Aggregator

Version:next-20261007 (linux-next) Released:2026-10-07

FEDORA-EPEL-2026-67a0bf9fc1 Packages in this update:

• openvpn-2.7.8-1.el10_3

Update description:

Update to upstream 2.7.8 release

It was discovered that Sudo did not properly handle time-based access restrictions when sudoers rules used NOTBEFORE or NOTAFTER with timestamps omitting the trailing timezone indicator. A local attacker could possibly use this issue to execute commands outside the intended time window by manipulating the TZ environment variable.

FEDORA-2026-112c430ffc Packages in this update:

• xorg-x11-server-Xwayland-24.1.14-1.fc43

Update description:

Update to xwayland 24.1.14 CVE fix for: CVE-2026-88812, CVE-2026-93515, CVE-2026-93516 CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522, CVE-2026-93523, CVE-2026-93524, CVE-2026-93536

It was discovered that Poppler had an integer overflow in FoFiTrueType::cvtSfnts. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-102620) It was discovered that Poppler had an integer overflow in SplashClip::clipToPath. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-102621) It was discovered that Poppler had a null pointer dereference in JBIG2Stream. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service. (CVE-2026-93312) It was discovered that Poppler had an integer overflow in JBIG2Stream::readCodeTableSeg. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93313) It was discovered that Poppler had an integer overflow in FoFiTrueType::mapCodeToGID. An attacker could possibly use this issue to cause Poppler to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93314)

FEDORA-2026-7d4732cbab Packages in this update:

• sudo-1.9.17-10.p2.fc44

Update description:

Fix for CVE-2026-96512

FEDORA-2026-e0fdd4bd82 Packages in this update:

• sudo-1.9.17-18.p2.fc45

Update description:

Fix for CVE-2026-96512

FEDORA-EPEL-2026-1363ecb05b Packages in this update:

• openvpn-2.7.8-1.el10_4

Update description:

Update to upstream 2.7.8 release

FEDORA-2026-2448dda850 Packages in this update:

• xorg-x11-server-Xwayland-24.1.14-1.fc44

Update description:

Update to xwayland 24.1.14 CVE fix for: CVE-2026-88812, CVE-2026-93515, CVE-2026-93516 CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522, CVE-2026-93523, CVE-2026-93524, CVE-2026-93536

FEDORA-2026-2460ebb288 Packages in this update:

• xorg-x11-server-Xwayland-24.1.14-1.fc45

Update description:

Update to xwayland 24.1.14 CVE fix for: CVE-2026-88812, CVE-2026-93515, CVE-2026-93516 CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522, CVE-2026-93523, CVE-2026-93524, CVE-2026-93536

FEDORA-EPEL-2026-7f96cebc19 Packages in this update:

• jfrog-cli-2.126.0-1.el9

Update description:

Update to 2.126.0.

FEDORA-EPEL-2026-57bdc9acc3 Packages in this update:

• jfrog-cli-2.126.0-1.el10_2

Update description:

Update to 2.126.0.

FEDORA-EPEL-2026-bfe0e6cebc Packages in this update:

• jfrog-cli-2.126.0-1.el10_3

Update description:

Update to 2.126.0.

FEDORA-EPEL-2026-6126086652 Packages in this update:

• jfrog-cli-2.126.0-1.el10_4

Update description:

Update to 2.126.0.

FEDORA-2026-c7d327b980 Packages in this update:

• jfrog-cli-2.126.0-1.fc45

Update description:

Update to 2.126.0.

FEDORA-2026-4d9c47d35a Packages in this update:

• jfrog-cli-2.126.0-1.fc44

Update description:

Update to 2.126.0.

FEDORA-2026-e7df84fae7 Packages in this update:

• openvpn-2.7.8-1.fc45

Update description:

Update to upstream 2.7.8 release

FEDORA-2026-eed9c789d3 Packages in this update:

• openvpn-2.7.8-1.fc44

Update description:

Update to upstream 2.7.8 release

FEDORA-2026-3ea898ea77 Packages in this update:

• curl-8.15.0-11.fc43

Update description:

• fix secure cookie attribute bypass with tab (CVE-2026-80255)
• fix OpenSSL provider use-after-free (CVE-2026-80229)

It was discovered that libwebsockets did not properly validate user-supplied data when parsing HTTP/2 HPACK path headers, which could result in a write past the end of an allocated buffer. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-19773) It was discovered that libwebsockets did not properly handle CBOR recording in the LECP parser, which could result in a write past the end of an allocated buffer. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2026-78161)