Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* python: python: Arbitrary file deletion via race condition during temporary directory cleanup (CVE-2026-12345)
* python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553)
* python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-1944
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
Security Fix(es):
* flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023)
* flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.
Security Fix(es):
* xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516)
* xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521)
* xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812)
* xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in P
The libX11 packages contain the core X11 protocol client library.
Security Fix(es):
* libX11: libX11: Heap-based buffer overflow via malicious X server (CVE-2026-88806)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries.
Security Fix(es):
* gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if (CVE-2026-102010)
* gcc: libstdc++ integer overflow in `new` operator (CVE-2026-95619)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Moderate: freeipmi security, bug fix, and enhancement update
The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.
Security Fix(es):
* FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504)
* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507)
* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506)
* FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509)
* FreeIPMI: FreeIPMI: Denial of Service via stack-ba
This update for python fixes the following issue:
- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free
(bsc#1283969).
Media · CVSS 6.3EPSS 0,39%Sin corrección publicada
Authentication bypass by spoofing in twofactor_gauthenticator
The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being bypassed.
This issue was fixed in commit 4640889.
Media · CVSS 6.3EPSS 0,35%Sin corrección publicada
Insufficient session expiration in twofactor_gauthenticator
The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code.
This issue was fixed in commit 4640889.
Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system.
This issue was fixed in commit 4640889.
llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader
llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and out-of-bounds reads by consumers.
llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader
llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggml_nbytes() and strides, causing out-of-bounds memory access when buffers are sized from wrapped byte counts.
llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer
llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids before the bytes_ buffer during model loading, causing crashes or potential code execution.
Media · CVSS 6.8EPSS 0,12%Sin corrección publicada
llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info
llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-server to read past id_to_token and crash.
llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs
llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and llama_encode_internal that allows remote unauthenticated attackers to read memory by supplying unvalidated token IDs. Attackers can send integer-array prompts to the llama-server /completion endpoint with IDs outside 0 to n_vocab to read embedding memory out of bounds or crash the process.
Media · CVSS 6.9EPSS 0,12%Sin corrección publicada
llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets
llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_model_loader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash the process or load adjacent process memory as model weights.
Tencent RapidJSON Regex stream.h Take out-of-bounds
A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream<UTF8<char>>::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.