Fedora Security Advisories

• dotnet10.0-10.0.111-1.fc43

Update to .NET SDK 10.0.111 and Runtime 10.0.11

Fixes: CVE-2026-62871,CVE-2026-62886,CVE-2026-62897,CVE-2026-62898,CVE-2026-62899,CVE-2026-62900,CVE-2026-62901,CVE-2026-62902,CVE-2026-62909,CVE-2026-70354

Release Notes:

• SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.11/10.0.111.md
• Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.11/10.0.11.md

• wordpress-6.9.7-1.fc43

Security update included in this release

• Authenticated Author+ remote code execution via malicious file upload on sites that use Imagick and Ghostscript. CVE-2026-65640

Security update included in this release

• Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai. CVE-2026-64638
• Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes (amosec)
• Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by n05ec
• Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal
• Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team
• A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security
• An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team
• Enumeration of post slugs reported by HDWSec
• Disclosure of notes in comment feeds reported by Elio Gubser
• Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic
• Bypass of the email address confirmation flow reported by 0ways
• A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by Andrew Mohawk and multiple independent reporters

• wordpress-6.9.7-1.el9

Security update included in this release

• Authenticated Author+ remote code execution via malicious file upload on sites that use Imagick and Ghostscript. CVE-2026-65640

Security update included in this release

• Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai. CVE-2026-64638
• Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes (amosec)
• Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by n05ec
• Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal
• Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team
• A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security
• An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team
• Enumeration of post slugs reported by HDWSec
• Disclosure of notes in comment feeds reported by Elio Gubser
• Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic
• Bypass of the email address confirmation flow reported by 0ways
• A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by Andrew Mohawk and multiple independent reporters

• wordpress-6.9.7-1.fc44

Security update included in this release

• Authenticated Author+ remote code execution via malicious file upload on sites that use Imagick and Ghostscript. CVE-2026-65640

Security update included in this release

• Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai. CVE-2026-64638
• Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes (amosec)
• Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by n05ec
• Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal
• Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team
• A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security
• An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team
• Enumeration of post slugs reported by HDWSec
• Disclosure of notes in comment feeds reported by Elio Gubser
• Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic
• Bypass of the email address confirmation flow reported by 0ways
• A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by Andrew Mohawk and multiple independent reporters

• wordpress-7.0.4-1.el10_3

Security update included in this release

• Authenticated Author+ remote code execution via malicious file upload on sites that use Imagick and Ghostscript. CVE-2026-65640

Security update included in this release

• Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai. CVE-2026-64638
• Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes (amosec)
• Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by n05ec
• Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal
• Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team
• A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security
• An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team
• Enumeration of post slugs reported by HDWSec
• Disclosure of notes in comment feeds reported by Elio Gubser
• Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic
• Bypass of the email address confirmation flow reported by 0ways
• A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by Andrew Mohawk and multiple independent reporters

• wordpress-6.9.7-1.el10_2

Security update included in this release

• Authenticated Author+ remote code execution via malicious file upload on sites that use Imagick and Ghostscript. CVE-2026-65640

Security update included in this release

• Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai. CVE-2026-64638
• Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes (amosec)
• Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by n05ec
• Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal
• Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team
• A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security
• An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team
• Enumeration of post slugs reported by HDWSec
• Disclosure of notes in comment feeds reported by Elio Gubser
• Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic
• Bypass of the email address confirmation flow reported by 0ways
• A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by Andrew Mohawk and multiple independent reporters

• trafficserver-10.2.0-1.fc43

Update to upstream 10.2.0.

• trafficserver-10.2.0-1.fc44

Update to upstream 10.2.0.

• libnfs-5.0.3-3.el10_3

Fixes CVE-2026-53689

• libnfs-4.0.0-2.el8

Fixes CVE-2026-53689

• libnfs-5.0.3-3.el9

Fixes CVE-2026-53689

• libnfs-5.0.3-3.el10_2

Fixes CVE-2026-53689

• python-alembic-1.19.1-1.fc43
• python-asyncmy-0.2.14-1.fc43
• python-sqlalchemy-2.0.52-1.fc43

This update contains new upstream releases for python-sqlalchemy (bugfixes), python-alembic (bugfixes) and python-asyncmy (bugfixes, security fixes and enhancements).

Please refer to upstream release notes and changelogs for details:

• python-sqlalchemy: version 2.0.52
• python-alembic: version 1.19.1
• python-asyncmy: versions 0.2.12, 0.2.13 and 0.2.14

• python-alembic-1.19.1-1.fc44
• python-asyncmy-0.2.14-1.fc44
• python-sqlalchemy-2.0.52-1.fc44

This update contains new upstream releases for python-sqlalchemy (bugfixes), python-alembic (bugfixes) and python-asyncmy (bugfixes, security fixes and enhancements).

Please refer to upstream release notes and changelogs for details:

• python-sqlalchemy: version 2.0.52
• python-alembic: version 1.19.1
• python-asyncmy: versions 0.2.12, 0.2.13 and 0.2.14

• darktable-5.4.1-12.fc46
• digikam-9.1.0-3.fc46
• ffmpeg-8.1.2-10.fc46
• geeqie-2.7-6.fc46
• gimp-3.2.4-4.fc46
• GraphicsMagick-1.3.45-10.fc46
• gthumb-4.0~beta-4.fc46
• ImageMagick-7.1.2.29-2.fc46
• imlib2-1.12.5-4.fc46
• imv-5.0.1-4.fc46
• kf5-kimageformats-5.116.0-12.fc46
• kf6-kimageformats-6.29.0-2.fc46
• libheif-1.23.1-9.fc46
• mingw-openexr-3.4.13-3.fc46
• mpv-0.41.0-8.fc46
• openapv-0.3.0.0-1.fc46
• OpenImageIO2.5-2.5.19.1-17.fc46
• OpenImageIO-3.1.15.0-4.fc46
• openjph-0.31.0-1.fc46
• perl-Prima-1.77-6.fc46
• python-imagecodecs-2025.8.2-7.fc46
• siril-1.4.4-3.fc46
• swayimg-5.5-2.fc46
• vapoursynth-79-3.fc46
• vips-8.18.3-4.fc46
• xevd-0.7.0-2.fc46
• xeve-0.7.0-2.fc46

Updated xeve/xevd, updated openapv and updated vapoursynth.

• darktable-5.4.1-12.fc45
• digikam-9.1.0-3.fc45
• ffmpeg-8.1.2-10.fc45
• geeqie-2.7-6.fc45
• gimp-3.2.4-4.fc45
• GraphicsMagick-1.3.45-10.fc45
• gthumb-4.0~beta-4.fc45
• ImageMagick-7.1.2.29-2.fc45
• imlib2-1.12.5-4.fc45
• imv-5.0.1-4.fc45
• kf5-kimageformats-5.116.0-12.fc45
• kf6-kimageformats-6.29.0-2.fc45
• libheif-1.23.1-9.fc45
• mingw-openexr-3.4.13-3.fc45
• mpv-0.41.0-8.fc45
• openapv-0.3.0.0-1.fc45
• OpenImageIO2.5-2.5.19.1-17.fc45
• OpenImageIO-3.1.15.0-4.fc45
• openjph-0.31.0-1.fc45
• perl-Prima-1.77-6.fc45
• python-imagecodecs-2025.8.2-7.fc45
• siril-1.4.4-3.fc45
• swayimg-5.5-2.fc45
• vapoursynth-79-3.fc45
• vips-8.18.3-4.fc45
• xevd-0.7.0-2.fc45
• xeve-0.7.0-2.fc45

Updated xeve/xevd, updated openapv and updated vapoursynth.

• python-watchfiles-1.2.0-3.el10_3

Update from 1.0.4 to 1.2.0. This also updates the PyO3 build requirement to 0.29 to address two RUSTSEC advisories.

Relevant watchfiles release notes:

• https://github.com/samuelcolvin/watchfiles/releases/tag/v1.0.5
• https://github.com/samuelcolvin/watchfiles/releases/tag/v1.1.0
• https://github.com/samuelcolvin/watchfiles/releases/tag/v1.1.1
• https://github.com/samuelcolvin/watchfiles/releases/tag/v1.2.0

PyO3 advisories:

• https://rustsec.org/advisories/RUSTSEC-2026-0176.html
• https://rustsec.org/advisories/RUSTSEC-2026-0177.html

• python3.13-3.13.15-1.el10_2

Update to Python 3.13.15

• python3.13-3.13.15-1.el9

Update to Python 3.13.15

• python3.13-3.13.15-1.el10_3

Update to Python 3.13.15