Fedora Security Advisories

• nextcloud-33.0.5-1.el10_2

33.0.5 Release

• nextcloud-33.0.5-1.el10_3

33.0.5 Release

• nextcloud-33.0.5-1.fc43

33.0.5 Release

• nextcloud-33.0.5-1.fc44

33.0.5 Release

• openslide-3.4.1-20.el8

Fix arbitrary memory write with crafted Ventana BIF file (CVE-2026-48977).

• openslide-3.4.1-20.el9

Fix arbitrary memory write with crafted Ventana BIF file (CVE-2026-48977).

• openslide-4.0.0-8.el10_3

Fix arbitrary memory write with crafted Ventana BIF file (CVE-2026-48977).

• openslide-4.0.0-14.fc43

Fix arbitrary memory write with crafted Ventana BIF file (CVE-2026-48977).

• openslide-4.0.0-14.fc44

Fix arbitrary memory write with crafted Ventana BIF file (CVE-2026-48977).

• ack-3.10.0-1.fc43

Update to version 3.10.0

• ack-3.10.0-1.fc44

Update to version 3.10.0

• hugo-0.162.1-1.fc43

Update to 0.162.1 (rhbz#2455512)

• hugo-0.162.1-1.fc44

Update to 0.162.1 (rhbz#2455512)

• perl-Mojo-JWT-1.02-1.fc44

This release of Mojo::JWT Improves the security of decode to prevent timing side-channel attacks in symmetric signatures

• perl-Mojo-JWT-1.02-1.fc43

This release of Mojo::JWT Improves the security of decode to prevent timing side-channel attacks in symmetric signatures

• python-django4.2-4.2.30-2.el9

• Backport fix for CVE-2026-35192 (low): Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
• Django 4.2.30 fixes one security issue with severity “moderate” and four security issues with severity “low” in 4.2.29
• CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload [moderate]
• CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation
• CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin
• CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable
• CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass
• Django 4.2.29 fixes a security issue with severity “moderate” and a security issue with severity “low” in 4.2.28
• CVE-2026-25673: Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows [moderate]
• CVE-2026-25674: Potential incorrect permissions on newly created file system objects

• chromium-149.0.7827.53-1.el10_2

Update to 149.0.7827.53

• fix 429 CVEs ( CVE-2026-10881 through CVE-2026-11309)

• chromium-149.0.7827.53-1.fc43

Update to 149.0.7827.53

• fix 429 CVEs ( CVE-2026-10881 through CVE-2026-11309)

• chromium-149.0.7827.53-1.el10_3

Update to 149.0.7827.53

• fix 429 CVEs ( CVE-2026-10881 through CVE-2026-11309)

• chromium-149.0.7827.53-1.el9

Update to 149.0.7827.53

• fix 429 CVEs ( CVE-2026-10881 through CVE-2026-11309)