Security Advisories

USN-8952-2 fixed a regression in Tornado that broke static file serving for applications that subclass Tornado's StaticFileHandler, such as Jupyter. Unfortunately, that update's incomplete fix could introduce a regression by rejecting symlinks into system directories like /usr/share, which distribution packages use …

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - USB Gadget drivers; - Memory management; - Network file systems library; - Networking core; - Stream parser; - ARM32 archit…

It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585)…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - USB Gadget drivers; - Memory management; - Network file systems library; - Networking core; - Stream parser; - ARM32 archit…

Pengfei Wang discovered that the Turtle Beach MultiSound audio device driver in the Linux kernel contained race conditions when fetching from the ring-buffer, leading to an out-of-bounds access. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-…

Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in the guest. (CVE-202…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - GPU drivers; - Ethernet bonding driver; - Network drivers; - F2FS file system; - Tracing infrastructure; - Networking core;…

Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in the guest. (CVE-202…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - USB Gadget drivers; - Memory management; - Network file systems library; - Networking core; - Stream parser; - ARM32 archit…

Qt5 - QtDeclarative component. Security Fix(es): * qt5-qtdeclarative: qt6-qtdeclarative: Improper validation of tag size in Text component parser (CVE-2025-12385) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the …

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any cha…

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security …

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es):…

It was discovered that HPLIP did not properly handle certain data, which could result in an out-of-bounds write. An attacker could possibly use this issue to cause a denial of service, expose sensitive information or execute arbitrary code. (CVE-2026-91097) It was discovered that HPLIP did not properly handle certa…

It was discovered that GStreamer Good Plugins did not properly handle certain network streams. A remote attacker could possibly use this issue to cause an application crash or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-3083, CVE-2026-3085) It…

USN-8946-1 fixed vulnerabilities in Unbound in Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS. This update provides the corresponding update for Ubuntu 26.10. Original advisory details: It was discovered that Unbound incorrectly han…

It was discovered that the ca-certificates-java JKS handling was not working properly in certain system languages, resulting in CA certificates removed from the system bundle not being removed from the JKS keystore. This update corrects the feature and resyncs the keystore with the system CA certificates list.

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631) For more details about the security issue(s), including the impact, a …

It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585)…

It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585)…

It was discovered that libnfs did not properly enforce the maximum size bound during ZDR decoding, resulting in an out-of-bounds write. An attacker could possibly use this issue to cause libnfs to crash, resulting in a denial of service, or execute arbitrary code.

It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code.

USN-9001-1 fixed a vulnerability in ca-certificates, ca-certificates-java. This update provides the corresponding fix for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that the ca-certificates JKS integration was not working properly, resulting in CA certificates removed fro…

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359) * chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-85049) * chromium-browser: skia…

Security fixes: - Fix open redirect via IMAP error recovery on attachment get, reported by Santhoshkumar S. - Fix so Received: header includes only trusted hostname and forwarded IP from a trusted proxy, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5. - Fix bug where some managesieve destructive actions could have bee…

The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fix(es): * util-linux: util-linux: heap use-after-free in libblkid nested partition probing…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929) * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228) * kernel: ipvs: clear the svc schedule…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Kernel: Denial of Service in network socket error handling (CVE-2026-22977) * kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (CVE-2026-46174) * kernel:…

Messenger template edits preserved Updates to the cpanel-csf package no longer overwrite your local edits to the CSF Messenger v1 templates (index.html, index.recaptcha.html, and index.text in the /usr/local/csf/messenger directory). For a full list of changes, read the ConfigServer Security & Firewall (CSF) cha…

USN-8952-1 fixed vulnerabilities in Tornado. Unfortunately that update was incomplete due to an incomplete fix for CVE-2026-103263, which broke static file serving for applications that subclass Tornado's StaticFileHandler, such as Jupyter, and could introduce a regression. This update fixes the problem. We apologi…

It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585)…

It was discovered that the io_uring subsystem in the Linux kernel did not properly handle canceled task work when processing certain wait operations, leading to the operation being performed in the wrong task context. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2026-810…

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firefox: Sandbox escape in the Profile Backup compo…

SituationA security vulnerability was discovered in Plesk's Site Import extension. This security vulnerability has been identified as CVE-2026-107246.Affected product version Product / Component Affected versions Patched versions Site Import extension 1.13.1 and earlier 1.13.2 ImpactArbitrary code execution as t…

It was discovered that the ca-certificates JKS integration was not working properly, resulting in CA certificates removed from the system bundle not being removed from the JKS keystore. This update corrects the feature and resyncs the keystore with the system CA certificates list.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: gimp: heap out-…

USN-7230-2 fixed vulnerabilities in FRR. Unfortunately, the fix for CVE-2024-55553 introduced a regression in RPKI support, causing FRR to stop processing RPKI updates after the first one, so routes were not revalidated when RPKI data changed. In Ubuntu 20.04 LTS, the BGP daemon also failed to start when the RPKI mo…

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323) * firefox: thunderbird: Information disclosure due to incorrect boun…

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-20…

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator e…

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK con…

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia (CVE-2023-4860) * chromium-browser: angle: Out of bounds memory access in ANGLE (CVE-2024-7532) * chromium-browse…

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-20…

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The m…

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. Security Fix(es): * frr: denial of service via crafted FlowSpec component (CVE-2026-37457) * frr: denial of service via crafted BGP UPDATE message (CVE…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378) * kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222) * …

USN-7530-1 fixed a vulnerability in ADOdb. This update provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. Original advisory details: It was discovered that ADOdb incorrectly handled SQL input. A remote attacker could use this issue…

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * dnspytho…

Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples. Security Fix(es): * raptor2: raptor2: arbitrary code execution via heap-based buffer overflow in language tag handling (CVE-2025-71436) For more details about the secur…

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-10…

Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handlin…

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: GIMP: heap buff…

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in gues…

The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space. Security Fix(es): * dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561) * dpdk: dpdk: Control-queue descriptor dou…

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handlin…

[td]URGENT — Security Advisory[/td]A critical vulnerability has been identified in LSQUIC, the QUIC and HTTP/3 library used in LiteSpeed Web Server (LSWS), OpenLiteSpeed (OLS), and LiteSpeed Web ADC (LSADC). This advisory also covers a separate vulnerability in the LiteSpeed Cache module for PrestaShop. See the seco…

It was discovered that Twisted's IMAP server mishandled wildcard patterns in mailbox list commands. An authenticated remote attacker could possibly use this issue to cause Twisted to use excessive resources, leading to a denial of service.

It was discovered that Pillow incorrectly handled map stride values when loading certain McIdas AREA images. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-54058) It was discovered that Pillow did not properly check for decompression bombs when proc…

It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches.

It was discovered that Net-SNMP incorrectly handled newly accepted connections in the SMUX module. An unauthenticated remote attacker could possibly use this issue to cause Net-SNMP to block indefinitely, resulting in a denial of service.

Max Justicz discovered that APT incorrectly handled hard links when encountering redirects and retrying package downloads. A remote on-path attacker could possibly use this issue to trick APT into installing an unverified package and achieve remote code execution with root privileges.

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-85049) * chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability (CVE-2026-91747) …

A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005. Security Fix(es): * tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data …

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678) * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: USB: serial: mxuport: fix me…

It was discovered that libmspack did not properly initialize pointers when handling errors while reading KWAJ archive headers. An attacker could possibly use this issue to cause libmspack to crash, resulting in a denial of service, or execute arbitrary code.

It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. (CVE-2026-110353) It was discovered that HAProxy incorrectly handled certain HTTP/1.1 chunked requests…

It was discovered that GNOME Shell did not properly validate icon dimensions when processing icons from a remote search provider. An attacker could possibly use this issue to cause GNOME Shell to crash, resulting in a denial of service, or expose sensitive information from memory.

It was discovered that GVfs did not properly validate data returned by an SFTP server. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-84267) It was discovered that GVfs did not properly validate the size of replies from an AFP server. A remote attacker could possibly use …

It was discovered that Bind incorrectly handled certain DNS messages with repeated singleton records such as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use excessive memory, leading to a denial of service. This issue only affected Ubuntu 26.10. (CVE-2026-75029) It…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205) Several security issues were discovered in the Linux kernel…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205) It was discovered that the i.MX clock driver in the Linux k…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - USB Gadget drivers; - Memory management; - Multiple devices driver; - ARM64 architecture; - EROFS file system; - Networking…

It was discovered that the Bluetooth subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3640) Several security issues were discovered in the Linux kernel. An attacker could …

Jürgen Groß discovered that the Xen network backend driver in the Linux kernel did not adequately limit the amount of queued packets when a guest did not process them. An attacker in a guest VM can use this to cause a denial of service (excessive kernel memory consumption) in the network backend domain.

he perl-YAML package provides the pure-Perl implementation of the YAML (YAML Ain't Markup Language) data serialization standard. It allows developers to serialize Perl data structures into formatted YAML text and deserialize YAML data back into native Perl structures, making it widely used for configuration files, d…

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573) * qt5-qtbase: qt6-qtbas…

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handlin…

It was discovered that libvips incorrectly handled certain PDF files with a page that defines a width but not a height. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, …

It was discovered that SOGo used the client-supplied Origin header when constructing password reset links. A remote attacker could possibly use this issue to obtain password reset tokens and take over user accounts.

It was discovered that the shpsort utility in Shapelib incorrectly handled certain inputs, leading to a double free. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code.

It was discovered that rxvt-unicode incorrectly handled certain escape sequences. An attacker could possibly use this issue to execute arbitrary code if a user displayed specially crafted text in the terminal.

It was discovered that Sprockets incorrectly handled certain specially crafted requests when the Sprockets server was used in production. A remote attacker could possibly use this issue to access files outside of the application's root directory.

It was discovered that Relax-and-Recover created a world-readable initrd when GRUB_RESCUE was enabled. A local attacker could possibly use this issue to obtain sensitive information.

It was discovered that libuser did not properly validate the GECOS field when changing user information. A local attacker could possibly use this issue to corrupt the passwd file, resulting in a denial of service. (CVE-2015-3245) It was discovered that libuser modified the passwd file in place when updating user in…

Dawid Golunski discovered that Swift Mailer did not properly sanitize e-mail addresses in the mail transport. A remote attacker could possibly use this issue to pass extra parameters to the mail command and execute arbitrary code.

It was discovered that Net::EasyTCP used the built-in Perl rand() function to generate encryption keys when no strong randomization module was present. An attacker could possibly use this issue to predict the keys and obtain sensitive information.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Bug Fix(es) and Enhancement(s): * gfs2: gfs2_glock_hold() assertion failure [AlmaLinux-8] (JIRA:RHEL-291229)

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector (CVE-2026-95387) For more details about the security issue(s), includ…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924) * kernel: ipv6: exthdrs: refresh nh after handling HAO option …

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related …

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pyjwt: P…

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) * firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109764) * firefox: Spoofing issue in the DOM: Web Serial component (CVE-2026-10…

The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fix(es): * util-linux: TOCTOU in the mount program when setting up loop devices (CVE-2026-2…

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: Reintroduction of .charkeys -dSAFER bypass in AlmaLinux 8 (CVE-2026-112177) For…

X.Org X11 libXi runtime library Security Fix(es): * libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply (CVE-2026-109090) * libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow (CVE-2026-109089) For more details about the security issue(s), includin…

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK con…

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N]…

Server Check cleanup Server Check no longer runs the obsolete cPAddons notification checks. For a full list of changes, read the ConfigServer Security & Firewall (CSF) change log.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202) * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264) * kernel: scsi: tar…

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK con…

GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker. Security Fix(es): * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658) For more details about the security issue(s), including the …

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pillow: …

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token P…

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): *…

Expat is a C library for parsing XML documents. Security Fix(es): * expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633) * expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214) For more details about the security issue(s), in…

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Security Fix(es): * com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425) * com.fasterxml.j…

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance PKCS5 padding (CVE-2026-83374) * JDK: Enhance TLS certificate handling (CVE-2026-83376) * JDK: Enhance LDAP logins (CVE-2026-83380) * JDK: Enha…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288) * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72…

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encrypti…

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772) * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754) * firefox: thunderbird: Spoofi…

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, uni…

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance PKCS5 padding (CVE-2026-83374) * JDK: Enhance TLS certificate handling (CVE-2026-83376) * JDK: Improve C2 loop transformations (CVE-2026-83378) * JD…

CJose is C library implementing the Javascript Object Signing and Encryption (JOSE). Security Fix(es): * cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service (CVE-2026-53938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgment…

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) Bug Fix(es) and Enhancement(s): * Thunderbird ESR 153 rebase [rhel-10.2.z] (JIRA:RHEL-175207) For more details about the security issue(s), including …

It was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could possibly use this issue to execute arbitrary code. The fix for this CVE was originally released via USN-8942-1, but it was found to be incomplete. This issue only affected dotnet10 and dotnet11. (…

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911) * brace-expansion: brace-expansion: Denial of Service vi…

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) * curl: libcurl: Unauthorized con…

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: angle: Use after free in ANGLE (CVE-2026-95325) * chromium-browser: angle: Out of bounds write in ANGLE (CVE-2026-95331) * chromium-browser: angle: Out of bounds read in ANGLE (CVE…

X.Org X11 libXtst runtime library Security Fix(es): * libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser (CVE-2026-94286) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s)…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: net: shaper: rework the VALID markin…

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: GNU Emacs: Arbitrary code execution upon opening a file (CVE-2026-96269) For more details abou…

This security release features fixes for multiple issues. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.4 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that su…

SituationThere are reports of a two-factor authentication (2FA) bypass in phpMyAdmin 5.2.3. It affects WebAuthn (security key) 2FA in installations that do not include the web-auth/webauthn-lib library.ImpactNone to Plesk servers.This affects phpMyAdmin's own two-factor authentication when the web-auth/webauthn-lib …

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3:…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udp: Deal with race between UDP socket address change and rehash (CVE-2024-57974) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: net/handshake: h…

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395) * net/[http:](http:) g…

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3:…

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both…

Ali Mashally discovered that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly use this issue to gain access to another user's local account and files, resulting in unauthorized access to sensitive information.

X.Org X11 libXrender runtime library Security Fix(es): * libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pag…

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442) For more details about the se…

xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts. Security Fix(es): * xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox es…

USN-8956-1 fixed a vulnerability in Brotli. This update provides the corresponding fixes for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. Original advisory details: It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause …

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrus…

The libX11 packages contain the core X11 protocol client library. Security Fix(es): * libX11: libX11: Heap-based buffer overflow via malicious X server (CVE-2026-88806) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to…

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-9351…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nvme: avoid double free special payload (CVE-2024-41073) * kernel: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (CVE-2025-40252) * kernel: crypto: …

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Security Fix(es): * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261) Bug Fix(es) and Enhancement(s): * [AlmaLinux8][tracker] Rebase Galera to 26.4.27 MariaDB:10.11 …

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300) * kernel: Read root-owned fil…

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-92035) * firefox: thunderbird: Use-after-free in the Graphics: Ca…

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22…

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: Node.js: Remote memory exhaustion v…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: mm/slub: avoid accessing metadata when pointer is invalid in object_err() (CVE-2025-39902) * kernel: drm/amdkfd: Fix out-of-bounds write…

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * crypto/x509: golang: golang crypto/x509: Denia…

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (C…

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fix(es): * DBI: DBI: Buffer overflow in error ha…

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: group policy certificate enrollment uses without val…

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28946) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process …

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum valida…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981) * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (C…

It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176) It was discovered that nginx incorrect…

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es…

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023) * flatpak: flatpak: Arbitrary write in root context via path …

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: writeback: fix race between cgroup_w…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236) * kernel: fuse: re-lock request before replacing page cache folio (CVE-202…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063) * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147) * kernel: ALSA: hda/cs…

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: …

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183) * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range he…

Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fix(es): * lrzsz: lrzsz: Arbitrary file overwrite via absolute …

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads (CVE-2026-42127) For more details about the security issue(s), including the …

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456) * openssl: Q…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233) * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206) * kernel: drm/amdgpu: Ref…

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash v…

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338) * undici: undici: Denial of Service due to …

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrit…

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734) For more details about the security issue(s), including the impact, a CVSS sc…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) * kernel: libceph: make de…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68…

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) * golang: internal/sysc…

The golang packages provide the Go programming language compiler. Security Fix(es): * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), includ…

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Security Fix(es): * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490) * mariadb: MariaDB Server Crash Due to Empty Backtrace Log (CVE-2023-52969) * mariadb: MariaDB Serv…

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es…

OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications looking to use the Container Pod concept popularized by Kubernetes. Security Fix(es): * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vuln…

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183) * net/textproto: mime/multipart: golang: golang: Denial of Service via memory li…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860) * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856) * kerne…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206) * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-20…

X.Org X11 libXfont2 runtime library Security Fix(es): * libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001) * libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgment…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113) * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147) * kernel: fl…

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) * httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) * httpd: Apache HTTP Server: Heap-based Buffe…

Certificate revocation bypass due to improper OCSP response validation

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603) * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: cr…

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (C…

Hi All, A new CVE-2026-116149, a high-severity stack buffer overflow in ImageMagick when processing specially crafted bzip2-compressed images. Affected versions: ImageMagick before 6.9.13-58 ImageMagick 7.x before 7.1.2-33 This could potentially affect DirectAdmin servers using the PHP imagick extension. Could …

SAC is a standard interface for CSS parsers, intended to work with CSS1, CSS2, CSS3 and other CSS derived languages. Security Fix(es): * libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274) * libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276) …

AlmaLinux 10 kernel update to 6.12.0-211.68.1.el10_2 fixes 18 security vulnerabilities (CVE-2025-38147 and seventeen 2026 CVEs) across networking, filesystem and driver code. Rated Important. Update the kernel and reboot.

Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through

Open-source vector similarity search for Postgres. Supports L2 distance, inner product, and cosine distance Security Fix(es): * pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build (CVE-2026-103484) For more details about the security issue(s), including the impac…

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls:…

SituationA security vulnerability was found in PHP and has been assigned CVE-2026-115560. For more information, you can find the official announcement here:PHP News Archive | 23 Oct 2026  Affected product versionUnknown at this time, as a full security advisory has not been released. ImpactPHP news archive indicates…

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in

The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during

Buffer overflow in the Google Brotli decoder (1.0.3-1.2.0), bundled by Node.js: a crafted Brotli stream allows a remote unauthenticated attacker to corrupt memory, disclose memory contents, cause DoS or potentially execute arbitrary code. Fixed in Brotli 1.0.10/1.1.1 and Node.js 22.23.4.

@DirectAdmin Support, Could you please investigate the following security vulnerability and check whether it affects DirectAdmin or any of its supported configurations? https://kb.isc.org/docs/cve-2026-94300 Most likely it will be a distro distributed package i believe but just to bring it to your attention.

Security and maintenance updates We released updated packages for EasyApache 4. This security release fixes two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in ea-php74 through ea-php85. It also patches ea-libcurl for 14 vulnerabilities, including CVE-2026-92392 (high), updates ea-nginx to 1.31…

Security and maintenance updates We released updated packages for EasyApache 4. This security release updates ea-nodejs22 to 22.23.4, which fixes seven vulnerabilities, including CVE-2026-111497, CVE-2026-105482 and CVE-2026-106069 (high). It also rebuilds the ea-php74, ea-php80 and ea-php81 meta packages so their c…

The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application f…

Internal case: CPANEL-57887 Original ticket: #96098463 SituationMultiple security vulnerabilities were disclosed in Node.js in the October 2026 Node.js security releases. The ea-nodejs22 package bundled with cPanel & WHM is affected. Node.js assigned the following CVEs: CVE-2026-105482 (high): dns.resolve trunca…

SituationA security vulnerability was discovered in Roundcube Webmail, which is shipped with Plesk for Linux, that allows an authenticated user to inject IMAP commands. This security vulnerability has been identified as CVE-2026-113386.Affected product version Product Affected versions Patched versions Plesk for …

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. A quoted key of 24 or

Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. With utf8 and allow_barekey, which relaxed enables, a quoted key is

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. With allow_bignum, a JSON number with a fraction or exponent decodes

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. With dupkeys_as_arrayref, the values of a duplicate object key are collected

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse. The parser appends each chunk to its buffer. In scalar or list context,

Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv. With canonical, the keys of a

Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parser object holds its callbacks and its incremental parse

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. allow_nonref is enabled by default and incr_parse inherits it. A

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. encode_stringify writes a value in its string form under

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, a tagged value's class name and argument

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the

Security fixes: - Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/viewsource action, reported by Wahab "NeoX" K. - Fix bug where an alias login wasn't qualified by IMAP host, reported by Milan Hoppe. - Add a size limit to the CSS proxy content processing, reported by …

SymptomsRoundcube released a security update on October 19th, 2026 in v1.6.20.CauseRoundcube versions prior to 1.6.20 and 1.7.5 have security vulnerabilities, and an internal case, CPANEL-57939, has been opened for the development team to review and address this.ResolutionAt this time, this security update is now av…

SituationA security vulnerability was discovered which allows the calendar and contact data of a mail account to be retrieved without any credentials.Affected product version Product Affected versions Patched versions cPanel & WHM v124 and later 134.0.67 or later 136.0.51 or later 138.0.19 or later Im…

SituationA security vulnerability was discovered in cPanel & WHM, which allows a user to direct a root-privileged process into writing a file to a location of the reseller's choosing.Affected product version Product Affected versions Patched versions cPanel & WHM v78 and later 110.0.154 or later 134…

Get patching! https://www.cve.org/CVERecord?id=CVE-2026-99999 https://pwn.ai/blog/pwnescape

A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.

Security and maintenance updates We released updated packages for EasyApache 4. This security release patches ea-libcurl for six vulnerabilities (CVE-2025-14524, CVE-2025-14819, CVE-2026-5773, CVE-2026-18924, CVE-2026-80230 and CVE-2026-80255). The release also updates ea-libzip to 1.12 and ea-tomcat101 to 10.1.61. …

SituationA security vulnerability was discovered in WP Toolkit, which is provided with cPanel & WHM. This security vulnerability has been identified as CVE-2026-107663.Affected product version Product Affected versions Patched versions WP Toolkit on cPanel & WHM 6.11.4 and earlier 6.11.5 ImpactAn authent…

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.

Firewall and Messenger reliability fixes Package upgrades no longer leave the firewall unloaded. CSF Messenger now removes its web server configuration and reports an error if the web server fails to restart with it, instead of leaving the web server down. The csf --mregen command now writes the server hostname into…

Security and maintenance updates We released updated packages for EasyApache 4. This security release updates ea-apache24-mod_security2 to 2.9.15. This version fixes five vulnerabilities (CVE-2026-61812, CVE-2026-61813, CVE-2026-73857, CVE-2026-104259 and CVE-2026-104269). The release also patches ea-openssl11 for f…

This security and maintenance release features 7 security fixes and 4 bug fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If…

Security and maintenance updates We released updated packages for EasyApache 4. This security release updates ea-apache24 to Apache HTTP Server 2.4.69, which fixes twenty vulnerabilities (CVE-2026-42356, CVE-2026-42528, CVE-2026-46729, CVE-2026-47360, CVE-2026-48005, CVE-2026-56153, CVE-2026-56154, CVE-2026-56449, C…

WHMCS-22707 — Undisclosed Security Fix

Security and maintenance updates We released updated packages for EasyApache 4. This security release updates ea-php82 to 8.2.34, ea-php83 to 8.3.35, ea-php84 to 8.4.26 and ea-php85 to 8.5.11, which fix eleven vulnerabilities (CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-17545, CVE-2026-91765, CVE-2026-917…

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."

Harden iptables command For a full list of changes, read the ConfigServer Security & Firewall (CSF) change log.

Security update Sitejet Builder ships with an updated build-time library to resolve CVE-2026-40175. For a full list of changes, read the Sitejet Builder change log.

Security and maintenance updates We released updated packages for EasyApache 4. This release updates ea-nginx to 1.31.6, which includes the upstream fix for CVE-2026-90439, a buffer overflow in the ngx_http_v3_module module. EasyApache 4 does not build that module, so EasyApache 4 installations are not affected. It …

Security and maintenance updates We released updated packages for EasyApache 4. This security release updates ea-libxml2 to 2.15.4, which fixes eight vulnerabilities (CVE-2026-86137, CVE-2026-86138, CVE-2026-86139, CVE-2026-86140, CVE-2026-86141, CVE-2026-86142, CVE-2026-86143 and CVE-2026-86144), and patches ea-rub…

Maintenance and security updates We released updated packages for EasyApache 4. This release patches ea-openssl11 on CentOS 7 for a heap buffer overflow in CMS key unwrapping (CVE-2026-63072) and excessive memory use when buffering DTLS records (CVE-2026-54874). It also updates ea-re2c to v4.6 and fixes three ea-pod…

Maintenance and security updates We released updated packages for EasyApache 4. This release updates ea-nginx to v1.31.4, which adds PROXY protocol version 2 support to the stream and mail modules, sends the ":authority" pseudo-header on HTTP/2 and gRPC requests to backends, and fixes a worker-process segm…

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. 

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface. 

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface. 

Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.

# cPanel updates automatically; run manually to patch now
/usr/local/cpanel/scripts/upcp --force
# The update also repairs calendar and contact permissions for existing accounts
cat /usr/local/cpanel/version

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

# WP Toolkit (package wp-toolkit-cpanel) updates independently of cPanel & WHM
bash <(curl -SsL https://wp-toolkit.plesk.com/cPanel/installer.sh || wget -qO- https://wp-toolkit.plesk.com/cPanel/installer.sh) --version 6.11.3

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API".

plesk installer --select-release-current --reinstall-patch
plesk version

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

# Update the Site Import extension to 1.12.2 or later
# Plesk → Extensions → Updates → Site Import → Update

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.

# cPanel updates automatically; run manually to patch now
/usr/local/cpanel/scripts/upcp --force
# The update also repairs calendar and contact permissions for existing accounts
cat /usr/local/cpanel/version

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root.

yum update virtualizor
# Or in the admin panel: Config → Check for Updates → Update Now

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects.

yum update virtualizor
# Or in the admin panel: Config → Check for Updates → Update Now

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by.

yum update virtualizor
# Or in the admin panel: Config → Check for Updates → Update Now

This security release features a fix for a critical severity security vulnerability. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”…

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and.

wp plugin update litespeed-cache
# or: WordPress → Plugins → LiteSpeed Cache → Update Now
wp plugin get litespeed-cache --field=version

The pure-Perl implementation of Mojo::JSON in Mojolicious before 9.47 does not limit JSON nesting depth, allowing a small, deeply nested JSON document to trigger unbounded recursion, memory exhaustion, and a process crash. The path is only used when Cpanel::JSON::XS is not installed or MOJO_NO_JSON_XS is set — the Cpanel::JSON::XS fast path already enforces a nesting limit and is not affected.

perl -MCpanel::JSON::XS -e 'print "fast path OKn"'
# cPanel ships the affected fast path by default — if the check above prints "fast path OK", you are not exposed on cPanel's own stack.
# If it errors, or MOJO_NO_JSON_XS is set, update the Perl Mojo stack:
cpanm [email protected]

cpanm [email protected]
perl -MMojo::JSON -e 'print Mojo::JSON->VERSION, "n"'

Dear Exim users, The Exim maintainers are releasing a security fix for four security issues. * GCVE-25-2026-09-50-1 * GCVE-25-2026-09-51-1 * GCVE-25-2026-09-55-1 * GCVE-25-2026-09-56-1 ---- Title: Exim Security Advisory for EXIM-Security-2026-09-12.1 / GCVE-25-2026-09-50-1 Announced: 2026-09-18 Affects: Ex…

Hello, Got an email today: URGENT — Security Advisory​A critical privilege-escalation vulnerability has been identified in LiteSpeed Web Server Enterprise. On shared-hosting servers, a malicious low-privilege website user could potentially gain root-level access to the server. This could a…

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux).

# WHM → Plugins → Marketplace → Installed → Acronis Backup → Update (≥ 1.9.3.1021)
# Plesk → Extensions → Updates → Acronis Backup → Update (≥ 1.8.11.638)

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization.

# Update the Paid Downloads plugin to the latest WordPress.org release
wp plugin update --all

This security and maintenance release features 17 bug fixes on Core, 19 bug fixes for the Block Editor, and 11 security fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.1 from WordPress.org, or visit your WordPress Dashboard, cl…

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

# Update the Ruby extension stack to the patched release
# Plesk → Extensions → Updates → apply pending updates

Situation We have received notice that a critical privilege-escalation vulnerability has been identified in LiteSpeed Web Server Enterprise. On shared-hosting servers, a malicious low-privilege website user could potentially gain root-level access to the server.   This could allow an attacker to access or alter othe…

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.

A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.

SituationA vulnerability was found in the advanced-rule parser in the ConfigServer Security & Firewall (CSF) software which could allow a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root.Note: By default, no remote allow/deny feed is configured.Affected Product vers…

sudo yum update

sudo dnf update

SituationA vulnerability was found in the MESSENGER service in the ConfigServer Security & Firewall (CSF) software which could allow an unauthenticated remote attacker to execute arbitrary commands as the CSF service account.Note: By default, the MESSENGER service is disabled.Affected Product versions Prod…

sudo yum update

sudo dnf update

CloudLinux specific take on it: bridge-stp-uaf (CVE-2026-72389) local root vulnerability: kernel update and mitigation for CloudLinux - CloudLinux 📋 TL;DR — last updated September 10, 2026, 16:20 UTC bridge-stp-uaf (CVE-2026-72389, C…

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects

Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Input Data Manipulation. This issue.

# Replace the PayTR Virtual POS iFrame module with v9.0.3 from the vendor
# WHMCS → Setup → Payment Gateways → confirm the module version

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual.

# Replace the PayTR Virtual POS iFrame module with v9.0.3 from the vendor
# WHMCS → Setup → Payment Gateways → confirm the module version

Unauthenticated Remote Code Execution (CVE-2026-67399)

Improved security around email previews

Undisclosed Security Fix

Undisclosed Security Fix

Client Area Authorization Bypass (CVE-2026-29204)

Undisclosed Security Fix

Honour parent theme definition for captcha.tpl on Login as Owner link

Correct bulk removal of IPs on Security tab of General Settings

Unauthenticated Remote Code Execution (CVE-2026-67399)

Improved security around email previews

Undisclosed Security Fix

Undisclosed Security Fix

Client Area Authorization Bypass (CVE-2026-29204)

Undisclosed Security Fix

Add clarifying messaging on Integration Links regarding Captcha

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify configuration options of third-party plugins including ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding. Exploitation requires the respective third-party plugins to be installed, as the impact against those plugins' settings is only reachable when those plugins are present.

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A comment payload crafted exclusively from decimal numeric character references (e.g. ", <, >) placed inside an allowed element such as <code> bypasses WordPress's wp_kses sanitization, as kses does not treat a data-settings="..." substring within text content as an HTML attribute, allowing the malicious payload to reach the vulnerable function. For this to be exploitable, the site must allow users with previously approved comments to write new comments, and the require_name_email setting must be disabled.

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted `` tag attributes in all versions up to, and including, 7.7. This is due to a

A security vulnerability has been discovered in Phusion Passenger's Watchdog API.

sudo yum update

sudo dnf update

A local user's .forward file can trigger unsafe string expansion in Exim's redirect router, allowing command injection under certain pipe transport configurations. 

A privilege escalation vulnerability exists in cPanel & WHM's database management functionality. 

A vulnerability in the cPanel web server allows manipulation of cpsrvd responses under limited conditions.

WordPress recently announced a few vulnerabilities that were fixed.

Security vulnerabilities tied to the ea-nginx ngx_http_rewrite_module (CVE-2026-9256) have been discovered.

An unauthenticated endpoint in cpsrvd was found that could allow the insertion of arbitrary HTTP headers. This affects cPanel & WHM versions 132 and higher.

An unsafe symlink handling error was found that allows a user to chmod an arbitrary file, allowing for denial of service and possible privilege escalation.

Apache HTTP Server: http2: Double Free and possible RCE on early reset (CVE-2026-23918). Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.

An authentication bypass security issue has been identified in the cPanel software (including DNSOnly) affecting all versions after 11.40.We would like to thank Sybre Waaijer for helping to identify and responsibly report this vulnerability to us.

sudo yum update

An authenticated cPanel account holder with mail-related privileges can create arbitrary files on the server through cPanel's EmailTrack functionality.

A vulnerability was found in the MESSENGER service in the ConfigServer Firewall (CSF) software which could allow for unauthorized code execution.

sudo yum update

sudo dnf update

An authenticated cPanel account holder who is able to add parked or addon domains can create arbitrary files on the server.

Multiple vulnerabilities were found in the ConfigServer Firewall plugin.

sudo yum update

sudo dnf update

Argument injection vulnerability in WP Toolkit before version 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.

A combination of two vulnerabilities in the LiteSpeed cPanel plugin allowed an authenticated cPanel user to escalate privileges to root, including on servers running CloudLinux and CageFS.

Security vulnerabilities tied to ea-nginx-njs(CVE-2026-8711) and ea-memcached16(CVE-2026-47783, CVE-2026-47784) have been discovered.

An upstream vulnerability was recently reported for Unbound that affects supported cPanel & WHM versions 126 and higher.

A security vulnerability was found in the plugin provided by LiteSpeed that allowed unauthorized root access to the server.

A vulnerability has been reported that currently affects cPanel & WHM versions 132 and higher.

This security release addresses vulnerabilities across multiple versions of cPanel & WHM, including fixes for several vulnerabilities rated up to High severity.

It was found that SSL verification was not fully enforced in the DNS Cluster system, which could allow for a malicious server to man-in-the-middle the request and capture credentials. This affects cPanel & WHM versions 126 and higher.

It was found that a low-privilege team user (role=default) can escalate to the owner account's full capabilities through the use of certain UAPI modules. This affects cPanel & WHM versions 110 and higher.

It was found that, as part of the sqloptimizer script, it was possible that a created SQL query could be injected with arbitrary SQL queries. This affects all cPanel & WHM versions.

Through a combination of incorrect dropping of privileges and insufficient path filtering, it was possible to read arbitrary files via certain cpdavd endpoints. This affects cPanel & WHM versions 120 and higher.

The vulnerability, tracked as CVE-2026-45185, aka Dead.Letter, has been described as a use-after-free vulnerability in Exim's binary data transmission (BDAT) message body parsing when a TLS connection is handled by GnuTLS.

A Perl code injection method was found in the create_user API call, relating to the plugin parameter.

An arbitrary file read found was found in the feature::LOADFEATUREFILE adminbin call where it does not adequately validate the feature file name. A relative path may be passed as the argument to this call, causing an arbitrary file to be made world-readable.

Several security vulnerabilities were reported in Exim, impacting versions prior to 4.99.2:

An escalation-of-privilege bug in various modules in Apache HTTP Server 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user. 

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.

plesk installer --select-release-current --reinstall-patch
plesk version

Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache.

wp plugin update litespeed-cache
# or: WordPress → Plugins → LiteSpeed Cache → Update Now
wp plugin get litespeed-cache --field=version

Targeted Security Release For a full list of changes, read the ConfigServer Security & Firewall (CSF) change log.

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a.

wp plugin update jetbackup
# or: WordPress → Plugins → JetBackup → Update to 3.1.23.5

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a.

plesk installer --select-release-current --reinstall-patch
plesk version

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader (CVE-2026-27820) * net-imap: Net::IMAP: Arbitrary IMAP command inj…

sudo dnf update

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource ex…

sudo dnf update

USN-8555-1 fixed vulnerabilities in Ubuntu Advantage Tools. On Ubuntu 14.04 LTS only, it was discovered that some machines were unable to enable esm-infra-legacy due to a preemptive apt-helper check. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Bilal Teke discover…

Security and maintenance updates We released updated packages for EasyApache 4. This security release hardens the Phusion Passenger agent API authorization boundary so an empty API account database confers no privileges, resolving a local privilege escalation in the Passenger Watchdog API (SEC-75753). The fix is app…

It was discovered that primitive decoders in openCryptoki produced integer underflows when the encoded length was zero. An attacker could possibly use this issue to trigger out-of-bounds reads. (CVE-2026-40253) It was discovered that openCryptoki incorrectly handled symlinks. An attacker in the token-group could po…

sudo apt update && sudo apt upgrade

Dovecot v2.4.5 released ref.: https://github.com/dovecot/core/releases/tag/2.4.5 https://dovecot.org/releases/2.4/

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is.

wp plugin update jetbackup
# or: WordPress → Plugins → JetBackup → Update to 3.1.23.5

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases.

plesk installer --select-release-current --reinstall-patch
plesk version

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.

plesk installer --select-release-current --reinstall-patch
plesk version

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.

# Update the Migrator extension to 2.36.0 and Site Import to 1.12.1
# Plesk → Extensions → Updates → apply pending updates

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202) * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264) Bug Fix(es) and Enh…

sudo dnf update

RtabRace (CVE-2026-68138) is a Linux kernel race in the traffic-control subsystem that lets an unprivileged local user corrupt kernel memory. On CloudLinux the reliably reachable result is a host crash, and CloudLinux 8 and CloudLinux 7 Hybrid ship exposed. Here is how to check whether a server is exposed and what t…

sudo yum update

sudo dnf update

sudo apt update && sudo apt upgrade

https://support.cpanel.net/hc/en-us/articles/42503837957015-Security-CSF-Security-Release Since DirectAdmin maintains its own CSF ‘fork’ and quite a lot of DirectAdmin servers are still running CSF, is DA aware of these vulnerabilities and are there plans to release fixes for the DirectAdmin version?

BadGarbage (CVE-2026-53361) is a Linux kernel race condition that lets any local user, including a process inside a container, become root on the host. It affects CloudLinux 10 only. CloudLinux 7 through 9 are not affected. There is no runtime mitigation, so the fix is the patched kernel or a KernelCare livepatch. H…

sudo yum update

sudo dnf update

Maintenance and Security Release We released updated packages for EasyApache 4. This release resolves three PHP vulnerabilities across ea-php82, ea-php83, ea-php84, and ea-php85: a libgd vulnerability (CVE-2026-9672), a SQL injection via backslash breakout in PGSQL (CVE-2026-17543), and a crash via recursive symlink…

It was discovered that libgit2 incorrectly handled the Git Smart Protocol. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-10128) It was discovered that libgit2 incorrectly handled empty…

sudo apt update && sudo apt upgrade

WordPress 7.0.4 is now available WordPress 7.0.4 is now available which features a security fix. Because this is a security release, it is recommended that you update your sites immediately. You can update to WordPress 7.0.4 by downloading it from WordPress.org, or visiting your site’s Dashboard → Updates and …

Security updates 1.6.18 and 1.7.3 released ref.: https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3

Security fixes This security release resolves several vulnerabilities in CSF (CPANEL-54191, CPANEL-55183, CPANEL-54192, CPANEL-55265). It also includes several firewall reliability fixes for AlmaLinux 10, Debian, and Ubuntu. For a full list of changes, read the ConfigServer Security & Firewall (CSF) change log.

Faster site publishing Sitejet Builder now downloads website files in parallel when you publish a site. This reduces publish time for large sites. For a full list of changes, read the Sitejet Builder change log.

Introduced the Meridian interface We introduced Meridian, a new goal-based cPanel interface. Meridian organizes common hosting tasks into six purpose-built hubs for Websites, Email, Files, Databases, Security, and Performance. Its Dashboard highlights required actions, suggests relevant next steps, and provides an a…

Security Hotfix We released an updated ea-nginx package family (nginx 1.31.3) for EasyApache 4. This security release resolves three nginx vulnerabilities, including a critical heap buffer overflow in the map directive with regular expressions (CVE-2026-42533) that could allow remote code execution or a worker proce…

Maintenance updates We released updated packages for EasyApache 4. This maintenance release includes updates to ea-passenger-src (v6.1.8), ea-ruby27-passenger (v6.1.8), ea-redis62 (v6.2.23), ea-valkey72 (v7.2.14), ea-memcached16 (v1.6.45), and ea-podman (v1.0-23), plus companion rebuilds for ea-apache24-mod-passenge…

Stronger two-factor authentication for API requests We’ve added a Security Policy that closes a gap in API authentication: when it’s enabled alongside two-factor authentication (2FA), API requests can no longer skip 2FA protection. Once you turn on both settings, the system handles inbound API requests a…

Maintenance updates We released updated ea-tomcat101, ea-memcached16, ea-apache24-mod_security2, ea-modsec2-rules-owasp-crs, ea-ioncube15, ea-nodejs22, and Phusion Passenger 6.1.7 (ea-passenger-src, ea-ruby27-passenger, ea-apache24-mod-passenger, ea-nginx-passenger) packages for EasyApache 4. This maintenance releas…

Maintenance updates We released updated ea-modsec30, ea-modsec30-connector-apache24, and ea-modsec30-rules-owasp-crs packages for EasyApache 4. This maintenance release fixes ModSecurity audit logs silently failing to write across mod_ruid2 user IDs, forces a full Apache restart on package update so the updated libm…

Bug fixes This release fixes Comet Backup jobs failing en masse with locked-by-device retention errors on busy servers. The plugin now requests the less-often automatic-retention ruleset for dispatched backups and no longer cancels orphaned in-flight jobs, so overlapping retention passes cannot wedge the device.

Security hotfix We released updated ea-modsec30 and ea-modsec30-rules-owasp-crs packages for EasyApache 4. This security hotfix updates ea-modsec30 to 3.0.16, addressing two issues: CVE-2026-52747 (the multipart/form-data request body parser invalidly handled r and characters, allowing an unauthenticated WAF rule b…

Improved read-only API token enforcement Sitejet Builder UAPI methods are now classified as read-only for cPanel & WHM API token enforcement. For a full list of changes, read the Sitejet Builder change log.

Security and maintenance updates We released updated packages for EasyApache 4. This security release updates PHP 8.2, 8.3, 8.4, and 8.5 to address CVE-2026-14355 (a memory corruption issue in openssl_encrypt with AES-WRAP-PAD) and, for PHP 8.3, CVE-2026-12184 (a TLS setup failure leading to remote DoS). It also upd…

Security and maintenance updates We released an updated ea-tomcat101 package for EasyApache 4. This security release updates Apache Tomcat to 10.1.56, addressing six CVEs (CVE-2026-55956, CVE-2026-55955, CVE-2026-55276, CVE-2026-53434, CVE-2026-53404, CVE-2026-50229) with a top severity of Moderate. For a full list …

Maintenance updates We released updated packages for EasyApache 4. This maintenance release updates three nginx scripting and header modules: ea-nginx-echo to v0.65 (OOM safety fix), ea-nginx-headers-more to v0.40 (Content-Type charset parsing fix), and ea-nginx-njs to v1.0.0 (major version; includes security harden…

Bug fix We released a bug fix update for Site Quality Monitoring. * SQM-227: Fixed an infinite redirect loop and repeated authentication emails when re-opening Site Quality Monitoring from cPanel. For a full list of changes, read the Site Quality Monitoring change log.

Removed Sitejet AI promotional banner We removed the Sitejet AI promotional banner from the cPanel Tools page. This does not change Sitejet Builder functionality. For a full list of changes, read the Sitejet Builder change log.

Security updates We released updated packages for EasyApache 4. This security release updates ea-nginx from v1.31.1 to v1.31.2, addressing two CVEs from the nginx 2026-06-17 advisory: CVE-2026-42055 (Medium: buffer overflow in ngx_http_proxy_v2_module and ngx_http_grpc_module) and CVE-2026-48142 (Low: buffer over-re…

Security and maintenance updates We released updated packages for EasyApache 4. This security and maintenance release patches ea-openssl11 to 1.1.1w-8 (CentOS 7 only) with TuxCare/ELS backports addressing five CVEs including four High-severity issues (CVE-2026-45447, CVE-2026-34180, CVE-2026-7383, CVE-2026-9076). It…

AWS partner rollout Server Monitoring rollout for the AWS partner. For a full list of changes, read the Server Monitoring change log.

DigitalOcean partner rollout Server Monitoring rollout for the DigitalOcean partner. For a full list of changes, read the Server Monitoring change log.

Security and maintenance updates We released updated packages for EasyApache 4. This security and maintenance release updates ea-apache24 to v2.4.68, which addresses thirteen CVEs in the Apache HTTP Server including two critical mod_http2 issues (CVE-2026-49975, CVE-2026-48913). It also updates the Passenger ecosyst…

Google Cloud partner rollout Server Monitoring rollout for the Google Cloud partner. For a full list of changes, read the Server Monitoring change log.

Bug fixes This release fixes an issue where WebPros remote storage did not update after a Comet Backup license change, and enables cloud storage provisioning from the Destinations tab on storage-tier licenses with re-authentication resume.

Improved permission and domain-ownership validation Improve permission and domain-ownership validation for Sitejet actions. For a full list of changes, read the Sitejet Builder change log.

Bug fixes and improvements This release stops Comet backups from consuming all local disk space during a backup run, fixes restore backup options being hidden in the UI when no backup jobs exist, ensures the outbound User-Agent is not inherited from the parent process, removes the credentials download warning, and …

Security and maintenance updates We released updated packages for EasyApache 4. This security release patches CVE-2026-49975 in ea-apache24. Attackers can craft malicious HTTP/2 cookie headers that multiply across streams, consuming excessive memory. The fix makes cookie headers count against LimitRequestFields. Not…

Hotfix security release We released updated packages for EasyApache 4. This release addresses CVE-2026-9256 (nginx-poolslip), a critical remote code execution vulnerability affecting all nginx versions, fixed in ea-nginx 1.31.1. Phusion Passenger was also updated to version 6.1.3. For a full list of changes, read th…

Updated publish/polling access controls Improve Sitejet publish/polling access controls. For a full list of changes, read the Sitejet Builder change log.

Hotfix security release We released updated packages for EasyApache 4. This release addresses CVE-2026-8711 in ea-nginx-njs and CVE-2026-47783, CVE-2026-47784 in ea-memcached16. For a full list of changes, read the EasyApache 4 change log.