Red Hat Security AdvisoryRHSA-2026:0414
A Subscription Management tool for finding and reporting Red Hat product usage
Released 2026-01-08 · Red Hat rating Important · View on Red Hat →
Fixes 20 records
Priority HIGH 66
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.
CVSS 3.1HIGH 7.1· Local · No auth · User interaction · EPSS 0.00278 · Published 2025-11-24 · Partial fix · 1.6.51 CWE-122
Priority MEDIUM 64
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.0038 · Published 2025-12-03 · Partial fix · 1.6.52 CWE-125
Priority MEDIUM 64
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00447 · Published 2025-11-24 · Partial fix · 1.6.51 CWE-125
Priority MEDIUM 55
A vulnerability was found in systemd-coredump.
CVSS 3.1MEDIUM 4.7· Local · Low privileges · No interaction · EPSS 0.01277 · Published 2025-05-30 · Partial fix · 252.37, 253.32 +12 CWE-364
Priority MEDIUM 53
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed…
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00466 · Published 2025-10-07 · Partial fix · 3.9.24, 3.10.19 +4 CWE-1285
Priority MEDIUM 52
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used.
CVSS 3.1LOW 3.6· Local · Low privileges · No interaction · EPSS 0.00463 · Published 2025-10-06 · Partial fix · 10.1 CWE-159
Priority MEDIUM 52
GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process.
CVSS 3.1MEDIUM 4.1· Local · No auth · User interaction · EPSS 0.0049 · Published 2025-07-11 · Partial fix CWE-24
Priority MEDIUM 46
urllib3 is a user-friendly HTTP client library for Python.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00731 · Published 2025-12-05 · Partial fix · 2.6.0 CWE-770
Priority MEDIUM 44
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00446 · Published 2025-11-26 · Partial fix · 1.3.2 CWE-674
Priority MEDIUM 44
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.0058 · Published 2025-11-25 · Partial fix · 1.3.2 CWE-436
Priority MEDIUM 40
Glob matches files using patterns the shell uses.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.0309 · Published 2025-11-17 · Partial fix · 10.5.0, 11.1.0 CWE-78
Priority LOW 37
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02162 · Published 2025-12-02 · Fixed in 5.2.9, 5.1.15 +1 CWE-407
Priority LOW 36
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0138 · Published 2025-09-15 · Partial fix · 2.7.2 CWE-770
Priority LOW 34
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0045 · Published 2025-12-29 · Partial fix · 6.14.1 CWE-20
Priority LOW 31
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00932 · Published 2025-10-01 · Partial fix · 4.2.25, 5.1.13 +1 CWE-23
Priority LOW 30
CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00744 · Published 2024-06-27 · Partial fix · 3.9.24, 3.10.0b1
Priority LOW 27
Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions.
CVSS 3.1MEDIUM 6.2· Local · No auth · No interaction · EPSS 0.00159 · Published 2025-09-10 · Partial fix · 2.10.0, 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3 +6 CWE-674
Priority LOW 21
The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00603 · Published 2025-06-17 · Partial fix · 3.9.24, 3.10.19 +4 CWE-1333
Priority LOW 16
ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
CVSS 3.1LOW 3.6· Local · Low privileges · No interaction · EPSS 0.00125 · Published 2025-10-06 · Partial fix · 10.1 CWE-158
Priority LOW 9
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.
CVSS 4.0LOW 1.8· Local · High privileges · No interaction · EPSS 0.00149 · Published 2025-10-31 · Partial fix · 3.9.25, 3.10.20 +5 CWE-400
THREATIST.IORead the docs