * kernel: can: j1939: implement NETDEV_UNREGISTER notification handler (CVE-2025-39925) * kernel: Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CVE-2025-39982) * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981) * kernel: net/mlx5: fs, fix UAF in flow counter release (CVE-2025-39979) * kernel: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CVE-2025-39983) * kernel: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (CVE-2025-40047) * kernel: iommu/vt-d: Disallow dirty tracking if incoherent page walk (CVE-2025-40058) * kernel: ice: ice_adapter: release xa entry on adapter allocation failure (CVE-2025-40185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38737 CVE-2025-39925 CVE-2025-39979 CVE-2025-39981 CVE-2025-39982 CVE-2025-39983 CVE-2025-40047 CVE-2025-40058 CVE-2025-40185 Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fix(es): * linux-pam: Linux-pam directory Traversal (CVE-2025-6020) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6020 OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9230 The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities. Security Fix(es): * binutils: GNU Binutils ld elflink.c elf_gc_sweep memory corruption (CVE-2025-5244) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5244 The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fix(es): * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11230 OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH SSHD Agent Forwarding and X11 Forwarding (CVE-2025-32728) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-32728 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-27877 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ublk: make sure ubq->canceling is set when queue is frozen (CVE-2025-22068) * kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724) * kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883) * kernel: e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898) * kernel: wifi: mt76: fix linked list corruption (CVE-2025-39918) * kernel: i40e: fix idx validation in config queues msg (CVE-2025-39971) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-22068 CVE-2025-38724 CVE-2025-39883 CVE-2025-39898 CVE-2025-39918 CVE-2025-39971 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088) * python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-59088 CVE-2025-59089 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018) * firefox: Use-after-free in the Audio/Video component (CVE-2025-13014) * firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016) * firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019) * firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020) * firefox: Race condition in the Graphics component (CVE-2025-13012) * firefox: Spoofing issue in Firefox (CVE-2025-13015) * firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013) * firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-13012 CVE-2025-13013 CVE-2025-13014 CVE-2025-13015 CVE-2025-13016 CVE-2025-13017 CVE-2025-13018 CVE-2025-13019 CVE-2025-13020 MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * mysql: DML unspecified vulnerability (CPU Oct 2025) (CVE-2025-53053) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53044) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53062) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53054) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53045) * mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53040) * mysql: Components Services unspecified vulnerability (CPU Oct 2025) (CVE-2025-53069) * mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53042) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-53040 CVE-2025-53042 CVE-2025-53044 CVE-2025-53045 CVE-2025-53053 CVE-2025-53054 CVE-2025-53062 CVE-2025-53069 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Heap Use-After-Free in libsoup message queue handling during HTTP/2 read completion (CVE-2025-12105) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-12105 Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651) * tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-31651 CVE-2025-55752 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.108 and .NET Runtime 10.0.8.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-42899 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-52881 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 (CVE-2025-14333) * firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2025-14322) * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328) * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329) * firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331) * firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14321 CVE-2025-14322 CVE-2025-14323 CVE-2025-14324 CVE-2025-14325 CVE-2025-14328 CVE-2025-14329 CVE-2025-14330 CVE-2025-14331 CVE-2025-14333 Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651) * tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service (CVE-2025-61795) * tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-31651 CVE-2025-55752 CVE-2025-61795 The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Access of Uninitialized Pointer in Wireshark (CVE-2025-13499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-13499 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58183 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * database/sql: Postgres Scan Race Condition (CVE-2025-47907) * podman: Podman kube play command may overwrite host files (CVE-2025-9566) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9566 CVE-2025-47907 Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61729 CVE-2025-68121 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702) * kernel: kernfs: Fix UAF in polling when open file is released (CVE-2025-39881) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-39702 CVE-2025-39881 A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-27144 The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) Bug Fix(es): * When using a P11SecretKey for both signing and encryption in FIPS mode, the FIPS PKCS11 provider would fail with a CKR_ATTRIBUTE_VALUE_INVALID error. This was due to the default configuration not applying the CKA_ENCRYPT=true attribute to the key. The configuration in this release is updated to include this attribute. (AlmaLinux-142860, AlmaLinux-142876, AlmaLinux-142877, AlmaLinux-142878, AlmaLinux-142879, AlmaLinux-142880) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-64720 CVE-2025-65018 CVE-2026-21925 CVE-2026-21933 CVE-2026-21945 Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices. Security Fix(es): * qtsvg: Use-after-free vulnerability in Qt SVG (CVE-2025-10729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-10729 Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817) * Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818) * Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819) * Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 CVE-2025-49844 libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: Invalid return code for chacha20 poly1305 with OpenSSL backend (CVE-2025-5987) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5987 OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand (CVE-2025-61984) * openssh: OpenSSH: Null character in ssh:// URI can lead to code execution via ProxyCommand (CVE-2025-61985) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61984 CVE-2025-61985 The Go Programming Language. Security Fix(es): * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58183 Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229) * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230) * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-62229 CVE-2025-62230 CVE-2025-62231 The golang packages provide the Go programming language compiler. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61729 PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004) * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-2004 CVE-2026-2005 CVE-2026-2006 Expat is a C library for parsing XML documents. Security Fix(es): * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-59375 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778) * bind: Cache poisoning due to weak PRNG (CVE-2025-40780) * bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8677 CVE-2025-40778 CVE-2025-40780 The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS. Security Fix(es): * postfix: buffer over-read via malformed enhanced status code (CVE-2026-43964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-43964 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018) * firefox: Use-after-free in the Audio/Video component (CVE-2025-13014) * firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016) * firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019) * firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020) * firefox: Race condition in the Graphics component (CVE-2025-13012) * firefox: Spoofing issue in Firefox (CVE-2025-13015) * firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013) * firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-13012 CVE-2025-13013 CVE-2025-13014 CVE-2025-13015 CVE-2025-13016 CVE-2025-13017 CVE-2025-13018 CVE-2025-13019 CVE-2025-13020 The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58183 Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution. Security Fix(es): * keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-13609 This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning. Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal. Security Fix(es): * mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-55753 The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files. Security Fix(es): * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) * libpng: LIBPNG out-of-bounds read in png_image_read_composite (CVE-2025-66293) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-64720 CVE-2025-65018 CVE-2025-66293 The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive (CVE-2026-4111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4111 Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * git-lfs: Git LFS may write to arbitrary files via crafted symlinks (CVE-2025-26625) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-26625 The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fix(es): * tar: Tar path traversal (CVE-2025-45582) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-45582 The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems (CVE-2025-11561) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11561 Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61729 CVE-2025-68121 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58183 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 (CVE-2025-14333) * firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2025-14322) * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328) * firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329) * firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331) * firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14321 CVE-2025-14322 CVE-2025-14323 CVE-2025-14324 CVE-2025-14325 CVE-2025-14328 CVE-2025-14329 CVE-2025-14330 CVE-2025-14331 CVE-2025-14333 The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities. Security Fix(es): * binutils: GNU Binutils Linker heap-based overflow (CVE-2025-11082) * binutils: GNU Binutils Linker heap-based overflow (CVE-2025-11083) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11082 CVE-2025-11083 The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools, which provides better performance than the traditional Linux NFS server used by most users. These packages also contain the mount.nfs, umount.nfs, and showmount programs. Security Fix(es): * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-12801 Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression. Security Fix(es): * Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS (CVE-2025-6176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6176 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CVE-2025-38499) * kernel: net: tun: Update napi->skb after XDP process (CVE-2025-39984) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38499 CVE-2025-39984 Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * resolv: Denial of Service in resolv gem (CVE-2025-24294) * rexml: REXML denial of service (CVE-2025-58767) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-24294 CVE-2025-58767 CVE-2025-61594 The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082) * httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200) * httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58098 CVE-2025-65082 CVE-2025-66200 gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. Security Fix(es): * gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing (CVE-2025-67269) * gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling (CVE-2025-67268) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-67268 CVE-2025-67269 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-8291 MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238) * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236) * mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-21998 CVE-2026-22001 CVE-2026-22002 CVE-2026-22004 CVE-2026-22005 CVE-2026-22009 CVE-2026-22015 CVE-2026-22017 CVE-2026-34270 CVE-2026-34271 CVE-2026-34276 CVE-2026-34303 CVE-2026-34304 CVE-2026-34308 CVE-2026-35236 CVE-2026-35237 CVE-2026-35238 CVE-2026-35239 CVE-2026-35240 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) * urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-66418 CVE-2025-66471 CVE-2026-21441 Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation (CVE-2025-68156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2025 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-68156 The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter. Security Fix(es): * gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-5201 The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944) * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959) * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-33278 CVE-2026-42944 CVE-2026-42959 The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4046 The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915) * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58436 CVE-2025-61915 Binutils is a collection of binary utilities, including ar (for creating, modifying and extracting from archives), as (a family of GNU assemblers), gprof (for displaying call graph profile data), ld (the GNU linker), nm (for listing symbols from object files), objcopy (for copying and translating object files), objdump (for displaying information from object files), ranlib (for generating an index for the contents of an archive), readelf (for displaying detailed information about binary files), size (for listing the section sizes of an object or archive file), strings (for listing printable strings from files), strip (for discarding symbols), and addr2line (for converting addresses to file and line). Security Fix(es): * binutils: GNU Binutils Linker heap-based overflow (CVE-2025-11083) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11083 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (First- vs Last-Value Wins) (CVE-2025-14523) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14523 MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fix(es): * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21941) * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21948) * mysql: InnoDB unspecified vulnerability (CPU Jan 2026) (CVE-2026-21936) * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21968) * mysql: DDL unspecified vulnerability (CPU Jan 2026) (CVE-2026-21937) * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2026) (CVE-2026-21964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-21936 CVE-2026-21937 CVE-2026-21941 CVE-2026-21948 CVE-2026-21964 CVE-2026-21968 PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-12818 The vsftpd packages include a Very Secure File Transfer Protocol (FTP) daemon, which is used to serve files over a network. Security Fix(es): * vsftpd: vsftpd: Denial of service via integer overflow in ls command parameter parsing (CVE-2025-14242) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14242 The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser. Security Fix(es): * net-snmp: buffer overflow via a specially crafted packet can cause a crash in snmptrapd (CVE-2025-68615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-68615 Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-32365 The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fix(es): * postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-12818 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806) * kernel: audit: fix out-of-bounds read in audit_compare_dname_path() (CVE-2025-39840) * kernel: mm: slub: avoid wake up kswapd in set_track_prepare (CVE-2025-39843) * kernel: net: phylink: add lock for serializing concurrent pl->phydev writes with resolver (CVE-2025-39905) * kernel: iommufd: Fix race during abort for file descriptors (CVE-2025-39966) * kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176) * kernel: sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240) * kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CVE-2025-40277) * kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CVE-2025-68287) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-39806 CVE-2025-39840 CVE-2025-39843 CVE-2025-39905 CVE-2025-39966 CVE-2025-40176 CVE-2025-40240 CVE-2025-40277 CVE-2025-68287 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-47913 MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490) * mariadb: MariaDB Server Crash Due to Empty Backtrace Log (CVE-2023-52969) * mariadb: MariaDB Server Crash (CVE-2023-52971) * mariadb: MariaDB Server Crash via Item_direct_view_ref (CVE-2023-52970) * mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693) * mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation (CVE-2025-13699) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2023-52969 CVE-2023-52970 CVE-2023-52971 CVE-2025-13699 CVE-2025-21490 CVE-2025-30693 CVE-2025-30722 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-47913 HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61729 The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-64720 CVE-2025-65018 CVE-2026-21925 CVE-2026-21933 CVE-2026-21945 The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fix(es): * util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames (CVE-2025-14104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14104 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Excessive read buffering DoS in http.client (CVE-2025-13836) * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (CVE-2025-12084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-12084 CVE-2025-13836 OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file (CVE-2025-11187) * openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing (CVE-2025-15467) * openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling (CVE-2025-15468) * openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation (CVE-2025-15469) * openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression (CVE-2025-66199) * openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter (CVE-2025-68160) * openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls (CVE-2025-69418) * openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419) * openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing (CVE-2025-69421) * openssl: OpenSSL: Denial of Service via malformed TimeStamp Response (CVE-2025-69420) * openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing (CVE-2026-22795) * openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification (CVE-2026-22796) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11187 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469 CVE-2025-66199 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420 CVE-2025-69421 CVE-2026-22795 CVE-2026-22796 The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards. Security Fix(es): * GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write (CVE-2025-68973) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-68973 The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9086 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking (CVE-2026-24049) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-24049 Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-68121 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819) * kernel: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CVE-2025-38022) * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349) * kernel: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU (CVE-2025-38453) * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568) * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731) * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154) * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170) * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135) * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158) * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248) * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258) * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251) * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service. (CVE-2025-40271) * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and denial of service (CVE-2025-40294) * kernel: Linux kernel: Information disclosure and denial of service in Bluetooth HCI event handling (CVE-2025-40301) * kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318) * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301) * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-37819 CVE-2025-38022 CVE-2025-38349 CVE-2025-38453 CVE-2025-38568 CVE-2025-38731 CVE-2025-40135 CVE-2025-40154 CVE-2025-40158 CVE-2025-40170 CVE-2025-40248 CVE-2025-40251 CVE-2025-40258 CVE-2025-40271 CVE-2025-40294 CVE-2025-40301 CVE-2025-40318 CVE-2025-68301 CVE-2025-68305 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service due to data race in vmalloc's show_numa_info function (CVE-2025-38383) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38383 PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: heap-based buffer overflow in array_merge() (CVE-2025-14178) * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177) * php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14177 CVE-2025-14178 CVE-2025-14180 The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Integer overflow in memalign leads to heap corruption (CVE-2026-0861) * glibc: glibc: Information disclosure via zero-valued network query (CVE-2026-0915) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-0861 CVE-2026-0915 Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-2026-21637) * nodejs: Nodejs denial of service (CVE-2025-59466) * nodejs: Nodejs denial of service (CVE-2025-59465) * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131) * nodejs: Nodejs file permissions bypass (CVE-2025-55130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-55130 CVE-2025-55131 CVE-2025-55132 CVE-2025-59465 CVE-2025-59466 CVE-2026-21637 Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: iperf Heap Buffer Overflow (CVE-2025-54349) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-54349 Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-2026-21637) * nodejs: Nodejs denial of service (CVE-2025-59466) * nodejs: Nodejs denial of service (CVE-2025-59465) * nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131) * nodejs: Nodejs file permissions bypass (CVE-2025-55130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-55130 CVE-2025-55131 CVE-2025-55132 CVE-2025-59465 CVE-2025-59466 CVE-2026-21637 The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: Sudo: Privilege escalation due to failure in privilege drop calls (CVE-2026-35535) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-35535 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication (CVE-2026-0719) * libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response (CVE-2026-1761) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-0719 CVE-2026-1761 A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58183 Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-11234 The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) * httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032) * httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857) * httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007) * Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-28780 CVE-2026-33007 CVE-2026-33857 CVE-2026-34032 CVE-2026-34059 The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * Wireshark: NULL Pointer Dereference in Wireshark (CVE-2025-9817) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9817 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting (CVE-2025-38141) * kernel: Linux kernel io_uring: Local privilege escalation, information disclosure, or denial of service via use-after-free (CVE-2025-38106) * kernel: drm/xe: Make dma-fences compliant with the safe access rules (CVE-2025-38703) * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing (CVE-2025-39760) * kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CVE-2025-39818) * kernel: Kernel: Use-after-free in GPIO character device allows privilege escalation or denial of service (CVE-2025-40249) * kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085) * kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001) * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097) * kernel: Linux kernel: Information disclosure in efivarfs via incorrect error propagation (CVE-2026-23156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38106 CVE-2025-38141 CVE-2025-38703 CVE-2025-39760 CVE-2025-39818 CVE-2025-40249 CVE-2025-71085 CVE-2026-23001 CVE-2026-23097 CVE-2026-23156 Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: Missing access check on reparse point operations (CVE-2026-1933) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * samba: group policy certificate enrollment uses <http://> without validation (CVE-2026-3012) * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480) * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170) * samba: Remote Code Execution in SAMR (CVE-2026-4408) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Critical Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4408 CVE-2026-4480 CVE-2026-40170 Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61729 The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-23490 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327) * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147 (CVE-2026-0891) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-0878) * firefox: Use-after-free in the IPC component (CVE-2026-0882) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884) * firefox: Information disclosure in the Networking component (CVE-2026-0883) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877) * firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890) * firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879) * firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880) * firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14327 CVE-2026-0877 CVE-2026-0878 CVE-2026-0879 CVE-2026-0880 CVE-2026-0882 CVE-2026-0883 CVE-2026-0884 CVE-2026-0885 CVE-2026-0886 CVE-2026-0887 CVE-2026-0890 CVE-2026-0891 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Spoofing issue in the Downloads Panel component (CVE-2025-14327) * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-0885) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147 (CVE-2026-0891) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-0878) * firefox: Use-after-free in the IPC component (CVE-2026-0882) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-0884) * firefox: Information disclosure in the Networking component (CVE-2026-0883) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-0877) * firefox: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-0890) * firefox: Clickjacking issue, information disclosure in the PDF Viewer component (CVE-2026-0887) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-0879) * firefox: Sandbox escape due to integer overflow in the Graphics component (CVE-2026-0880) * firefox: Incorrect boundary conditions in the Graphics component (CVE-2026-0886) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14327 CVE-2026-0877 CVE-2026-0878 CVE-2026-0879 CVE-2026-0880 CVE-2026-0882 CVE-2026-0883 CVE-2026-0884 CVE-2026-0885 CVE-2026-0886 CVE-2026-0887 CVE-2026-0890 CVE-2026-0891 Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago. Security Fix(es): * libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response (CVE-2026-1761) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-1761 The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4800 Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution. Security Fix(es): * keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication (CVE-2026-1709) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Critical Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-1709 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. (CVE-2026-23530) * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability (CVE-2026-23884) * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883) * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution (CVE-2026-23533) * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution. (CVE-2026-23531) * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow (CVE-2026-23534) * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow (CVE-2026-23532) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-23530 CVE-2026-23531 CVE-2026-23532 CVE-2026-23533 CVE-2026-23534 CVE-2026-23883 CVE-2026-23884 The golang packages provide the Go programming language compiler. Security Fix(es): * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61728 CVE-2025-61732 CVE-2025-68121 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es): * .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127) * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26127 CVE-2026-26130 The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards. Security Fix(es): * GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution (CVE-2026-24882) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-24882 The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-13465 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es): * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26130 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation (CVE-2025-38415) * kernel: vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403) * kernel: Linux kernel: Data corruption and system instability due to improper io_uring/net buffer handling (CVE-2025-38730) * kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length (CVE-2025-39933) * kernel: mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable() (CVE-2025-40133) * kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. (CVE-2025-40304) * kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling (CVE-2025-40322) * kernel: svcrdma: use rc_pageoff for memcpy byte offset (CVE-2025-68811) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38403 CVE-2025-38415 CVE-2025-38730 CVE-2025-39933 CVE-2025-40133 CVE-2025-40304 CVE-2025-40322 CVE-2025-68811 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es): * .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127) * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26127 CVE-2026-26130 Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-34982 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross?Dashboard Privilege Escalation (CVE-2026-21721) * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61728 CVE-2025-61729 CVE-2025-68121 CVE-2026-21721 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (CVE-2023-53034) * kernel: Linux kernel erofs: Use-After-Free due to device type mismatch (CVE-2025-38172) * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064) * kernel: Bluetooth: ISO: Fix possible UAF on iso_conn_free (CVE-2025-40141) * kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service (CVE-2025-40269) * kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349) * kernel: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CVE-2026-22998) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2023-53034 CVE-2025-38172 CVE-2025-40064 CVE-2025-40141 CVE-2025-40269 CVE-2025-68349 CVE-2026-22998 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libvpx: Heap buffer overflow in libvpx (CVE-2026-2447) * firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785) * firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793) * firefox: Undefined behavior in the DOM: Core & HTML component (CVE-2026-2771) * firefox: Integer overflow in the Audio/Video component (CVE-2026-2774) * firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776) * firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781) * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766) * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769) * firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787) * firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768) * firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783) * firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784) * firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026-2759) * firefox: Integer overflow in the JavaScript: Standard Library component (CVE-2026-2762) * firefox: Sandbox escape in the Graphics: WebRender component (CVE-2026-2761) * firefox: Privilege escalation in the Messaging System component (CVE-2026-2777) * firefox: Same-origin policy bypass in the Networking: JAR component (CVE-2026-2790) * firefox: Mitigation bypass in the DOM: HTML Parser component (CVE-2026-2775) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2763) * firefox: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2792) * firefox: Incorrect boundary conditions in the Web Audio component (CVE-2026-2773) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2786) * firefox: Use-after-free in the Graphics: ImageLib component (CVE-2026-2789) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component (CVE-2026-2757) * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-2760) * firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-2772) * firefox: Incorrect boundary conditions in the Networking: JAR component (CVE-2026-2779) * firefox: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-2767) * firefox: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (CVE-2026-2764) * firefox: Privilege escalation in the Netmonitor component (CVE-2026-2782) * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2765) * firefox: Privilege escalation in the Netmonitor component (CVE-2026-2780) * firefox: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component (CVE-2026-2778) * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-2758) * firefox: Mitigation bypass in the Networking: Cache component (CVE-2026-2791) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-2770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-2447 CVE-2026-2757 CVE-2026-2758 CVE-2026-2759 CVE-2026-2760 CVE-2026-2761 CVE-2026-2762 CVE-2026-2763 CVE-2026-2764 CVE-2026-2765 CVE-2026-2766 CVE-2026-2767 CVE-2026-2768 CVE-2026-2769 CVE-2026-2770 CVE-2026-2771 CVE-2026-2772 CVE-2026-2773 CVE-2026-2774 CVE-2026-2775 CVE-2026-2776 CVE-2026-2777 CVE-2026-2778 CVE-2026-2779 CVE-2026-2780 CVE-2026-2781 CVE-2026-2782 CVE-2026-2783 CVE-2026-2784 CVE-2026-2785 CVE-2026-2786 CVE-2026-2787 CVE-2026-2788 CVE-2026-2789 CVE-2026-2790 CVE-2026-2791 CVE-2026-2792 CVE-2026-2793 FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279) * fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269) * fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-15269 CVE-2025-15275 CVE-2025-15279 The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Security Fix(es): * python: protobuf: Protobuf: Denial of Service due to recursion depth bypass (CVE-2026-0994) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-0994 The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Heap buffer overflow in libvpx (CVE-2026-2447) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-2447 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721) * firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698) * firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716) * firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684) * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705) * firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710) * firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690) * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708) * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691) * firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699) * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693) * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719) * firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694) * firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720) * firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707) * firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4684 CVE-2026-4685 CVE-2026-4686 CVE-2026-4687 CVE-2026-4688 CVE-2026-4689 CVE-2026-4690 CVE-2026-4691 CVE-2026-4692 CVE-2026-4693 CVE-2026-4694 CVE-2026-4695 CVE-2026-4696 CVE-2026-4697 CVE-2026-4698 CVE-2026-4699 CVE-2026-4700 CVE-2026-4701 CVE-2026-4702 CVE-2026-4704 CVE-2026-4705 CVE-2026-4706 CVE-2026-4707 CVE-2026-4708 CVE-2026-4709 CVE-2026-4710 CVE-2026-4711 CVE-2026-4712 CVE-2026-4713 CVE-2026-4714 CVE-2026-4715 CVE-2026-4716 CVE-2026-4717 CVE-2026-4718 CVE-2026-4719 CVE-2026-4720 CVE-2026-4721 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61729 CVE-2025-68121 nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-1642 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in IPv6 address deletion may lead to a denial of service (CVE-2026-23010) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-23010 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow (CVE-2025-14905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14905 The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files. Security Fix(es): * libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API (CVE-2026-22801) * libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read (CVE-2026-22695) * libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-22695 CVE-2026-22801 CVE-2026-25646 HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-68121 Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-33999 CVE-2026-34001 CVE-2026-34003 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22855) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22853) * freerdp: FreeRDP global-buffer-overflow (CVE-2026-22858) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22859) * freerdp: FreeRDP: Denial of Service via use after free in ecam_channel_write (CVE-2026-24678) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-22853 CVE-2026-22855 CVE-2026-22858 CVE-2026-22859 CVE-2026-24678 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865) * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366) * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367) * cpython: email header injection due to unquoted newlines (CVE-2026-1299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-15366 CVE-2025-15367 CVE-2026-0865 CVE-2026-1299 The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61729 CVE-2025-68121 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Kernel: Double free vulnerability in exFAT filesystem can lead to denial of service (CVE-2025-38206) * kernel: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (CVE-2025-40096) * kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168) * kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38206 CVE-2025-40096 CVE-2025-40168 CVE-2025-68800 The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. Security Fix(es): * grub2: Missing unregister call for gettext command may lead to use-after-free (CVE-2025-61662) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61662 MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods. Security Fix(es): * MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVE-2026-25506) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25506 The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities. Security Fix(es): * openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following (CVE-2026-23893) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-23893 This package provides build-stage rpm automation to simplify the creation of Go language (golang) packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only. Security Fix(es): * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function (CVE-2025-9820) * gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification (CVE-2025-14831) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-9820 CVE-2025-14831 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-23490 The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61729 CVE-2025-68121 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61728 CVE-2025-61729 CVE-2025-68121 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772) * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754) * firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752) * firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757) * firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753) * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759) * firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747) * firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749) * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766) * firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761) * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771) * firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764) * firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765) * firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-6746 CVE-2026-6747 CVE-2026-6748 CVE-2026-6749 CVE-2026-6750 CVE-2026-6751 CVE-2026-6752 CVE-2026-6753 CVE-2026-6754 CVE-2026-6757 CVE-2026-6759 CVE-2026-6761 CVE-2026-6762 CVE-2026-6763 CVE-2026-6764 CVE-2026-6765 CVE-2026-6766 CVE-2026-6767 CVE-2026-6769 CVE-2026-6770 CVE-2026-6771 CVE-2026-6772 CVE-2026-6776 CVE-2026-6785 CVE-2026-6786 A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61728 CVE-2025-61729 CVE-2025-68121 yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61729 CVE-2025-68121 The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-53020 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es): * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043) * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-34043 CVE-2026-42899 yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4519 The ncurses (new curses) library routines are a terminal-independent method of updating character screens with reasonable optimization. The ncurses packages contain support utilities including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo. Security Fix(es): * ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. (CVE-2025-69720) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-69720 GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718) * gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719) * gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) * gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-52718 CVE-2026-52719 CVE-2026-52720 CVE-2026-52722 yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fix(es): * squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526) * Squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-32748 CVE-2026-33526 Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: Cockpit: Arbitrary command execution via crafted links in system logs UI (CVE-2026-4802) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4802 Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-35177 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721) * firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698) * firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716) * firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684) * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705) * firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710) * firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690) * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708) * firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691) * firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699) * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693) * firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719) * firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694) * firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720) * firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707) * firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687) * thunderbird: Out of bounds read in IMAP parsing (CVE-2026-4371) * thunderbird: Spoofing issue in Thunderbird (CVE-2026-3889) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-3889 CVE-2026-4371 CVE-2026-4684 CVE-2026-4685 CVE-2026-4686 CVE-2026-4687 CVE-2026-4688 CVE-2026-4689 CVE-2026-4690 CVE-2026-4691 CVE-2026-4692 CVE-2026-4693 CVE-2026-4694 CVE-2026-4695 CVE-2026-4696 CVE-2026-4697 CVE-2026-4698 CVE-2026-4699 CVE-2026-4700 CVE-2026-4701 CVE-2026-4702 CVE-2026-4704 CVE-2026-4705 CVE-2026-4706 CVE-2026-4707 CVE-2026-4708 CVE-2026-4709 CVE-2026-4710 CVE-2026-4711 CVE-2026-4712 CVE-2026-4713 CVE-2026-4714 CVE-2026-4715 CVE-2026-4716 CVE-2026-4717 CVE-2026-4718 CVE-2026-4719 CVE-2026-4720 CVE-2026-4721 giflib is a library for reading and writing gif images. Security Fix(es): * giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-23868 Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 CVE-2026-27137 The golang packages provide the Go programming language compiler. Security Fix(es): * cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61731 CVE-2026-25679 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Arbitrary code execution via heap out-of-bounds write in RLE planar decode path (CVE-2026-26965) * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline (CVE-2026-26955) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26955 CVE-2026-26965 This package provides build-stage rpm automation to simplify the creation of Go language (golang) packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() (CVE-2026-23231) * kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential privilege escalation. (CVE-2025-71238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-71238 CVE-2026-23231 The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-10158 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4786 CVE-2026-6100 Expat is a C library for parsing XML documents. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-45186 Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Security Fix(es): * capstone: Capstone: Memory corruption via unchecked vsnprintf return (CVE-2025-68114) * capstone: Capstone: Heap buffer overflow via skipdata callback allows denial of service or arbitrary code execution. (CVE-2025-67873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-67873 CVE-2025-68114 This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time. Security Fix(es): * perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003) * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2006-10002 CVE-2006-10003 The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance TLS connection handling (CVE-2026-34282) * JDK: Enhance key generation (CVE-2026-34268) Bug Fix(es): * When copying files, OpenJDK 21 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 21 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in this release. (AlmaLinux-169617, AlmaLinux-169951, AlmaLinux-169952, AlmaLinux-169942, AlmaLinux-169953, AlmaLinux-169945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-22007 CVE-2026-22013 CVE-2026-22016 CVE-2026-22018 CVE-2026-22021 CVE-2026-23865 CVE-2026-34268 CVE-2026-34282 FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-15270 The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service (CVE-2023-52356) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2023-52356 Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-1525 CVE-2026-1526 CVE-2026-1528 CVE-2026-2229 CVE-2026-21710 CVE-2026-25547 CVE-2026-26996 CVE-2026-27135 CVE-2026-27904 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772) * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754) * firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752) * firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757) * firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753) * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759) * firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747) * firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749) * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766) * firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761) * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771) * firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764) * firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765) * firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-6746 CVE-2026-6747 CVE-2026-6748 CVE-2026-6749 CVE-2026-6750 CVE-2026-6751 CVE-2026-6752 CVE-2026-6753 CVE-2026-6754 CVE-2026-6757 CVE-2026-6759 CVE-2026-6761 CVE-2026-6762 CVE-2026-6763 CVE-2026-6764 CVE-2026-6765 CVE-2026-6766 CVE-2026-6767 CVE-2026-6769 CVE-2026-6770 CVE-2026-6771 CVE-2026-6772 CVE-2026-6776 CVE-2026-6785 CVE-2026-6786 GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920) * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082) * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085) * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921) * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-2920 CVE-2026-2921 CVE-2026-2922 CVE-2026-2923 CVE-2026-3082 CVE-2026-3083 CVE-2026-3085 crun is a OCI runtime Security Fix(es): * crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-30892 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-1519 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852) * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732) * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676) * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491) * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948) * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684) * freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681) * freerdp: FreeRDP has a Heap-buffer-overflow in audio_formats_free (CVE-2026-24682) * freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683) * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679) * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675) * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages (CVE-2026-31806) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-22852 CVE-2026-22854 CVE-2026-22856 CVE-2026-23732 CVE-2026-23948 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676 CVE-2026-24679 CVE-2026-24681 CVE-2026-24682 CVE-2026-24683 CVE-2026-24684 CVE-2026-31806 OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables (CVE-2026-3497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-3497 Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-32280 CVE-2026-32281 CVE-2026-32283 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.116 and .NET Runtime 9.0.15.Security Fix(es): * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171) * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203) * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116) * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26171 CVE-2026-32178 CVE-2026-32203 CVE-2026-33116 The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing (CVE-2026-4424) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4424 nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files (CVE-2026-32647) * NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module (CVE-2026-27654) * NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file (CVE-2026-27784) * NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled (CVE-2026-27651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-27651 CVE-2026-27654 CVE-2026-27784 CVE-2026-32647 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984) * FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-33983 CVE-2026-33984 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.126 and .NET Runtime 8.0.26.Security Fix(es): * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171) * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203) * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116) * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26171 CVE-2026-32178 CVE-2026-32203 CVE-2026-33116 Authoritative DNS server for A/AAAA container records Forwards other request to configured resolvers. Read more about configuration in `src/backend/mod.rs`. Security Fix(es): * aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset (CVE-2026-35406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-35406 Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210) * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-33210 CVE-2026-41316 Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities. Security Fix(es): * libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() (CVE-2026-4878) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4878 The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4775 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-31431 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401) * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956) * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975) * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955) * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968) * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954) * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958) * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946) * firefox: Privilege escalation in the Security component (CVE-2026-8970) * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950) * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974) * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953) * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962) * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-8388 CVE-2026-8391 CVE-2026-8401 CVE-2026-8946 CVE-2026-8947 CVE-2026-8950 CVE-2026-8953 CVE-2026-8954 CVE-2026-8955 CVE-2026-8956 CVE-2026-8957 CVE-2026-8958 CVE-2026-8961 CVE-2026-8962 CVE-2026-8968 CVE-2026-8970 CVE-2026-8974 CVE-2026-8975 The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Buffer Over-read in Wireshark (CVE-2026-3203) * wireshark: Improperly Controlled Sequential Memory Allocation in Wireshark (CVE-2026-3201) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-3201 CVE-2026-3203 OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode (CVE-2026-35385) * OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option (CVE-2026-35414) * OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage (CVE-2026-35387) * OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions (CVE-2026-35388) * OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username (CVE-2026-35386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388 CVE-2026-35414 The libexif packages provide a library for extracting extra information from image files. Security Fix(es): * libexif: libexif: Denial of Service and information disclosure via integer underflow in MakerNote decoding (CVE-2026-40386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-40386 The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improved Arena allocations (CVE-2026-22008) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance TLS connection handling (CVE-2026-34282) * JDK: Enhance key generation (CVE-2026-34268) This release also updates a number of third-party libraries included in the JDK. The libraries themselves are affected by the following CVEs, but this is not a statement that the JDK itself is affected: * giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740) * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) Bug Fix(es): * When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 25 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in this release. (AlmaLinux-169939, AlmaLinux-169937) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-22007 CVE-2026-22008 CVE-2026-22013 CVE-2026-22016 CVE-2026-22018 CVE-2026-22021 CVE-2026-23865 CVE-2026-26740 CVE-2026-33416 CVE-2026-33636 CVE-2026-34268 CVE-2026-34282 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731) * firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-5731 CVE-2026-5732 CVE-2026-5734 CVE-2026-33416 CVE-2026-33636 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-39766 CVE-2025-68741 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.117 and .NET Runtime 9.0.16.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-42899 Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078) * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-34078 CVE-2026-34079 A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fix(es): * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-58183 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958) * tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-31958 CVE-2026-35536 DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update mechanism, using stand-alone DDNS daemon. Security Fix(es): * Kea: Kea: Denial of Service via maliciously crafted message (CVE-2026-3608) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-3608 Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-59032 CVE-2026-27857 CVE-2026-27858 A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-61726 CVE-2025-61729 CVE-2025-68121 Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: ws: be more explicit when handling hostnames on cli (CVE-2026-4631) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Critical Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4631 The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-33554 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel (net/mlx5): Use-after-free in ECVF vports unload leads to denial of service (CVE-2025-38109) * kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure (CVE-2026-23144) * kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution (CVE-2026-23171) * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193) * kernel: macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209) * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204) * kernel: ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-38109 CVE-2026-23144 CVE-2026-23171 CVE-2026-23191 CVE-2026-23193 CVE-2026-23204 CVE-2026-23209 The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es): * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-29111 A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402) * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-23270 CVE-2026-31402 CVE-2026-31419 CVE-2026-31431 libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-27135 The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597) * pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-30922 CVE-2026-32597 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731) * firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-5731 CVE-2026-5732 CVE-2026-5734 CVE-2026-33416 CVE-2026-33636 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-43284 PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735) * php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259) * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262) * php: signed integer overflow in metaphone() (CVE-2026-7568) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-6735 CVE-2026-7258 CVE-2026-7259 CVE-2026-7262 CVE-2026-7568 OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-27622 yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-32282 CVE-2026-32283 GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-14087 CVE-2025-14512 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-3039 CVE-2026-5946 The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-35091 CVE-2026-35092 HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066) * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-71066 CVE-2026-46113 CVE-2026-46227 CVE-2026-53359 Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417) * vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421) * vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-28417 CVE-2026-28421 CVE-2026-33412 Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * nodejs: Nodejs denial of service (CVE-2026-21637) * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581) * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710) * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715) * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716) * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711) * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713) * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714) * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-1525 CVE-2026-1526 CVE-2026-1527 CVE-2026-1528 CVE-2026-2229 CVE-2026-2581 CVE-2026-21637 CVE-2026-21710 CVE-2026-21711 CVE-2026-21712 CVE-2026-21713 CVE-2026-21714 CVE-2026-21715 CVE-2026-21716 CVE-2026-21717 CVE-2026-25547 CVE-2026-26996 CVE-2026-27135 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect (CVE-2026-25997) * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952) * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986) * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775) * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885) * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884) * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883) * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985) * FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read (CVE-2026-33982) * FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution (CVE-2026-33987) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25952 CVE-2026-25997 CVE-2026-26986 CVE-2026-29775 CVE-2026-31883 CVE-2026-31884 CVE-2026-31885 CVE-2026-33982 CVE-2026-33985 CVE-2026-33987 The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files. Security Fix(es): * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-33636 The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355) * libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912) Bug Fix(es) and Enhancement(s): * Reintroduce the `tiffcp -i` option (JIRA:AlmaLinux-185328) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2023-52355 CVE-2026-12912 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300) * kernel: ptrace: require CAP_SYS_PTRACE when task has no mm (CVE-2026-46333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-46300 CVE-2026-46333 jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. Security Fix(es): * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers (CVE-2026-39979) * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-39979 CVE-2026-40164 The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-33416 nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Critical Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-42945 Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-41316 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633) * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839) * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980) * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015) * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097) * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166) * kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202) * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279) * kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267) * kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275) * kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346) * kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345) * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405) * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441) * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470) * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866) * kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034) * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134) * kernel: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" (CVE-2025-40210) * kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling (CVE-2025-40257) * kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320) * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040) * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111) * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210) * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-56633 CVE-2025-21839 CVE-2025-37980 CVE-2025-38015 CVE-2025-38097 CVE-2025-38166 CVE-2025-38202 CVE-2025-38267 CVE-2025-38275 CVE-2025-38279 CVE-2025-38345 CVE-2025-38346 CVE-2025-38405 CVE-2025-38441 CVE-2025-38470 CVE-2025-39866 CVE-2025-40034 CVE-2025-40134 CVE-2025-40210 CVE-2025-40257 CVE-2025-40320 CVE-2026-23040 CVE-2026-23111 CVE-2026-23210 CVE-2026-23243 OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing (CVE-2026-7383) * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption (CVE-2026-9076) * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure. (CVE-2026-34180) * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181) * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182) * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183) * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764) * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766) * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767) * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768) * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769) * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770) * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445) * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446) * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-7383 CVE-2026-9076 CVE-2026-34180 CVE-2026-34181 CVE-2026-34182 CVE-2026-34183 CVE-2026-42764 CVE-2026-42766 CVE-2026-42767 CVE-2026-42768 CVE-2026-42769 CVE-2026-42770 CVE-2026-45445 CVE-2026-45446 CVE-2026-45447 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python-idna: idna: Denial of Service via specially crafted long inputs (CVE-2026-45409) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-45409 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-32280 CVE-2026-32281 CVE-2026-32283 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-45491 CVE-2026-45591 The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-49975 The golang packages provide the Go programming language compiler. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.5+1 [almalinux-10.2.z] (JIRA:AlmaLinux-193473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-39821 CVE-2026-39822 CVE-2026-42505 Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication (CVE-2026-10118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-10118 Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146) * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486) Bug Fix(es) and Enhancement(s): * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-185571) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-29146 CVE-2026-34486 CVE-2025-66614 CVE-2026-24733 CVE-2026-24734 CVE-2026-24880 CVE-2026-25854 CVE-2026-29129 CVE-2026-29145 CVE-2026-32990 CVE-2026-34483 CVE-2026-34487 CVE-2026-34500 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-45491 CVE-2026-45591 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-45491 CVE-2026-45591 Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146) * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486) Bug Fix(es) and Enhancement(s): * Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-168577) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-29146 CVE-2026-34486 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467) * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532) * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Critical Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-31419 CVE-2026-31467 CVE-2026-31532 CVE-2026-31581 CVE-2026-43037 CVE-2026-43501 CVE-2026-46054 The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-50031 The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition. Security Fix(es): * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-6893 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163) * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499) * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-43163 CVE-2026-43499 CVE-2026-53166 This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location. Security Fix(es): * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-68121 CVE-2026-32280 CVE-2026-32281 CVE-2026-32282 Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245) * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-42245 CVE-2026-42246 CVE-2026-42258 Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-33811 PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fix(es): * pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading (CVE-2026-5674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-5674 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432) * urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-44431 CVE-2026-44432 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432) * urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-44431 CVE-2026-44432 DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fix(es): * DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-9698 CVE-2026-10879 memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load. Security Fix(es): * memcached: memcached: Username enumeration via timing side channel (CVE-2026-47783) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-47783 OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing (CVE-2026-41142) * OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files (CVE-2026-42216) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-41142 CVE-2026-42216 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401) * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956) * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975) * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955) * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968) * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954) * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958) * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946) * firefox: Privilege escalation in the Security component (CVE-2026-8970) * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950) * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974) * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953) * firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVE-2026-8959) * firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962) * firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-8388 CVE-2026-8391 CVE-2026-8401 CVE-2026-8946 CVE-2026-8947 CVE-2026-8950 CVE-2026-8953 CVE-2026-8954 CVE-2026-8955 CVE-2026-8956 CVE-2026-8957 CVE-2026-8958 CVE-2026-8959 CVE-2026-8961 CVE-2026-8962 CVE-2026-8968 CVE-2026-8970 CVE-2026-8974 CVE-2026-8975 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327) * firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component (CVE-2026-12299) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328) * firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310) * firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325) * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315) * firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305) * firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304) * firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291) * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-12289 CVE-2026-12290 CVE-2026-12291 CVE-2026-12292 CVE-2026-12294 CVE-2026-12295 CVE-2026-12296 CVE-2026-12297 CVE-2026-12298 CVE-2026-12299 CVE-2026-12302 CVE-2026-12304 CVE-2026-12305 CVE-2026-12306 CVE-2026-12307 CVE-2026-12308 CVE-2026-12309 CVE-2026-12310 CVE-2026-12311 CVE-2026-12312 CVE-2026-12313 CVE-2026-12314 CVE-2026-12315 CVE-2026-12324 CVE-2026-12325 CVE-2026-12327 CVE-2026-12328 CVE-2026-12329 CVE-2026-12330 The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-48526 PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-6473 CVE-2026-6475 CVE-2026-6477 CVE-2026-6478 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-39822 The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an application server which is like a J2EE application server, without all the baggage. Security Fix(es): * org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-67030 libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. Security Fix(es): * libxslt: use-after-free with key data stored cross-RVT (CVE-2025-10911) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-10911 The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-33416 CVE-2026-33636 nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-9256 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019) Bug Fix(es) and Enhancement(s): * [10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-176147) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-4786 CVE-2026-6019 Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-41411 The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fix(es): * libsolv: Stack-based buffer overflow in libsolv's Debian metadata parser when handling SHA384/SHA512 checksums (CVE-2026-9150) * libsolv: Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file (CVE-2026-9149) * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-9149 CVE-2026-9150 CVE-2026-48864 A library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions. Security Fix(es): * libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string (CVE-2025-13151) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Low Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-13151 The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c (CVE-2024-34459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Low Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-34459 The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density. Security Fix(es): * rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-43958 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 CVE-2026-32280 CVE-2026-32281 CVE-2026-32283 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-39822 The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25679 CVE-2026-32280 CVE-2026-32281 CVE-2026-32283 The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling (CVE-2025-6170) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Low Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-6170 The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network (CVE-2026-34980) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-34980 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: rxrpc: fix RESPONSE authenticator parser OOB read (CVE-2026-31636) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898) * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) Bug Fix(es) and Enhancement(s): * Unexpected execmem SELinux denials after CVE-2026-46054 fix [rhel-10.2.z] (JIRA:RHEL-185117) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-31636 CVE-2026-43038 CVE-2026-43198 CVE-2026-43414 CVE-2026-45898 CVE-2026-46117 CVE-2026-46135 CVE-2026-46145 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313) * firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327) * firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component (CVE-2026-12299) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328) * firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310) * firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325) * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315) * firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305) * firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292) * firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304) * firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291) * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-12289 CVE-2026-12290 CVE-2026-12291 CVE-2026-12292 CVE-2026-12294 CVE-2026-12295 CVE-2026-12296 CVE-2026-12297 CVE-2026-12298 CVE-2026-12299 CVE-2026-12302 CVE-2026-12304 CVE-2026-12305 CVE-2026-12306 CVE-2026-12307 CVE-2026-12308 CVE-2026-12309 CVE-2026-12310 CVE-2026-12311 CVE-2026-12312 CVE-2026-12313 CVE-2026-12314 CVE-2026-12315 CVE-2026-12324 CVE-2026-12325 CVE-2026-12327 CVE-2026-12328 CVE-2026-12329 CVE-2026-12330 libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices. Security Fix(es): * libinput: local privilege escalation via crafted uinput devices (CVE-2026-50292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-50292 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641) * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786) * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056) * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772) * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260) * kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152) * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166) Bug Fix(es) and Enhancement(s): * AlmaLinux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-10.2.z] (JIRA:AlmaLinux-166047) * AlmaLinux9.5 crash due to lpfc NULL ndlp->vport [almalinux-10.2.z] (JIRA:AlmaLinux-171774) * objtool static_call check blocks build of out-of-tree livepatch modules on AlmaLinux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:AlmaLinux-178495) * ibmveth Adapter Freeze with Small MSS [almalinux-10.2.z] (JIRA:AlmaLinux-179723) * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-10.2.z] (JIRA:AlmaLinux-183127) * AlmaLinux10.0 - s390/mm: Add missing secure storage access fixups [almalinux-10.2.z] (JIRA:AlmaLinux-183319) * [AlmaLinux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:AlmaLinux-182299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-31474 CVE-2026-31641 CVE-2026-31669 CVE-2026-31772 CVE-2026-31786 CVE-2026-31787 CVE-2026-43056 CVE-2026-43260 CVE-2026-43330 CVE-2026-46056 CVE-2026-46125 CVE-2026-46152 CVE-2026-46166 CVE-2026-46173 CVE-2026-46331 The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-35091 CVE-2026-35092 The golang packages provide the Go programming language compiler. Security Fix(es): * net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.4+1 [almalinux-10.2.z] (JIRA:AlmaLinux-183347) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-42507 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-15308 Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files. Security Fix(es): * perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access (CVE-2026-42496) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-42496 PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735) * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262) * php: signed integer overflow in metaphone() (CVE-2026-7568) * php: denial of service via DOMNode::C14N() (CVE-2026-7263) * php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-6104 CVE-2026-6735 CVE-2026-7258 CVE-2026-7262 CVE-2026-7263 CVE-2026-7568 The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Security Fix(es): * coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification (CVE-2025-5278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-5278 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: XFS data corruption using reflink () Bug Fix(es) and Enhancement(s): * [Exploits (KEV)] kernel: XFS data corruption using reflink [almalinux-10.2.z] (JIRA:AlmaLinux-193945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-53016 CVE-2026-64600 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-15308 MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261) Bug Fix(es) and Enhancement(s): * Rebase MariaDB 11.8 to 11.8.8 in AlmaLinux10 (JIRA:AlmaLinux-183084) * Rebase Galera to 26.4.27 in AlmaLinux10 (JIRA:AlmaLinux-183259) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-49261 This distribution provides a Perl interface to allow reading and writing of compressed data created with the zlib and bzip2 libraries. IO-Compress supports reading and writing of bzip2, RFC 1950, RFC 1951, RFC 1952 (i.e. gzip) and zip files/buffers. The following modules used to be distributed separately, but are now included with the IO-Compress distribution: * Compress-Zlib * IO-Compress-Zlib * IO-Compress-Bzip2 * IO-Compress-Base Security Fix(es): * perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob (CVE-2026-48962) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-48962 MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261) Bug Fix(es) and Enhancement(s): * Rebase MariaDB 10.11 to 10.11.18 in AlmaLinux10 (JIRA:AlmaLinux-183086) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-49261 Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-39821 This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning. Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal. Security Fix(es): * httpd: mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-29168 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189) * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176) Bug Fix(es) and Enhancement(s): * CLONE - [AlmaLinux 10.2 Bug] qla2xxx flash image validation failure [almalinux-10.2.z] (JIRA:AlmaLinux-181887) * tegra-se fixes and updates [almalinux-10.2.z] (JIRA:AlmaLinux-182759) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-43279 CVE-2026-46090 CVE-2026-46176 CVE-2026-46189 The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450) Bug Fix(es) and Enhancement(s): * Backport Zen5 IFUNC changes to prefer AVX512/EVEX?512 string implementations on AlmaLinux 10 [almalinux-10] (JIRA:AlmaLinux-174869) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-5450 The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) * httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185) * httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631) * httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536) * httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355) Bug Fix(es) and Enhancement(s): * address Moderate severity issues from httpd 2.4.68 [almalinux-10.2.z] (JIRA:AlmaLinux-184518) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2024-42516 CVE-2026-29169 CVE-2026-34355 CVE-2026-34356 CVE-2026-42536 CVE-2026-44185 CVE-2026-44631 Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245) * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-42245 CVE-2026-42246 CVE-2026-42258 giflib is a library for reading and writing gif images. Security Fix(es): * giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-26740 The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913) * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) Bug Fix(es) and Enhancement(s): * address CVE-2026-43951 and CVE-2026-48913 in mod_http2 (JIRA:AlmaLinux-188008) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-43951 CVE-2026-48913 The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API. Security Fix(es): * c-ares: c-ares: Use-after-free / double-free in query-completion handling (CVE-2026-33630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-33630 GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (CVE-2026-58016) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-58016 GStreamer is a streaming media framework, based on graphs of elements which operate on media data. This package contains plug-ins whose license is not fully compatible with LGPL. Security Fix(es): * gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-53703 Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-42006 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610) * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-11610 CVE-2026-11774 FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface (CVE-2026-40033) * freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser (CVE-2026-44422) * freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700) * freerdp: FreeRDP: Arbitrary code execution via crafted RDPGFX PDUs (CVE-2026-44421) * freerdp: FreeRDP: Arbitrary code execution and denial of service via heap-buffer-overflow (CVE-2026-44420) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-40033 CVE-2026-44420 CVE-2026-44421 CVE-2026-44422 CVE-2026-45700 Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733) * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525) * undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697) * undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934) * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) Bug Fix(es) and Enhancement(s): * nodejs24: Rebase to the latest Node.js 24 release [almalinux-10.2.z] (JIRA:AlmaLinux-186582) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-6733 CVE-2026-6734 CVE-2026-9678 CVE-2026-9697 CVE-2026-11525 CVE-2026-12151 CVE-2026-42338 CVE-2026-48615 CVE-2026-48618 CVE-2026-48619 CVE-2026-48928 CVE-2026-48930 CVE-2026-48933 CVE-2026-48934 CVE-2026-48935 Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151) * undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678) * undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733) * undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525) * nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619) * nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930) * nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935) * nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933) * nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934) * Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928) * nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615) * nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618) Bug Fix(es) and Enhancement(s): * nodejs22: Rebase to the latest Node.js 22 release [almalinux-10.2.z] (JIRA:AlmaLinux-186623) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-6733 CVE-2026-9678 CVE-2026-11525 CVE-2026-12151 CVE-2026-42338 CVE-2026-48615 CVE-2026-48618 CVE-2026-48619 CVE-2026-48928 CVE-2026-48930 CVE-2026-48933 CVE-2026-48934 CVE-2026-48935 yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-27145 CVE-2026-33811 CVE-2026-39821 This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module allows Perl programmers to make use of the highly capable validating XML parser and the high performance DOM implementation. Security Fix(es): * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-8177 Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fix(es): * github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154) * github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-25681 CVE-2026-27145 CVE-2026-33811 CVE-2026-39821 CVE-2026-42151 CVE-2026-42154 GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow (CVE-2026-53705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-53705 The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals. Security Fix(es): * HPLIP: Incomplete Fix for CVE-2026-8631 (CVE-2026-14544) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-14544 Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists. Security Fix(es): * acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369) * acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-54369 CVE-2026-54370 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276) * kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341) * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259) Bug Fix(es) and Enhancement(s): * CNB103: net: page_pool: avoid false positive warning if NAPI was never added [almalinux-10.2.z] (JIRA:AlmaLinux-162140) * [AlmaLinux 10] Bonding reports unknown speed/duplex for tg3 interface [almalinux-10.2.z] (JIRA:AlmaLinux-182770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-43074 CVE-2026-43276 CVE-2026-43341 CVE-2026-46155 CVE-2026-46242 CVE-2026-46259 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (CVE-2026-8643) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-8643 nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055) Bug Fix(es) and Enhancement(s): * "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [almalinux-10.2.z] (JIRA:AlmaLinux-191778) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-42055 The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928) * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435) * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Moderate Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-5435 CVE-2026-5928 CVE-2026-6238 IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513) * jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-54512 CVE-2026-54513 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830) * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-39829 CVE-2026-39830 CVE-2026-39832 CVE-2026-39835 The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009) * gnutls: Fix crashing on an underflow with a DTLS datagram (CVE-2026-33845) * gnutls: Fix RSA-PSK identity truncation (CVE-2026-42010) * gnutls: Fix case-sensitivity of domain name comparison in name constraints (CVE-2026-3833) * gnutls: Fix intersecting empty name constraints (CVE-2026-42011) * gnutls: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-3832 CVE-2026-3833 CVE-2026-5260 CVE-2026-5419 CVE-2026-33845 CVE-2026-33846 CVE-2026-42009 CVE-2026-42010 CVE-2026-42011 CVE-2026-42012 CVE-2026-42013 CVE-2026-42014 CVE-2026-42015 Libyang is YANG data modeling language parser and toolkit written (and providing API) in C. Security Fix(es): * libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob (CVE-2026-44673) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-44673 OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-34588 Certificate revocation bypass due to improper OCSP response validation Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-5405) * wireshark: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark (CVE-2026-5656) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-5405 CVE-2026-5656 The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474) * sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-14474 CVE-2026-14476 HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-27145 CVE-2026-33811 FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. Security Fix(es): * frr: denial of service via crafted FlowSpec component (CVE-2026-37457) * frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-37457 CVE-2026-37459 The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fix(es): * mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() (CVE-2026-44172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-44172 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-39821 The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-39821 The perl-HTTP-Daemon package includes the [HTTP::Daemon](HTTP::Daemon) class, a subclass of IO::Socket::IP. Instances of the [HTTP::Daemon](HTTP::Daemon) class are HTTP/1.1 servers that listen on a socket for incoming requests. Security Fix(es): * perl-HTTP-Daemon: [HTTP::Daemon:](HTTP::Daemon:) Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-8450 The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fix(es): * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-6477 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-46323 The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212337, AlmaLinux-212338, AlmaLinux-212339, AlmaLinux-212340, AlmaLinux-212342, AlmaLinux-212343) Bug Fix(es): * In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212353, AlmaLinux-212359, AlmaLinux-212360, AlmaLinux-212361) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-41254 CVE-2026-46917 CVE-2026-46968 CVE-2026-47010 CVE-2026-47021 CVE-2026-47027 CVE-2026-47059 CVE-2026-47063 CVE-2026-60147 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113) * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147) * kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168) * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530) * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) * kernel: fanotify: fix false positive on permission events (CVE-2026-46150) * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215) * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976) * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950) * kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009) * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) * kernel: can: bcm: thrtimer use-after-free during RX operation teardown () Bug Fix(es) and Enhancement(s): * nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running bz1477872 testcase (JIRA:AlmaLinux-173103) * tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [almalinux-10.2.z] (JIRA:AlmaLinux-183975) * [AlmaLinux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [almalinux-10.2.z] (JIRA:AlmaLinux-186311) * ice: driver update 2026-06, part 1 [almalinux-10.2.z] (JIRA:AlmaLinux-191324) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-71113 CVE-2025-71147 CVE-2026-23168 CVE-2026-31530 CVE-2026-46116 CVE-2026-46150 CVE-2026-46215 CVE-2026-52950 CVE-2026-52976 CVE-2026-53009 CVE-2026-53071 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) * kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993) * kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281) Bug Fix(es) and Enhancement(s): * rxrpc: Address CVE-2026-43500 [almalinux-10.2.z] (JIRA:AlmaLinux-178254) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-46086 CVE-2026-52993 CVE-2026-53006 CVE-2026-53281 Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721) * librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722) * librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413) * libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-12413 CVE-2026-14957 CVE-2026-50721 CVE-2026-50722 OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in AlmaLinux OpenSSH client versions (CVE-2026-55655) * openssh: Double free in AlmaLinux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service (CVE-2026-55653) * openssh: Heap out-of-bounds read in AlmaLinux versions of OpenSSH GSSAPI indicator cleanup due to missing NULL sentinel termination (CVE-2026-55654) * openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002) * openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy (CVE-2026-59996) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-55653 CVE-2026-55654 CVE-2026-55655 CVE-2026-59996 CVE-2026-60002 The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-59939 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs/notify: call exportfs_encode_fid with s_umount (CVE-2025-40237) * kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110) * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692) * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973) * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059) Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-40237 CVE-2026-23110 CVE-2026-31692 CVE-2026-46099 CVE-2026-52973 CVE-2026-53059 CVE-2026-64561 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-10.2.z] (JIRA:AlmaLinux-192473) * dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [almalinux-10.2.z] (JIRA:AlmaLinux-192330) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2026-47300 CVE-2026-47302 CVE-2026-47303 CVE-2026-47304 CVE-2026-50524 CVE-2026-50526 CVE-2026-50527 CVE-2026-50528 CVE-2026-50646 CVE-2026-50648 CVE-2026-50649 CVE-2026-50650 CVE-2026-50651 CVE-2026-50659 CVE-2026-56170 CVE-2026-57108 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211) * kernel: isofs: validate Rock Ridge CE continuation extent against volume size (CVE-2026-46303) * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle () Bug Fix(es) and Enhancement(s): * [DELL 10.2 FEAT] [LATE-ADD] - Include support for Ghostrider PTL mini config SKU with Realtek IC Solution [almalinux-10.2.z] (JIRA:AlmaLinux-185669) * dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [almalinux-10.2.z] (JIRA:AlmaLinux-212063) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Important Copyright 2026 AlmaLinux OS cpe:/a:almalinux:almalinux:10 cpe:/a:almalinux:almalinux:10::appstream cpe:/a:almalinux:almalinux:10::powertools cpe:/a:almalinux:almalinux:10::highavailability cpe:/a:almalinux:almalinux:10::nfv cpe:/a:almalinux:almalinux:10::realtime cpe:/a:almalinux:almalinux:10::resilientstorage cpe:/a:almalinux:almalinux:10::sap cpe:/a:almalinux:almalinux:10::sap_hana cpe:/a:almalinux:almalinux:10::supplementary cpe:/o:almalinux:almalinux:10 cpe:/o:almalinux:almalinux:10::baseos CVE-2025-68211 CVE-2026-46303 CVE-2026-64530