Moderate: yggdrasil-worker-package-manager security update
Moderate: ruby:3.3 security, bug fix, and enhancement update
Moderate: ruby:4.0 security, bug fix, and enhancement update
Important: kernel security update
IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: Certificate Authority (CA) Key Recovery Authority (KRA) Online Certificate Status Protocol (OCSP) Manager Token Key Service (TKS) Token Processing Service (TPS) Automatic Certificate Management Environment (ACME) Responder Enrollment over Secure Transport (EST) Responder Security Fix(es): resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059) resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058) com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: libX11 security update
Important: libX11 security update
Important: resteasy security update
Important: postgresql16-pgvector security update
Important: qt5-qtbase security update
A filesystem browser for CockpitSecurity Fix(es): cockpit-files: cockpit-files: Arbitrary file ownership and permission modification via symlink race condition (CVE-2026-91203) cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202) cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Moderate: glibc security update
Moderate: pipewire security update
Collector with the supported components for a Red Hat build of OpenTelemetrySecurity Fix(es): net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440) net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Critical: fence-agents security update
Collector with the supported components for a Red Hat build of OpenTelemetrySecurity Fix(es): net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440) net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: bind security, bug fix, and enhancement update
A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.Security Fix(es): tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data (CVE-2026-88048) tesseract: Tesseract: Stack buffer overflow via crafted .traineddata file (CVE-2026-88047) tesseract: Tesseract: Heap out-of-bounds write allows arbitrary code execution or denial of service (CVE-2026-88049) tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata model (CVE-2026-88051) tesseract: Tesseract: Heap out-of-bounds write leads to heap corruption via crafted data file (CVE-2026-88053) tesseract: Tesseract: Heap out-of-bounds write can lead to arbitrary code execution (CVE-2026-88052) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.Security Fix(es): flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023) flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.Security Fix(es): flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023) flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: kernel security update
Important: webkit2gtk3 security update
A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005.Security Fix(es): tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data (CVE-2026-88048) tesseract: Tesseract: Stack buffer overflow via crafted .traineddata file (CVE-2026-88047) tesseract: Tesseract: Heap out-of-bounds write allows arbitrary code execution or denial of service (CVE-2026-88049) tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata model (CVE-2026-88051) tesseract: Tesseract: Heap out-of-bounds write leads to heap corruption via crafted data file (CVE-2026-88053) tesseract: Tesseract: Heap out-of-bounds write can lead to arbitrary code execution (CVE-2026-88052) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.Security Fix(es): google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests (CVE-2026-84445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: bind security, bug fix, and enhancement update
BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.Security Fix(es): bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) bind: bind: Denial of Service via long query names in RPZ processing (CVE-2026-11331) bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records (CVE-2026-81736) bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667) bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing (CVE-2026-81563) bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274) bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666) bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630) bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300) bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888) bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313) Bug Fix(es) and Enhancement(s): bind9.18: New root trust anchor key for DNSSEC [rhel-9.6.z] (JIRA:RHEL-255222) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Critical: kernel security, bug fix, and enhancement update
Critical: fence-agents security update
Critical: fence-agents security update