RHSA-2026:57191

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

iskorotkov/avro is a fast Go Avro codec.

Axios is a promise based HTTP client for the browser and Node.js.

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

Axios is a promise based HTTP client for the browser and Node.js.

js-yaml is a JavaScript YAML parser and dumper.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

iskorotkov/avro is a fast Go Avro codec.

containerd is an open-source container runtime.

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.

Prometheus is an open-source monitoring system and time series database.

The RSA and DSA public key parsers did not enforce size limits on key parameters.

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard.

Billy is an interface filesystem abstraction for Go.

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node…