5 days 11 hours ago
FEDORA-2026-e9e305c64c
Packages in this update:
Update description:
Update to 0.2.6 upstream release
This release fixes
GHSA-vwvw-f6v4-w737
/ CVE-2026-120499:
read_hdf5 could execute arbitrary code when reading a crafted HDF5 file.
As part of the fix, loading files containing classes, objects written with
use_state=True, or pandas DataFrame/Series objects is disabled by
default and will now raise a ValueError; see the release
notes for details.
5 days 13 hours ago
FEDORA-2026-4a16e04d4b
Packages in this update:
Update description:
Update to 0.2.6 upstream release
This release fixes
GHSA-vwvw-f6v4-w737
/ CVE-2026-120499:
read_hdf5 could execute arbitrary code when reading a crafted HDF5 file.
As part of the fix, loading files containing classes, objects written with
use_state=True, or pandas DataFrame/Series objects is disabled by
default and will now raise a ValueError; see the release
notes for details.
5 days 14 hours ago
FEDORA-2026-667d0938f0
Packages in this update:
Update description:
Update to Hugo 0.165.0, which includes security fixes for several CVEs.
This release fixes CVE-2026-75926 (Tailwind CSS Node permission model bypass) and CVE-2026-89258 (symlink confinement bypass), as well as earlier escaping and sandbox issues fixed upstream.
Fedora 44 provides Go 1.26, and Hugo 0.166.0 and later require Go 1.27.0, so 0.165.0 is the newest release that can be built for this Fedora release.
The extended edition is built with bundled LibSass, so the package does not depend on a system libsass.
Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.165.0
5 days 14 hours ago
FEDORA-2026-9521359c66
Packages in this update:
Update description:
Update to Hugo 0.165.0.
Fedora 43 provides Go 1.26, and Hugo 0.166.0 and later require Go 1.27.0, so 0.165.0 is the newest release that can be built for this Fedora release. This update therefore skips 0.167.0 and 0.168.0, neither of which was published for Fedora 43. It is intended to be the final Hugo update for Fedora 43.
The extended edition is built with bundled LibSass, so the package does not depend on a system libsass.
Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.165.0
5 days 14 hours ago
FEDORA-2026-97aa8e408a
Packages in this update:
Update description:
Update to Hugo 0.169.0, which includes a security fix.
Menu pre and post values defined in front matter are no longer rendered as unescaped HTML. Because front matter is untrusted content, a content contributor could previously inject arbitrary HTML, including script, into pages that render menu entries. These values are now HTML escaped unless text/html is allowed in security.allowContent, and a warning-menu-pre-post-html-escaped warning is logged when markup is escaped. Menu entries defined in the site configuration are not affected.
This update also requires Go 1.27.0 and continues to build the extended edition with bundled LibSass, so the package does not depend on a system libsass.
Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.169.0
5 days 21 hours ago
FEDORA-2026-94fa41e927
Packages in this update:
Update description:
arbitrary read/write via grant copy
[XSA-523, CVE-2026-102703, CVE-2026-102704]
wrong version of xsa518 patch in last build
x86/AMD: ineffectual Zenbleed workaround [XSA-515, CVE-2026-79608]
x86: XPTI may break on huge-memory systems [XSA-516, CVE-2026-79609]
grant-table: double version change race [XSA-517, CVE-2026-79610]
VMX: VMentry failure with branch tracing and blocked states
[XSA-518, CVE-2026-79611]
Arm: multiple issues with GNTTABOP_cache_flush
[XSA-519, CVE-2026-102699, CVE-2026-102702]
gnttab: cache-flush handling may cause page reference leak
[XSA-520, CVE-2026-102700]
6 days 4 hours ago
USN-8955-1 fixed vulnerabilities in nginx in Ubuntu 26.10, Ubuntu 26.04
LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. This update provides the
corresponding update for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04
LTS, and Ubuntu 14.04 LTS.
In addition, this update fixes CVE-2026-42533 for these releases.
It was discovered that nginx incorrectly handled certain map directives
using regex matching and capture variables. A remote attacker could
possibly use this issue to crash nginx, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2026-42533)
Original advisory details:
It was discovered that nginx incorrectly handled certain configurations
using the alias directive together with rewrite rules. A remote attacker
could possibly use this issue to cause nginx to crash, resulting in a
denial of service, or execute arbitrary code. (CVE-2026-15176)
It was discovered that nginx incorrectly handled map directives using
regex matching under certain circumstances. A remote attacker could
possibly use this issue to cause nginx to crash, resulting in a denial of
service, or execute arbitrary code. (CVE-2026-93479)
It was discovered that nginx incorrectly handled HTTP/3 requests when
proxy_request_buffering was enabled. This issue only affected Ubuntu 26.04
LTS and Ubuntu 26.10. A remote attacker could possibly use this issue to
inject data into proxied requests. (CVE-2026-95101)
It was discovered that nginx incorrectly handled asynchronous file I/O in
certain configurations with Server Side Includes pages. A remote attacker
could possibly use this issue to cause nginx to crash, resulting in a
denial of service, or execute arbitrary code. (CVE-2026-97205)
It was discovered that nginx incorrectly handled SSL session ticket keys
when configured with a shared session cache but without explicit ticket
key rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS,
and Ubuntu 26.10. A remote attacker could possibly use this issue to forge
client SSL sessions and bypass client certificate verification.
(CVE-2026-97629)
