Red Hat Security AdvisoryRHSA-2026:0934
Release of OpenShift Serverless Logic 1.36.0 security update & enhancements
Released 2026-01-22 · Red Hat rating Important · View on Red Hat →
Fixes 16 records
Priority HIGH 76
Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00667 · Published 2025-10-22 · Fixed CWE-349
Priority HIGH 72
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available.
CVSS 4.0HIGH 7.2· Network · Low privileges · No interaction · EPSS 0.73452 · Published 2025-07-15 · Partial fix · 3.50.2 CWE-197
Priority HIGH 70
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems.
CVSS 3.1HIGH 8.0· Local · No auth · No interaction · EPSS 0.01001 · Published 2025-09-11 · Partial fix · 2.4.13 CWE-287
Priority HIGH 69
A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management.
CVSS 3.1HIGH 7.8· Local · No auth · No interaction · EPSS 0.00444 · Published 2025-07-10 · Partial fix · 2.15.2, 1.1.39-8.el10_0 +42 CWE-416
Priority HIGH 67
A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00491 · Published 2025-06-09 · Partial fix · 3.8.0, 3.7.7-4.el10_0 +48 CWE-190
Priority MEDIUM 63
Allows modifying some file metadata (e.g.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00825 · Published 2025-06-03 · Fixed in 3.9.23, 3.10.18 +4 CWE-22
Priority MEDIUM 51
Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data".
CVSS 3.1CRITICAL 9.4· Network · No auth · No interaction · EPSS 0.0148 · Published 2025-06-03 · Fixed in 3.9.23, 3.10.18 +4 CWE-22
Priority MEDIUM 48
A vulnerability was found in libxml2.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01558 · Published 2025-06-16 · Partial fix · 2.15.0, 2.12.5-7.el10_0 +34 CWE-125
Priority MEDIUM 47
A use-after-free vulnerability was found in libxml2.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00833 · Published 2025-06-16 · Partial fix · 2.15.0, 2.12.5-7.el10_0 +33 CWE-825
Priority MEDIUM 44
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00615 · Published 2025-07-15 · Partial fix CWE-284
Priority MEDIUM 42
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01487 · Published 2025-06-03 · Fixed in 3.9.23, 3.10.18 +4 CWE-22
Priority MEDIUM 40
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.0127 · Published 2025-07-15 · Partial fix
Priority LOW 39
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00751 · Published 2025-07-15 · Partial fix
Priority LOW 36
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0138 · Published 2025-09-15 · Partial fix · 2.7.2 CWE-770
Priority LOW 36
A flaw was found in linux-pam.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00279 · Published 2025-08-13 · Fixed in 1.1.8-23.el7_9.2, 1.3.1-38.el8_10 +19 CWE-22
Priority LOW 36
A flaw was found in linux-pam.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00472 · Published 2025-06-17 · Fixed in 1.7.1, 1.6.1-8.el10 +49 CWE-22
THREATIST.IORead the docs