RHSA-2026:59593

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

js-yaml is a JavaScript YAML parser and dumper.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes.

A flaw was found in the cluster-curator-controller component.

A flaw was found in the cluster-curator-controller component of multicluster engine (MCE).

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

A flaw was found in the managedcluster-import-controller.

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards.

The RSA and DSA public key parsers did not enforce size limits on key parameters.

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

A flaw was found in the clusterclaims-controller component of multicluster engine (MCE).

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE).

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.

Billy is an interface filesystem abstraction for Go.

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE).

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.