Fedora Security Advisories

• postgresql16-postgis-3.6.4-5.fc45
• postgresql17-postgis-3.6.4-5.fc45
• postgresql18-postgis-3.6.4-5.fc45

Backport fix for CVE-2026-73515.

• postgresql16-postgis-3.6.4-5.fc43
• postgresql17-postgis-3.6.4-5.fc43
• postgresql18-postgis-3.6.4-5.fc43

Backport fix for CVE-2026-73515.

• postgresql16-postgis-3.6.4-5.fc44
• postgresql17-postgis-3.6.4-5.fc44
• postgresql18-postgis-3.6.4-5.fc44

Backport fix for CVE-2026-73515.

• chromium-153.0.8010.36-1.el9

Update to 153.0.8010.36, it fixes 230 CVEs: CVE-2026-87429 - CVE-2026-87658

• mongo-c-driver-1.30.11-1.el9

Fixes

• Fix length check in bson_new_from_buffer.

Fixes

• Fix allocation in Windows Secure Channel.
• Fix error handling in SCRAM authentication.

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-1.30.11-1.fc43

Fixes

• Fix length check in bson_new_from_buffer.

Fixes

• Fix allocation in Windows Secure Channel.
• Fix error handling in SCRAM authentication.

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-1.30.11-1.el10_2

Fixes

• Fix length check in bson_new_from_buffer.

Fixes

• Fix allocation in Windows Secure Channel.
• Fix error handling in SCRAM authentication.

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-1.30.11-1.el8

Fixes

• Fix length check in bson_new_from_buffer.

Fixes

• Fix allocation in Windows Secure Channel.
• Fix error handling in SCRAM authentication.

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-1.30.11-1.fc44

Fixes

• Fix length check in bson_new_from_buffer.

Fixes

• Fix allocation in Windows Secure Channel.
• Fix error handling in SCRAM authentication.

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-2.5.4-1.fc45

Fixes

• Fix allocation in Windows Secure Channel.

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-2.5.4-1.el10_3

Fixes

• Fix allocation in Windows Secure Channel.

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-2.5.4-1.el10_4

Fixes

• Fix allocation in Windows Secure Channel.

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• wordpress-6.9.8-1.el9

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

• wordpress-6.9.8-1.fc43

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

• wordpress-6.9.8-1.el10_2

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

• wordpress-6.9.8-1.fc44

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

• wordpress-7.1.1-1.el10_3

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

• wordpress-7.1.1-1.fc45

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

• wordpress-7.1.1-1.el10_4

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

• ckermit-11.0.509-2.fc45

Update to 11.0.509 with security fix