Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Loading...
Explore Latest Linux Security advisories
We found 78 articles for you...
89
security advisoryfedoraXSSFedora 44 Prometheus Update Critical Security Issues 2026-01a1840582
Update to 3.13.0. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-01a1840582 2026-07-11 01:06:30.201315+00:00 -------------------------------------------------------------------------------- Name : prometheus Product : Fedora 44 Version : 3.13.0 Release : 1.fc44 URL : https://github.com/prometheus/prometheus Summary : Prometheus monitoring system and time series database Description : The Prometheus monitoring system and time series database. -------------------------------------------------------------------------------- Update Information: Update to 3.13.0 -------------------------------------------------------------------------------- ChangeLog: * Thu Jul 2 2026 Mikel Olasagasti Uranga - 3.13.0-1 - Update to 3.13.0 - Closes rhbz#2495979 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2489191 - CVE-2026-40186 prometheus: ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2489191 [ 2 ] Bug #2492689 - CVE-2026-44990 prometheus: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2492689 [ 3 ] Bug #2493575 - CVE-2026-41567 prometheus: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2493575 [ 4 ] Bug #2495063 - CVE-2026-53606 prometheus: sanitize-html: Cross-Site Scripting (XSS) via insufficient URI scheme validation [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2495063 [ 5 ] Bug #2495322 - CVE-2026-25681 prometheus: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2495322 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-01a1840582' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jul 10, 2026
•Critical
Fedora
202
security advisoryimportantmalicious codeopenSUSE Python-Pip Important File Overwrite Threat Advisory 2026-2634-1
An update that solves three vulnerabilities can now be installed.. # Security update for python-pip Announcement ID: SUSE-SU-2026:2634-1 Release Date: 2026-06-25T13:55:49Z Rating: important References: * bsc#1262429 * bsc#1263442 * bsc#1266669 Cross-References: * CVE-2026-3219 * CVE-2026-6357 * CVE-2026-8643 CVSS scores: * CVE-2026-3219 ( SUSE ): 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-3219 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2026-3219 ( NVD ): 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-6357 ( SUSE ): 5.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-6357 ( SUSE ): 5.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N * CVE-2026-6357 ( NVD ): 5.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-8643 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H * CVE-2026-8643 ( NVD ): 4.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2026-8643 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected Products: * openSUSE Leap 15.4 * Public Cloud Module 15-SP4 * Python 3 Module 15-SP7 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE LinuxEnterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves three vulnerabilities can now be installed. ## Description: This update for python-pip fixes the following issues * CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429). * CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442). * CVE-2026-8643: path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (bsc#1266669). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-2634=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-2634=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-2634=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2026-2634=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-2634=1 * Python 3 Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Python3-15-SP7-2026-2634=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -tpatch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-2634=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-2634=1 * Public Cloud Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP4-2026-2634=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-2634=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-2634=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-2634=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-2634=1 ## Package List: * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * python311-pip-22.3.1-150400.17.26.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * python311-pip-22.3.1-150400.17.26.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * python311-pip-22.3.1-150400.17.26.1 * Public Cloud Module 15-SP4 (noarch) * python311-pip-22.3.1-150400.17.26.1 * openSUSE Leap 15.4 (noarch) * python311-pip-22.3.1-150400.17.26.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch) * python311-pip-22.3.1-150400.17.26.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch) * python311-pip-22.3.1-150400.17.26.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch) * python311-pip-22.3.1-150400.17.26.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch) * python311-pip-22.3.1-150400.17.26.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (noarch) * python311-pip-22.3.1-150400.17.26.1 * Python 3 Module 15-SP7 (noarch) * python311-pip-22.3.1-150400.17.26.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (noarch) *python311-pip-22.3.1-150400.17.26.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch) * python311-pip-22.3.1-150400.17.26.1 ## References: * https://www.suse.com/security/cve/CVE-2026-3219.html * https://www.suse.com/security/cve/CVE-2026-6357.html * https://www.suse.com/security/cve/CVE-2026-8643.html * https://bugzilla.suse.com/show_bug.cgi?id=1262429 * https://bugzilla.suse.com/show_bug.cgi?id=1263442 * https://bugzilla.suse.com/show_bug.cgi?id=1266669 . Critical update for openSUSE addressing three important vulnerabilities in python-pip that allow file system compromises.. openSUSE vulnerabilities, python-pip security, SUSE advisory, important update, file system security. . Severity: Important. LinuxSecurity.com Team
Jun 25, 2026
•Important
OpenSUSE
172
security advisorycross site scriptingUbuntuUbuntu 16.04 Smarty Important Cross-Site Scripting Risk USN-8272-1
Smarty could be made to run malicious JavaScript in the user's browser if it received specially crafted input.. ========================================================================== Ubuntu Security Notice USN-8272-1 May 19, 2026 smarty3 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: Smarty could be made to run malicious JavaScript in the user's browser if it received specially crafted input. Software Description: - smarty3: The compiling PHP template engine Details: Takuya Aramaki discovered that Smarty did not properly escape JavaScript code. An attacker could possibly use this issue to conduct a cross-site scripting attack. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS smarty3 3.1.21-1ubuntu1+esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8272-1 CVE-2023-28447 . Smarty could allow execution of malicious JavaScript in the user's browser, warranting critical attention and updates.. Smarty Security Issue, Ubuntu 16.04, Cross-Site Scripting, Security Advisory, JavaScript Exploit. . Severity: Important. LinuxSecurity.com Team
May 19, 2026
•Important
Ubuntu
100
security advisorySuSEimportantSUSE 2026 php-composer2 Important Command Injection Vuln 21542-1
An update that solves three vulnerabilities can now be installed.. # Security update for php-composer2 Announcement ID: SUSE-SU-2026:21542-1 Release Date: 2026-05-04T10:46:30Z Rating: important References: * bsc#1255768 * bsc#1262254 * bsc#1262255 Cross-References: * CVE-2025-67746 * CVE-2026-40176 * CVE-2026-40261 CVSS scores: * CVE-2025-67746 ( SUSE ): 2.0 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2025-67746 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2025-67746 ( NVD ): 1.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-67746 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L * CVE-2026-40176 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-40176 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-40261 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-40261 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * SUSE Linux Enterprise Server 16.0 * SUSE Linux Enterprise Server for SAP applications 16.0 An update that solves three vulnerabilities can now be installed. ## Description: This update for php-composer2 fixes the following issues: * CVE-2025-67746: ANSI control characters injection in terminal output of various Composer commands via attacker controlled remote sources (bsc#1255768). * CVE-2026-40176: arbitrary command injection via malicious Perforce repository definition (bsc#1262254). * CVE-2026-40261: arbitrary command injection via malicious Perforce source reference/url (bsc#1262255). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Serverfor SAP applications 16.0 zypper in -t patch SUSE-SLES-16.0-672=1 * SUSE Linux Enterprise Server 16.0 zypper in -t patch SUSE-SLES-16.0-672=1 ## Package List: * SUSE Linux Enterprise Server for SAP applications 16.0 (noarch) * php-composer2-2.8.9-160000.3.1 * SUSE Linux Enterprise Server 16.0 (noarch) * php-composer2-2.8.9-160000.3.1 ## References: * https://www.suse.com/security/cve/CVE-2025-67746.html * https://www.suse.com/security/cve/CVE-2026-40176.html * https://www.suse.com/security/cve/CVE-2026-40261.html * https://bugzilla.suse.com/show_bug.cgi?id=1255768 * https://bugzilla.suse.com/show_bug.cgi?id=1262254 * https://bugzilla.suse.com/show_bug.cgi?id=1262255 . An important update for php-composer2 fixes command injection vulnerabilities in SUSE systems. Install now for security.. SUSE Linux Enterprise, php-composer2, command injection, security updates. . Severity: Important. LinuxSecurity.com Team
May 11, 2026
•Important
SuSE
203
security advisorydenial of servicemalicious codeMageia 9 nano Security Fix 2026-0121 Local Attack DoS Risks
MGASA-2026-0121 - Updated nano packages fix security vulnerabilities. MGASA-2026-0121 - Updated nano packages fix security vulnerabilities Publication date: 07 May 2026 URL: https://advisories.mageia.org/MGASA-2026-0121.html Type: security Affected Mageia releases: 9 CVE: CVE-2026-6842, CVE-2026-6843 Description: Local attacker can inject malicious .desktop launcher due to insecure directory permissions. (CVE-2026-6842) Format string vulnerability leads to denial of service. (CVE-2026-6843) References: - https://bugs.mageia.org/show_bug.cgi?id=35466 - https://lists.fedoraproject.org/archives/list/
May 07, 2026
•Important
Mageia
219
security advisorydenial of serviceimportantSignificant Security Flaws Discovered in Go Framework for Rocky Linux 10
Important: golang security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2026:10217", "synopsis": "Important: golang security update", "severity": "SEVERITY_IMPORTANT", "topic": "An update is available for golang.\nThis update affects Rocky Linux 10.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "The golang packages provide the Go programming language compiler.\n\nSecurity Fix(es):\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\n* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)\n\n* golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144)\n\n* cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names (CVE-2026-27140)\n\n* golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 10"], "fixes": [{"ticket": "2456338", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338", "description": ""}, {"ticket": "2456341", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2456341", "description": ""}, {"ticket": "2456336", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336", "description": ""}, {"ticket": "2456339", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "description": ""}, {"ticket": "2456340", "sourceBy": "Red Hat", "sourceLink":"https://bugzilla.redhat.com/show_bug.cgi?id=2456340", "description": ""}, {"ticket": "2456342", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2456342", "description": ""}], "cves": [{"name": "CVE-2026-27140", "sourceBy": "MITRE", "sourceLink": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27140", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "cvss3BaseScore": "9.0", "cwe": "CWE-641"}, {"name": "CVE-2026-27143", "sourceBy": "MITRE", "sourceLink": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27143", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvss3BaseScore": "8.1", "cwe": "CWE-733"}, {"name": "CVE-2026-27144", "sourceBy": "MITRE", "sourceLink": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27144", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvss3BaseScore": "8.1", "cwe": "CWE-440"}, {"name": "CVE-2026-32280", "sourceBy": "MITRE", "sourceLink": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-770"}, {"name": "CVE-2026-32282", "sourceBy": "MITRE", "sourceLink": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282", "cvss3ScoringVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "cvss3BaseScore": "7.8", "cwe": "CWE-367"}, {"name": "CVE-2026-32283", "sourceBy": "MITRE", "sourceLink": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-764"}], "references": [], "publishedAt": "2026-05-06T12:05:16.751656Z", "rpms": {"Rocky Linux 10": {"nvras": ["golang-race-0:1.25.9-3.el10_1.s390x.rpm", "go-toolset-0:1.25.9-3.el10_1.aarch64.rpm", "golang-race-0:1.25.9-3.el10_1.ppc64le.rpm", "golang-race-0:1.25.9-3.el10_1.aarch64.rpm", "go-toolset-0:1.25.9-3.el10_1.x86_64.rpm", "golang-src-0:1.25.9-3.el10_1.noarch.rpm","golang-0:1.25.9-3.el10_1.src.rpm", "golang-docs-0:1.25.9-3.el10_1.noarch.rpm", "golang-0:1.25.9-3.el10_1.x86_64.rpm", "golang-misc-0:1.25.9-3.el10_1.noarch.rpm", "go-toolset-0:1.25.9-3.el10_1.ppc64le.rpm", "golang-tests-0:1.25.9-3.el10_1.noarch.rpm", "golang-bin-0:1.25.9-3.el10_1.x86_64.rpm", "golang-bin-0:1.25.9-3.el10_1.s390x.rpm", "golang-0:1.25.9-3.el10_1.s390x.rpm", "golang-bin-0:1.25.9-3.el10_1.ppc64le.rpm", "golang-0:1.25.9-3.el10_1.aarch64.rpm", "golang-0:1.25.9-3.el10_1.ppc64le.rpm", "golang-race-0:1.25.9-3.el10_1.x86_64.rpm", "go-toolset-0:1.25.9-3.el10_1.s390x.rpm", "golang-bin-0:1.25.9-3.el10_1.aarch64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Explore the latest security advisory RLSA-2026:10217 for golang on Rocky Linux 10 with important updates for vulnerabilities.. golang update security advisory Rocky Linux important fixes. . Severity: Important. LinuxSecurity.com Team
May 06, 2026
•Important
Rocky Linux
172
security advisoryUbuntumalicious codeUbuntu 24.04 LTS Linux-nvidia-lowlatency Low Malicious Code USN-8185-2
Several security issues were fixed in the Linux kernel.. ========================================================================== Ubuntu Security Notice USN-8185-2 April 28, 2026 linux-nvidia-lowlatency vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux-nvidia-lowlatency: Linux low latency kernel for NVIDIA systems Details: Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - MIPS architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - Network block device driver; - Bluetooth drivers; - Character device driver; - TPM device driver; - Clock framework and drivers; - Data acquisition framework and drivers; - Hardware crypto device drivers; - GPU drivers; - Hardware monitoring drivers; - InfiniBand drivers; - Input Device core drivers; - IOMMU subsystem; - IRQ chip drivers; - Macintosh device drivers; - Multiple devices driver; - Media drivers; - Network drivers; - Mellanox network drivers; - STMicroelectronics network drivers; - Ethernet team driver; - MediaTek network drivers; - NVME drivers; - PA-RISC drivers; - Chrome hardware platform drivers; - x86 platform drivers; - Voltage and Current Regulator drivers; - SCSI subsystem; - SPI subsystem; - Media OrientedSystems Transport (MOST) driver; - Realtek RTL8723BS SDIO drivers; - TCM subsystem; - USB Host Controller drivers; - USB Type-C Connector System Software Interface driver; - Backlight driver; - Watchdog drivers; - BFS file system; - BTRFS file system; - Ext4 file system; - F2FS file system; - FUSE (File system in Userspace); - HFS+ file system; - File systems infrastructure; - Journaling layer for block devices (JBD2); - Network file system (NFS) client; - File system notification infrastructure; - NTFS3 file system; - OCFS2 file system; - SMB network file system; - BPF subsystem; - Ethernet bridge; - io_uring subsystem; - Locking primitives; - Scheduler infrastructure; - Shadow Call Stack mechanism; - Tracing infrastructure; - Memory management; - CAIF protocol; - Ceph Core library; - Networking core; - Ethtool driver; - Handshake API; - HSR network protocol; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - Multipath TCP; - Netfilter; - NET/ROM layer; - NFC subsystem; - Open vSwitch; - Rose network layer; - Network traffic control; - Network sockets; - Sun RPC protocol; - Integrity Measurement Architecture(IMA) framework; - Key management; - Simplified Mandatory Access Control Kernel framework; - FireWire sound drivers; - HD-audio driver; - Turtle Beach Wavefront ALSA driver; - STMicroelectronics SoC drivers; - USB sound devices; - KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364,CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072, CVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121, CVE-2025-71122, CVE-2025-71123, CVE-2025-71125, CVE-2025-71126, CVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137, CVE-2025-71138, CVE-2025-71140, CVE-2025-71141,CVE-2025-71143, CVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71149, CVE-2025-71150, CVE-2025-71151, CVE-2025-71153, CVE-2025-71154, CVE-2026-23209) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS linux-image-6.8.0-1051-nvidia-lowlatency 6.8.0-1051.54.1 linux-image-6.8.0-1051-nvidia-lowlatency-64k 6.8.0-1051.54.1 linux-image-nvidia-lowlatency 6.8.0-1051.54.1 linux-image-nvidia-lowlatency-6.8 6.8.0-1051.54.1 linux-image-nvidia-lowlatency-64k 6.8.0-1051.54.1 linux-image-nvidia-lowlatency-64k-6.8 6.8.0-1051.54.1 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-8185-2 https://ubuntu.com/security/notices/USN-8185-1 CVE-2024-36347, CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68782, CVE-2025-68783, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68804, CVE-2025-68806, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71071, CVE-2025-71072, CVE-2025-71075, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71088, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71101, CVE-2025-71102, CVE-2025-71104, CVE-2025-71105, CVE-2025-71107, CVE-2025-71108, CVE-2025-71109, CVE-2025-71111, CVE-2025-71112, CVE-2025-71113, CVE-2025-71114, CVE-2025-71116, CVE-2025-71118, CVE-2025-71119, CVE-2025-71120, CVE-2025-71121, CVE-2025-71122, CVE-2025-71123, CVE-2025-71125, CVE-2025-71126, CVE-2025-71127, CVE-2025-71130, CVE-2025-71131, CVE-2025-71132, CVE-2025-71133, CVE-2025-71135, CVE-2025-71136, CVE-2025-71137, CVE-2025-71138, CVE-2025-71140, CVE-2025-71141, CVE-2025-71143, CVE-2025-71144, CVE-2025-71147, CVE-2025-71148, CVE-2025-71149, CVE-2025-71150, CVE-2025-71151, CVE-2025-71153, CVE-2025-71154, CVE-2026-23209 Package Information: https://launchpad.net/ubuntu/+source/linux-nvidia-lowlatency/6.8.0-1051.54.1 . Several security flaws in Ubuntu's Linux kernel fixed enhance system integrity and confidentiality with necessary updates.. Ubuntu Linux Kernel, NVIDIA Low Latency, Security Fixes. . Severity: Low. LinuxSecurity.com Team
Apr 28, 2026
•Low
Ubuntu
100
security advisorybuffer overflowimportantSUSE Linux Micro 6.0 Essential Kernel Update Security Patches 20382-2026
An update that solves three vulnerabilities can now be installed.. # Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise Micro 6.0) Announcement ID: SUSE-SU-2026:20382-1 Release Date: 2026-01-19T15:31:55Z Rating: important References: * bsc#1250192 * bsc#1251787 * bsc#1253437 Cross-References: * CVE-2023-53676 * CVE-2025-39682 * CVE-2025-40204 CVSS scores: * CVE-2023-53676 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2023-53676 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-53676 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2025-39682 ( SUSE ): 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H * CVE-2025-39682 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H * CVE-2025-40204 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2025-40204 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: * SUSE Linux Micro 6.1 An update that solves three vulnerabilities can now be installed. ## Description: This update for the SUSE Linux Enterprise kernel 6.4.0-34.1 fixes various security issues The following security issues were fixed: * CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251787). * CVE-2025-39682: tls: fix handling of zero-length records on the rx_list (bsc#1250192). * CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253437). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.1 zypper in -t patch SUSE-SLE-Micro-6.1-kernel-247=1 ## Package List: * SUSE Linux Micro 6.1 (s390x x86_64) * kernel-livepatch-6_4_0-34-default-4-1.1 * kernel-livepatch-6_4_0-34-default-debuginfo-4-1.1 *kernel-livepatch-MICRO-6-0_Update_11-debugsource-4-1.1 ## References: * https://www.suse.com/security/cve/CVE-2023-53676.html * https://www.suse.com/security/cve/CVE-2025-39682.html * https://www.suse.com/security/cve/CVE-2025-40204.html * https://bugzilla.suse.com/show_bug.cgi?id=1250192 * https://bugzilla.suse.com/show_bug.cgi?id=1251787 * https://bugzilla.suse.com/show_bug.cgi?id=1253437 . Update addresses critical kernel vulnerabilities for SUSE Linux Micro. Immediate installation recommended for security.. SUSE Linux Micro, kernel update, security patch, information disclosure, buffer overflow. . Severity: Important. LinuxSecurity.com Team
Feb 17, 2026
•Important
SuSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!