Aggregator

FEDORA-2026-35a50f466b Packages in this update:

• wordpress-6.9.6-1.fc43

Update description: Security updates included in this release

• Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai. CVE-2026-64638
• Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes (amosec)
• Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by n05ec
• Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal
• Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team
• A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security
• An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team
• Enumeration of post slugs reported by HDWSec
• Disclosure of notes in comment feeds reported by Elio Gubser
• Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic
• Bypass of the email address confirmation flow reported by 0ways
• A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by Andrew Mohawk and multiple independent reporters

FEDORA-EPEL-2026-180c91b119 Packages in this update:

• wordpress-6.9.6-1.el10_2

Update description: Security updates included in this release

• Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai. CVE-2026-64638
• Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes (amosec)
• Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by n05ec
• Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal
• Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team
• A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security
• An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team
• Enumeration of post slugs reported by HDWSec
• Disclosure of notes in comment feeds reported by Elio Gubser
• Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic
• Bypass of the email address confirmation flow reported by 0ways
• A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by Andrew Mohawk and multiple independent reporters

FEDORA-EPEL-2026-ced33edbed Packages in this update:

• wordpress-6.9.6-1.el9

Update description: Security updates included in this release

• Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai. CVE-2026-64638
• Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes (amosec)
• Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by n05ec
• Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal
• Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team
• A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security
• An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team
• Enumeration of post slugs reported by HDWSec
• Disclosure of notes in comment feeds reported by Elio Gubser
• Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic
• Bypass of the email address confirmation flow reported by 0ways
• A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by Andrew Mohawk and multiple independent reporters

FEDORA-2026-572debb8a7 Packages in this update:

• wordpress-6.9.6-1.fc44

Update description: Security updates included in this release

• Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai. CVE-2026-64638
• Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes (amosec)
• Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by n05ec
• Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal
• Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team
• A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security
• An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team
• Enumeration of post slugs reported by HDWSec
• Disclosure of notes in comment feeds reported by Elio Gubser
• Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic
• Bypass of the email address confirmation flow reported by 0ways
• A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by Andrew Mohawk and multiple independent reporters

FEDORA-EPEL-2026-43fd90996e Packages in this update:

• wordpress-7.0.3-1.el10_3

Update description: Security updates included in this release

• Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai. CVE-2026-64638
• Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes (amosec)
• Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by n05ec
• Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal
• Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team
• A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security
• An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team
• Enumeration of post slugs reported by HDWSec
• Disclosure of notes in comment feeds reported by Elio Gubser
• Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic
• Bypass of the email address confirmation flow reported by 0ways
• A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by Andrew Mohawk and multiple independent reporters

FEDORA-2026-b79a5390a7 Packages in this update:

• kernel-7.1.7-100.fc43

Update description:

The 7.1.7 stable kernel update contains a fix for CVE-2026-68480

FEDORA-2026-c3d9971785 Packages in this update:

• kernel-7.1.7-200.fc44

Update description:

The 7.1.7 stable kernel update contains a fix for CVE-2026-68480

Version:7.1.7 (stable) Released:2026-08-06 Source:linux-7.1.7.tar.xz PGP Signature:linux-7.1.7.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-7.1.7

Version:6.18.43 (longterm) Released:2026-08-06 Source:linux-6.18.43.tar.xz PGP Signature:linux-6.18.43.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.18.43

Version:6.6.149 (longterm) Released:2026-08-06 Source:linux-6.6.149.tar.xz PGP Signature:linux-6.6.149.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.6.149

Version:6.1.181 (longterm) Released:2026-08-06 Source:linux-6.1.181.tar.xz PGP Signature:linux-6.1.181.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.1.181

Version:5.15.214 (longterm) Released:2026-08-06 Source:linux-5.15.214.tar.xz PGP Signature:linux-5.15.214.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-5.15.214

Version:5.10.263 (longterm) Released:2026-08-06 Source:linux-5.10.263.tar.xz PGP Signature:linux-5.10.263.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-5.10.263

FEDORA-2026-1925a10b0b Packages in this update:

• udisks2-2.11.2-1.fc43

Update description:

Update to the latest upstream release 2.11.2

FEDORA-2026-ae4aff6b6f Packages in this update:

• udisks2-2.11.2-1.fc44

Update description:

Update to the latest upstream release 2.11.2

Version:next-20260806 (linux-next) Released:2026-08-06

FEDORA-2026-e281fdcb69 Packages in this update:

• p11-kit-0.26.5-1.fc43

Update description:

rpc: guard against overflow when decoding nested attributes (CVE-2026-18938) Only affects 32 bit systems

FEDORA-2026-110c1a7742 Packages in this update:

• p11-kit-0.26.5-1.fc44

Update description:

rpc: guard against overflow when decoding nested attributes (CVE-2026-18938) Only affects 32 bit systems

FEDORA-EPEL-2026-c8a0627014 Packages in this update:

• pdns-5.0.7-1.el10_3

Update description:

• Update to 5.0.7

Release notes: https://docs.powerdns.com/authoritative/changelog/5.0.html#change-5.0.7 Security Advisory: https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-11.html

FEDORA-EPEL-2026-c370055154 Packages in this update:

• pdns-5.0.7-1.el10_2

Update description:

• Update to 5.0.7

Release notes: https://docs.powerdns.com/authoritative/changelog/5.0.html#change-5.0.7 Security Advisory: https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-11.html