Aggregator

FEDORA-2026-1e23d80c94 Packages in this update:

• librsvg2-2.63.2-1.fc45
• rust-librsvg-2.63.2-1.fc45
• rust-xml5ever-0.39.0-1.fc45

Update description:

Update librsvg to version 2.63.2.

This includes a fix for a potential use-after-free bug (assigned RUSTSEC-2026-0305, also assigned CVE-2026-96889 - see upstream bug report).

It was discovered that NetworkManager did not properly restrict the ca-path and phase2-ca-path certificate authority settings for private (single-user) 802.1X network connections. An attacker could use this issue to point their own private 802.1X connection profile at a directory under their control, causing NetworkManager to trust an attacker-chosen certificate authority and potentially exposing network credentials via a rogue authentication server.

FEDORA-2026-9e80aed94f Packages in this update:

• hplip-3.26.6-1.fc44

Update description:

3.26.6, fixes CVE-2026-91105,CVE-2026-91103,CVE-2026-91102,CVE-2026-91101,

CVE-2026-91100,CVE-2026-91099,CVE-2026-91098,CVE-2026-91097

FEDORA-2026-ebccf08143 Packages in this update:

• hplip-3.26.6-1.fc45

Update description:

3.26.6, fixes CVE-2026-91105,CVE-2026-91103,CVE-2026-91102,CVE-2026-91101,

CVE-2026-91100,CVE-2026-91099,CVE-2026-91098,CVE-2026-91097

FEDORA-2026-ff8f6f4444 Packages in this update:

• freerdp-3.32.0-1.fc45

Update description:

Update to 3.32.0

FEDORA-2026-d021fefd24 Packages in this update:

• freerdp-3.32.0-1.fc44

Update description:

Update to 3.32.0

FEDORA-2026-2c0751e1a3 Packages in this update:

• freerdp-3.32.0-1.fc43

Update description:

Update to 3.32.0

FEDORA-2026-fdb231ab53 Packages in this update:

• fetchmail-6.6.8-1.fc43

Update description:

Update to fetchmail-6.6.8 (CVE-2026-94184)

Update to fetchmail-6.6.7

FEDORA-2026-ffdc059b16 Packages in this update:

• fetchmail-6.6.8-1.fc44

Update description:

Update to fetchmail-6.6.8 (CVE-2026-94184)

Update to fetchmail-6.6.7

FEDORA-2026-d804dc1feb Packages in this update:

• rust-librsvg-2.63.2-1.fc46
• rust-xml5ever-0.39.0-1.fc46

Update description:

• Update the librsvg crate to version 2.63.2.
• Update the xml5ever crate to version 0.39.0.

This includes fixes for RUSTSEC-2026-0305.

FEDORA-2026-8ffc03a2ce Packages in this update:

• fetchmail-6.6.8-1.fc45

Update description:

Update to fetchmail-6.6.8 (CVE-2026-94184)

Update to fetchmail-6.6.7

FEDORA-EPEL-2026-1d4952c503 Packages in this update:

• slurm-22.05.11-2.el9

Update description:

update changelog

FEDORA-2026-74510edd4e Packages in this update:

• slurm-26.05.4-1.fc45

Update description:

Update to 26.05.4

FEDORA-2026-7f9c69a63c Packages in this update:

• wordpress-6.9.9-1.fc44

Update description: WordPress 6.9.9 Security Release

Security updates included in this release

• Unauthenticated path traversal in page-template resolution leading to conditional RCE CVE-2026-87902

WordPress 6.9.8 Security Release

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

FEDORA-EPEL-2026-fa7b2ec3a3 Packages in this update:

• wordpress-6.9.9-1.el10_2

Update description: WordPress 6.9.9 Security Release

Security updates included in this release

• Unauthenticated path traversal in page-template resolution leading to conditional RCE CVE-2026-87902

WordPress 6.9.8 Security Release

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

FEDORA-2026-5c9d8e41a9 Packages in this update:

• wordpress-6.9.9-1.fc43

Update description: WordPress 6.9.9 Security Release

Security updates included in this release

• Unauthenticated path traversal in page-template resolution leading to conditional RCE CVE-2026-87902

WordPress 6.9.8 Security Release

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

FEDORA-EPEL-2026-c032162b28 Packages in this update:

• wordpress-6.9.9-1.el9

Update description: WordPress 6.9.9 Security Release

Security updates included in this release

• Unauthenticated path traversal in page-template resolution leading to conditional RCE CVE-2026-87902

WordPress 6.9.8 Security Release

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

FEDORA-EPEL-2026-14c20cf8b8 Packages in this update:

• wordpress-7.1.2-1.el10_3

Update description: WordPress 7.1.2 Security Release

Security updates included in this release

• Unauthenticated path traversal in page-template resolution leading to conditional RCE CVE-2026-87902

WordPress 7.1.1 Maintenance and Security Release

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

FEDORA-2026-c7024b3255 Packages in this update:

• wordpress-7.1.2-1.fc45

Update description: WordPress 7.1.2 Security Release

Security updates included in this release

• Unauthenticated path traversal in page-template resolution leading to conditional RCE CVE-2026-87902

WordPress 7.1.1 Maintenance and Security Release

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

FEDORA-EPEL-2026-9a22fff830 Packages in this update:

• wordpress-7.1.2-1.el10_4

Update description: WordPress 7.1.2 Security Release

Security updates included in this release

• Unauthenticated path traversal in page-template resolution leading to conditional RCE CVE-2026-87902

WordPress 7.1.1 Maintenance and Security Release

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.