Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 491
Alerts This Week
Warning Icon 1 491

Stay Secure with the Latest Linux Advisories

Opensuse Large Esm H800
openSUSE

openSUSE 2026-3139-1 sssd Important Privilege Escalation and Bypass

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE LibreOffice Important Security Issues and Updates 2026-3140-1

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu 20.04 Linux Kernel Critical Privilege Escalation Issues USN-8576-1

Calendar White Jul 21, 2026
Critical
Ubuntu Large Esm H800
Ubuntu

Ubuntu 22.04 Linux Kernel Critical Issues Addressed USN-8575-1

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu 24.04 LTS Linux-GCP FIPS Major Threat Update 2026-8574-1

Calendar White Jul 21, 2026
Critical
Rockylinux Esm H900
Rocky

Rocky Linux webkit2gtk3 Important Security Issues RLSA-2026-42088

Calendar White Jul 21, 2026
Important
Rockylinux Esm H800
Rocky

Rocky Linux glib2 Important Integer Underflow Threat RLSA-2026-42090

Calendar White Jul 21, 2026
Important
Debianlts Large Esm H900
Debian LTS

Debian LTS Samba Important Access Bypass Denial of Service DLA-4692-1

Calendar White Jul 21, 2026
Important
Mageia Large Esm H900
Mageia

Mageia 10 serd Important Security Bugfix Advisory 2026-0058

Calendar White Jul 20, 2026
Important
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 69 articles for you...
202
Ls Advisories Opensuse Esm H240
Price Tag%201security advisoryimportantOpenSUSE

openSUSE 2026-21201-1 Jackson Annotations Important Array Bypass

An update that solves 4 vulnerabilities and has 5 bug fixes can now be installed.. openSUSE security update: security update for jackson-annotations, jackson-core, jackson-databind ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21201-1 Rating: important References: * bsc#1268603 * bsc#1268897 * bsc#1268898 * bsc#1268899 * bsc#1268902 Cross-References: * CVE-2026-54512 * CVE-2026-54513 * CVE-2026-54514 * CVE-2026-54515 CVSS scores: * CVE-2026-54512 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-54513 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2026-54514 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2026-54515 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 4 vulnerabilities and has 5 bug fixes can now be installed. Description: This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues - CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation (bsc#1268897). - CVE-2026-54513: jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (bsc#1268898). - CVE-2026-54514: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899). - CVE-2026-54515: jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties (bsc#1268902). - document length constraint bypass in blocking, async, and DataInput parsers (bsc#1268603). Changes for jackson-annotations: - Update to 2.18.8 * No changes since 2.17.3 Changes for jackson-core: - Update to 2.18.8 * Changes of 2.18.8 + #1611: Apply number-length validator on streaming integer path of async parser * Changes of 2.18.7 + #1570: Fail parsing from 'DataInput' if'StreamReadConstraints .getMaxDocumentLength()' set (bsc#1268603, GHSA-2m67-wjpj-xhg9) + #1600: Rework 3rd party licenses in jar + #1602: 'UTF8DataInputJsonParser' needs to enforce 'StreamReadConstraints.maxNameLength' limit * Changes of 2.18.6 + #1512: Number-parsing fix for 'UTF8DataInputJsonParser' + #1548: 'StreamReadConstraints.maxDocumentLength' not checked when creating parser with fixed buffer + #1555: Enforce 'StreamReadConstraints.maxNumberLength' for non-blocking (async) parser * Changes of 2.18.5 + #1433: 'JsonParser#getNumberType()' throws 'JsonParseException' when the current token is non-numeric instead of returning null + #1446: Invalid package reference to "java.lang.foreign" from 'com.fasterxml.jackson.core:jackson-core' (from 'FastDoubleParser') * Changes of 2.18.3 + #1391: Fix issue where the parser can read back old number state when parsing later numbers + #1397: Jackson changes additional values to infinite in case of special JSON structures and existing infinite values + #1398: Fix issue that feature COMBINE_UNICODE_SURROGATES_IN_UTF8 doesn't work when custom characterEscape is used * Changes of 2.18.2 + #1359: Non-surrogate characters being incorrectly combined when 'JsonWriteFeature.COMBINE_UNICODE_SURROGATES_IN_UTF8' is enabled * Changes of 2.18.1 + #1353: Use fastdoubleparser 1.0.90 * Changes of 2.18. + #223: 'UTF8JsonGenerator' writes supplementary characters as a surrogate pair: should use 4-byte encoding + #1230: Improve performance of 'float' and 'double' parsing from 'TextBuffer' + #1251: 'InternCache' replace synchronized with 'ReentrantLock' - the cache size limit is no longer strictly enforced for performance reasons but we should never go far about the limit + #1252: 'ThreadLocalBufferManager' replace synchronized with 'ReentrantLock' + #1257: Increase InternCache default max size from 100 to 200 + #1262: Add diagnostic method 'pooledCount()' in 'RecyclerPool' + #1264: Rename shaded 'ch.randelshofer:fastdoubleparser' classes toprevent use by downstream consumers + #1271: Deprecate 'LockFreePool' implementation in 2.18 (remove from 3.0) + #1274: 'NUL'-corrupted keys, values on JSON serialization + #1277: Add back Java 22 optimisation in FastDoubleParser + #1284: Optimize 'JsonParser.getDoubleValue()/getFloatValue() /getDecimalValue()' to avoid String allocation + #1305: Make helper methods of 'WriterBasedJsonGenerator' non-final to allow overriding + #1310: Add new 'StreamReadConstraints' ('maxTokenCount') to limit maximum number of Tokens allowed per document# + #1331: Update to FastDoubleParser v1.0.1 to fix 'BigDecimal' decoding proble Changes for jackson-databind: - Update to 2.18.8 * Changes of 2.18.8 + #5950: Improve 'UUIDeserializer' error handling + #5951: Improve 'InetSocketAddress' deserialization (bsc#1268899, CVE-2026-54514) + #5969: '@JsonView' by-passed for some "setterless" creator properties + #5971: '@JsonView' by-passed for unwrapped creator parameters + #5974: '@JsonIgnore' on Record property ignored with 'PropertyNamingStrategy' + #5981: 'BasicPolymorphicTypeValidator' setting 'allowIfSubTypeIsArray()' should validate element type (bsc#1268898, CVE-2026-54513) + #5988: 'PolymorphicTypeValidator' needs to validate generic type parameters too (bsc#1268897, CVE-2026-54512) + #5993: 'UPPER_SNAKE_CASE' / 'LOWER_CASE' 'NamingStrategyImpls' fold case using JVM default locale (Turkish-I bug) * Changes of 2.18.4 + #4628: '@JsonIgnore' and This email address is being protected from spambots. You need JavaScript enabled to view it.=READ_ONLY' on Record property ignored for deserialization + #5049: Duplicate creator property "b" (index 0 vs 1) on simple java record * Changes of 2.18.3 + #4444: The 'KeyDeserializer' specified in the class with '@JsonDeserialize(keyUsing = ...)' is overwritten by the 'KeyDeserializer' specified in the 'ObjectMapper'. + #4827: Subclassed Throwable deserialization fails since v2.18.0 - no creator index for property 'cause' + #4844: Fix wrapped array handling wrt 'null' by 'StdDeserializer' + #4848: Avoid type pollution in'StringCollectionDeserializer' + #4860: 'ConstructorDetector.USE_PROPERTIES_BASED' does not work with multiple constructors since 2.18 + #4878: When serializing a Map via Converter(StdDelegatingSerializer), a NullPointerException is thrown due to missing key serializer + #4908: Deserialization behavior change with @JsonCreator and @ConstructorProperties between 2.17 and 2.18 + #4917: 'BigDecimal' deserialization issue when using '@JsonCreator' + #4920: Creator properties are ignored on abstract types when collecting bean properties, breaking AsExternalTypeDeserializer + #4922: Failing '@JsonMerge' with a custom Map + #4932: Conversion of 'MissingNode' throws 'JsonProcessingException' * Changes of 2.18.2 + #4733: Wrong serialization of Type Ids for certain types of Enum values + #4742: Deserialization with Builder, External type id, '@JsonCreator' failing + #4777: 'StdValueInstantiator.withArgsCreator' is now set for creators with no arguments + #4783 Possibly wrong behavior of @JsonMerge + #4787: Wrong 'String.format()' in 'StdDelegatingDeserializer' hides actual error + #4788: 'EnumFeature.WRITE_ENUMS_TO_LOWERCASE' overrides '@JsonProperty' values + #4790: Fix '@JsonAnySetter' issue with "setter" method (related to #4639) + #4807: Improve 'FactoryBasedEnumDeserializer' to work better with XML module + #4810: Deserialization using '@JsonCreator' with renamed property failing (since 2.18) * Changes of 2.18.1 + #4508: Deserialized JsonAnySetter field in Kotlin data class is null + #4639: @JsonAnySetter on field ignoring unrecognized properties if they are declared before the last recognized properties in JSON + #4718: Should not fail on trying to serialize 'java.time.DateTimeException' + #4724: Deserialization behavior change with Records, '@JsonCreator' and '@JsonValue' between 2.17 and 2.18 + #4727: Eclipse having issues due'module-info' class "lost" on 2.18.0 jars + #4741: When 'Include.NON_DEFAULT' setting is used on POJO, empty values are not included in json ifdefault is 'null' + #4749: Fixed a problem with 'StdDelegatingSerializer#serializeWithType' looking up the serializer with the wrong argument * Changes of 2.18.0 + #562: Allow '@JsonAnySetter' to flow through Creators + #806: Problem with 'NamingStrategy', creator methods with implicit names + #2977: Incompatible 'FAIL_ON_MISSING_PRIMITIVE_PROPERTIES' and field level '@JsonProperty' + #3120: Return 'ListIterator' from 'ArrayNode.elements()' + #3241: 'constructorDetector' seems to invalidate 'defaultSetterInfo' for nullability + #3439: Java Record '@JsonAnySetter' value is null after deserialization + #4085: '@JsonView' does not work on class-level for records + #4119: Exception when deserialization uses a record with a constructor property with 'access=READ_ONLY' + #4356: 'BeanDeserializerModifier::updateBuilder()' doesn't work for beans with Creator methods + #4407: 'null' type id handling does not work with 'writeTypePrefix()' + #4452: '@JsonProperty' not serializing field names properly on '@JsonCreator' in Record + #4453: Allow JSON Integer to deserialize into a single-arg constructor of parameter type 'double' + #4456: Rework locking in 'DeserializerCache' + #4458: Rework synchronized block from 'BeanDeserializerBase' + #4464: When 'Include.NON_DEFAULT' setting is used, 'isEmpty()' method is not called on the serializer + #4472: Rework synchronized block in 'TypeDeserializerBase' + #4483: Remove 'final' on method BeanSerializer.serialize() + #4515: Rewrite Bean Property Introspection logic in Jackson 2.x + #4545: Unexpected deserialization behavior with '@JsonCreator', '@JsonProperty' and javac '-parameters' + #4570: Deprecate 'ObjectMapper.canDeserialize()'/'ObjectMapper .canSerialize()' + #4580: Add 'MapperFeature .SORT_CREATOR_PROPERTIES_BY_DECLARATION_ORDER' to use Creator properties' declaration order for sorting + #4584: Provide extension point for detecting "primary" Constructor for Kotlin (and similar) data classes + #4602: Possible wrong use of_arrayDelegateDeserializer in BeanDeserializerBase::deserializeFromObjectUsingNonDefault() + #4617: Record property serialization order not preserved + #4626: '@JsonIgnore' on Record property ignored for deserialization, if there is getter override + #4630: '@JsonIncludeProperties', '@JsonIgnoreProperties' ignored when serializing Records, if there is getter override + #4634: '@JsonAnySetter' not working when annotated on both constructor parameter & field + #4678: Java records don't serialize with 'MapperFeature .REQUIRE_SETTERS_FOR_GETTERS' + #4688: Should allow deserializing with no-arg '@JsonCreator(mode = DELEGATING)' + #4694: Deserializing 'BigDecimal' with large number of decimals result in incorrect value + #4699: Add extra 'writeNumber()' method in 'TokenBuffer' + #4709: Add 'JacksonCollectors' with 'toArrayNode()' implementation + Fix #5962: Case-insensitive deserialization may use wrong @JsonIgnoreProperties (bsc#1268902, CVE-2026-54515) Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-1124=1 Package List: - openSUSE Leap 16.0: jackson-annotations-2.18.8-160000.1.1 jackson-annotations-javadoc-2.18.8-160000.1.1 jackson-core-2.18.8-160000.1.1 jackson-core-javadoc-2.18.8-160000.1.1 jackson-databind-2.18.8-160000.1.1 jackson-databind-javadoc-2.18.8-160000.1.1 References: * https://www.suse.com/security/cve/CVE-2026-54512.html * https://www.suse.com/security/cve/CVE-2026-54513.html * https://www.suse.com/security/cve/CVE-2026-54514.html * https://www.suse.com/security/cve/CVE-2026-54515.html . Critical openSUSE update addresses important vulnerabilities in Jackson libraries with essential fixes for better security.. openSUSE update,jackson libraries,security vulnerabilities,jackson-annotations,important security advisory. .Severity: Important. LinuxSecurity.com Team

Calendar%202 Jul 03, 2026 •Important OpenSUSE
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisoryfedoraremote code execution

Fix Critical Deserialization Issue in Fedora 43 python-django-haystack

Fixes GHSA-r3hx-x5rh-p9vv: via eval() in Elasticsearch Result Deserialization https://github.com/django-haystack/django- haystack/security/advisories/GHSA-r3hx-x5rh-p9vv What's Changed https://github.com/django-haystack/django-haystack/releases/tag/v3.4.0. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-1d2c7eaa2f 2026-07-01 01:21:48.846188+00:00 -------------------------------------------------------------------------------- Name : python-django-haystack Product : Fedora 43 Version : 3.4.0 Release : 1.fc43 URL : http://haystacksearch.org/ Summary : Pluggable search for Django Description : Haystack provides modular search for Django. It features a unified, familiar API that allows you to plug in different search backends (such as Solr, Elasticsearch, Whoosh, Xapian, etc.) without having to modify your code. Haystack is BSD licensed, plays nicely with third-party app without needing to modify the source and supports advanced features like faceting, More Like This, highlighting, spatial search and spelling suggestions. You can find more information at http://haystacksearch.org/. -------------------------------------------------------------------------------- Update Information: Fixes GHSA-r3hx-x5rh-p9vv: via eval() in Elasticsearch Result Deserialization https://github.com/django-haystack/django- haystack/security/advisories/GHSA-r3hx-x5rh-p9vv What's Changed https://github.com/django-haystack/django-haystack/releases/tag/v3.4.0 Remove obsolete ElasticSearch2 support and tests by @claudep in https://github.com/django-haystack/django-haystack/pull/1978 Add Django v5.1 to the testing by @cclauss in https://github.com/django- haystack/django-haystack/pull/1991 GitHub Actions: Add Python 3.13 to the testing by @cclauss in https://github.com/django-haystack/django-haystack/pull/1997 Fix typo. by @andresmrm inhttps://github.com/django-haystack/django- haystack/pull/1998 Fix RelatedSearchQueryset.load_all() truncating results by @craigds in https://github.com/django-haystack/django-haystack/pull/2012 [FIXED] -- handle trailing slash in Solr index URL for core reload. by @DhavalGojiya in https://github.com/django-haystack/django-haystack/pull/1968 Bump the github-actions group with 2 updates by @dependabot[bot] in https://github.com/django-haystack/django-haystack/pull/2018 Update license field to use proper SPDX identifier by @leifdreizler in https://github.com/django-haystack/django-haystack/pull/2016 dev: Update Python dependencies by @kingbuzzman in https://github.com/django- haystack/django-haystack/pull/2019 dev: Update django by @kingbuzzman in https://github.com/django-haystack/django- haystack/pull/2020 fix: handle HEAD requests like GET in generic_views by @janheini in https://github.com/django-haystack/django-haystack/pull/2015 feat: Add requires-python to pyproject.toml (PEP 621) by @DhavalGojiya in https://github.com/django-haystack/django-haystack/pull/2039 Add Python 3.14 and 3.14t to the testing by @cclauss in https://github.com/django-haystack/django-haystack/pull/2031 Fix race condition in ConnectionRouter.routers lazy initialization by @craigds in https://github.com/django-haystack/django-haystack/pull/2048 add postgres backend to backend_support.rst by @fgregg in https://github.com/django-haystack/django-haystack/pull/2044 Actions: limit permissions for tests by @acdha in https://github.com/django- haystack/django-haystack/pull/2053 GitHub Actions: zizmor fixes by @acdha in https://github.com/django- haystack/django-haystack/pull/2055 -------------------------------------------------------------------------------- ChangeLog: * Mon Jun 22 2026 Michel Lind - 3.4.0-1 - Update to 3.4.0 upstream release - Resolves: rhbz#2484926 - Enable Packit * Thu Jun 4 2026 Python Maint - 3.3.0-8 - Rebuilt for Python 3.15 * Sat Jan 17 2026 Fedora Release Engineering -3.3.0-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2484926 - python-django-haystack-3.4.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2484926 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-1d2c7eaa2f' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new . Eliminate a critical deserialization flaw in python-django-haystack on Fedora 43 to prevent remote code execution risks.. Fedora security, python-django-haystack update, security advisory, code execution risk, software update. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Jun 30, 2026 •Important Fedora
Banner 4 1028x280 1708121825 1771600306
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisoryfedoracritical

Fedora 44 Python-Django-Haystack Faces Critical Deserialization Risk

Fixes GHSA-r3hx-x5rh-p9vv: via eval() in Elasticsearch Result Deserialization https://github.com/django-haystack/django- haystack/security/advisories/GHSA-r3hx-x5rh-p9vv What's Changed https://github.com/django-haystack/django-haystack/releases/tag/v3.4.0. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-3e10194134 2026-07-01 01:01:09.528460+00:00 -------------------------------------------------------------------------------- Name : python-django-haystack Product : Fedora 44 Version : 3.4.0 Release : 1.fc44 URL : http://haystacksearch.org/ Summary : Pluggable search for Django Description : Haystack provides modular search for Django. It features a unified, familiar API that allows you to plug in different search backends (such as Solr, Elasticsearch, Whoosh, Xapian, etc.) without having to modify your code. Haystack is BSD licensed, plays nicely with third-party app without needing to modify the source and supports advanced features like faceting, More Like This, highlighting, spatial search and spelling suggestions. You can find more information at http://haystacksearch.org/. -------------------------------------------------------------------------------- Update Information: Fixes GHSA-r3hx-x5rh-p9vv: via eval() in Elasticsearch Result Deserialization https://github.com/django-haystack/django- haystack/security/advisories/GHSA-r3hx-x5rh-p9vv What's Changed https://github.com/django-haystack/django-haystack/releases/tag/v3.4.0 Remove obsolete ElasticSearch2 support and tests by @claudep in https://github.com/django-haystack/django-haystack/pull/1978 Add Django v5.1 to the testing by @cclauss in https://github.com/django- haystack/django-haystack/pull/1991 GitHub Actions: Add Python 3.13 to the testing by @cclauss in https://github.com/django-haystack/django-haystack/pull/1997 Fix typo. by @andresmrm inhttps://github.com/django-haystack/django- haystack/pull/1998 Fix RelatedSearchQueryset.load_all() truncating results by @craigds in https://github.com/django-haystack/django-haystack/pull/2012 [FIXED] -- handle trailing slash in Solr index URL for core reload. by @DhavalGojiya in https://github.com/django-haystack/django-haystack/pull/1968 Bump the github-actions group with 2 updates by @dependabot[bot] in https://github.com/django-haystack/django-haystack/pull/2018 Update license field to use proper SPDX identifier by @leifdreizler in https://github.com/django-haystack/django-haystack/pull/2016 dev: Update Python dependencies by @kingbuzzman in https://github.com/django- haystack/django-haystack/pull/2019 dev: Update django by @kingbuzzman in https://github.com/django-haystack/django- haystack/pull/2020 fix: handle HEAD requests like GET in generic_views by @janheini in https://github.com/django-haystack/django-haystack/pull/2015 feat: Add requires-python to pyproject.toml (PEP 621) by @DhavalGojiya in https://github.com/django-haystack/django-haystack/pull/2039 Add Python 3.14 and 3.14t to the testing by @cclauss in https://github.com/django-haystack/django-haystack/pull/2031 Fix race condition in ConnectionRouter.routers lazy initialization by @craigds in https://github.com/django-haystack/django-haystack/pull/2048 add postgres backend to backend_support.rst by @fgregg in https://github.com/django-haystack/django-haystack/pull/2044 Actions: limit permissions for tests by @acdha in https://github.com/django- haystack/django-haystack/pull/2053 GitHub Actions: zizmor fixes by @acdha in https://github.com/django- haystack/django-haystack/pull/2055 -------------------------------------------------------------------------------- ChangeLog: * Mon Jun 22 2026 Michel Lind - 3.4.0-1 - Update to 3.4.0 upstream release - Resolves: rhbz#2484926 - Enable Packit * Thu Jun 4 2026 Python Maint - 3.3.0-8 - Rebuilt for Python3.15 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2484926 - python-django-haystack-3.4.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2484926 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-3e10194134' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new . Fixes critical deserialization issue in python-django-haystack on Fedora 44, ensuring enhanced system security and stability.. python-django-haystack update, elasticsearch deserialization, fedora security advisory, GHSA-r3hx-x5rh-p9vv. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Jun 30, 2026 •Critical Fedora
100
Ls Advisories Suse Esm H240
Price Tag%201security advisorySuSEcode execution

SUSE Python Azure Core Important CVE-2026-21226 Code Execution Advisory

An update that solves one vulnerability can now be installed.. # Security update for python-azure-core Announcement ID: SUSE-SU-2026:20617-1 Release Date: 2026-03-01T15:59:58Z Rating: important References: * bsc#1257703 Cross-References: * CVE-2026-21226 CVSS scores: * CVE-2026-21226 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-21226 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2026-21226 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * SUSE Linux Enterprise Server 16.0 * SUSE Linux Enterprise Server High Availability Extension 16.0 An update that solves one vulnerability can now be installed. ## Description: This update for python-azure-core fixes the following issues: * CVE-2026-21226: Fixed deserialization of untrusted data which may allow an authorized attacker to execute code over a network. (bsc#1257703) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server High Availability Extension 16.0 zypper in -t patch SUSE-SLES-HA-16.0-330=1 ## Package List: * SUSE Linux Enterprise Server High Availability Extension 16.0 (noarch) * python313-azure-core-1.32.0-160000.3.1 ## References: * https://www.suse.com/security/cve/CVE-2026-21226.html * https://bugzilla.suse.com/show_bug.cgi?id=1257703 . Update for Python Azure Core on SUSE fixes critical issues including code execution from untrusted data.. python azure core, SUSE update, security patch, code execution risk. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Mar 05, 2026 •Important SuSE
Banner 4 1028x280 1708121825 1771600306
100
Ls Advisories Suse Esm H240
Price Tag%201security advisorySuSEcode execution

SUSE 16.0 Python Azure Core Significant Code Execution Flaw 2026-20621-1

An update that solves one vulnerability can now be installed.. # Security update for python-azure-core Announcement ID: SUSE-SU-2026:20621-1 Release Date: 2026-03-01T15:59:49Z Rating: important References: * bsc#1257703 Cross-References: * CVE-2026-21226 CVSS scores: * CVE-2026-21226 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-21226 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2026-21226 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * SUSE Linux Enterprise Server for SAP Applications 16.0 An update that solves one vulnerability can now be installed. ## Description: This update for python-azure-core fixes the following issues: * CVE-2026-21226: Fixed deserialization of untrusted data which may allow an authorized attacker to execute code over a network. (bsc#1257703) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server for SAP Applications 16.0 zypper in -t patch SUSE-SLES-16.0-330=1 ## Package List: * SUSE Linux Enterprise Server for SAP Applications 16.0 (noarch) * python313-azure-core-1.32.0-160000.3.1 ## References: * https://www.suse.com/security/cve/CVE-2026-21226.html * https://bugzilla.suse.com/show_bug.cgi?id=1257703 . Update for python-azure-core in SUSE fixes critical deserialization issue that allows code execution by an attacker.. SUSE Update, Python Azure Core Security, Critical Vulnerability Fix. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Mar 05, 2026 •Important SuSE
202
Ls Advisories Opensuse Esm H240
Price Tag%201security advisorycode executionimportant

openSUSE Leap 16.0 python-azure-core Important Code Exec Fix 2026-20292-1

An update that solves one vulnerability and has one bug fix can now be installed.. openSUSE security update: security update for python-azure-core ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20292-1 Rating: important References: * bsc#1257703 Cross-References: * CVE-2026-21226 CVSS scores: * CVE-2026-21226 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2026-21226 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves one vulnerability and has one bug fix can now be installed. Description: This update for python-azure-core fixes the following issues: - CVE-2026-21226: Fixed deserialization of untrusted data which may allow an authorized attacker to execute code over a network. (bsc#1257703) Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-330=1 Package List: - openSUSE Leap 16.0: python313-azure-core-1.32.0-160000.3.1 References: * https://www.suse.com/security/cve/CVE-2026-21226.html . Update available for python-azure-core that addresses a critical code execution issue and includes a bug fix.. openSUSE security update, python-azure-core, important update, CVE-2026-21226. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Mar 02, 2026 •Important OpenSUSE
Banner 4 1028x280 1708121825 1771600306
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisoryfedoradeserialization

Fedora 42 rust-rkyv 0.7 Critical Advisory RUSTSEC-2026-0001

https://rustsec.org/advisories/RUSTSEC-2026-0001. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-801214adba 2026-01-23 01:14:49.116911+00:00 -------------------------------------------------------------------------------- Name : rust-rkyv0.7 Product : Fedora 42 Version : 0.7.46 Release : 1.fc42 URL : https://crates.io/crates/rkyv Summary : Zero-copy deserialization framework for Rust Description : Zero-copy deserialization framework for Rust. -------------------------------------------------------------------------------- Update Information: https://rustsec.org/advisories/RUSTSEC-2026-0001 -------------------------------------------------------------------------------- ChangeLog: * Tue Jan 13 2026 Benjamin A. Beasley - 0.7.46-1 - Update to version 0.7.46; Fixes RUSTSEC-2026-0001 * Fri Jul 25 2025 Fedora Release Engineering - 0.7.45-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-801214adba' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines ListArchives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue . A critical update for rust-rkyv 0.7 in Fedora 42 addresses security issues. Ensure to upgrade for protection.. fedora rust-rkyv critical security update. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Jan 23, 2026 •Critical Fedora
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisoryfedorathreat

Fedora 43 rust-rkyv 0.7 Update Addressing RUSTSEC-2026-0001 Issue

https://rustsec.org/advisories/RUSTSEC-2026-0001. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-35d1dee2ab 2026-01-23 00:54:29.972485+00:00 -------------------------------------------------------------------------------- Name : rust-rkyv0.7 Product : Fedora 43 Version : 0.7.46 Release : 1.fc43 URL : https://crates.io/crates/rkyv Summary : Zero-copy deserialization framework for Rust Description : Zero-copy deserialization framework for Rust. -------------------------------------------------------------------------------- Update Information: https://rustsec.org/advisories/RUSTSEC-2026-0001 -------------------------------------------------------------------------------- ChangeLog: * Tue Jan 13 2026 Benjamin A. Beasley - 0.7.46-1 - Update to version 0.7.46; Fixes RUSTSEC-2026-0001 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-35d1dee2ab' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it:https://pagure.io/fedora-infrastructure/new_issue . Addressing RUSTSEC-2026-0001 with Fedora rust-rkyv0.7 update on jan 23, 2026. Fixes and update information included.. Russ Framework Fedora Update Rust Security Advisory. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Jan 23, 2026 •Important Fedora
Banner 4 1028x280 1708121825 1771600306
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics