Lector de Feeds

Publication date: 02 Nov 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-35501 , CVE-2026-50106 , CVE-2026-96405 , CVE-2026-97206 , CVE-2026-109125 Description
Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. Aggregate DNS name chained pointer decompression work leads to degradation of service. DNS-over-QUIC path-migration can lead to use-after-free on multi-threaded deployments. Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'. References

• https://bugs.mageia.org/show_bug.cgi?id=36568
• https://nlnetlabs.nl/projects/unbound/security-advisories/
• https://www.cve.org/CVERecord?id=CVE-2026-35501
• https://www.cve.org/CVERecord?id=CVE-2026-50106
• https://www.cve.org/CVERecord?id=CVE-2026-96405
• https://www.cve.org/CVERecord?id=CVE-2026-97206
• https://www.cve.org/CVERecord?id=CVE-2026-109125

SRPMS 10/core

• unbound-1.26.2-1.mga10

Publication date: 02 Nov 2026
Type: bugfix
Affected Mageia releases : 10
Description
This update fixes a reported performance issue with dnfdragora-updater References

• https://bugs.mageia.org/show_bug.cgi?id=36522

SRPMS 10/core

• dnfdragora-2.99.5-1.mga10
• python-manatools-0.99.3-1.mga10

Publication date: 02 Nov 2026
Type: bugfix
Affected Mageia releases : 10
Description
Use of online help requires gvfs packages, but for desktops that don't depend on gvfs the packages are absent. References

• https://bugs.mageia.org/show_bug.cgi?id=32976

SRPMS 10/core

• gimp-3.2.4-1.1.mga10

Publication date: 02 Nov 2026
Type: bugfix
Affected Mageia releases : 10
Description
Updated plamas-desktop package provides a bug fix from the KDE Team in the Folder View widget. References

• https://bugs.mageia.org/show_bug.cgi?id=36584
• https://bugs.kde.org/show_bug.cgi?id=508634
• https://invent.kde.org/plasma/plasma-desktop/-/merge_requests/3319

SRPMS 10/core

• plasma-desktop-6.5.5-2.1.mga10

Publication date: 30 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-53583 , CVE-2026-53584 , CVE-2026-53585 , CVE-2026-53586 , CVE-2026-53587 , CVE-2026-5917 Description
Inverted IP SubjectAltName Comparison in OpenSSL Backend. (CVE-2026-53583) Submodule path traversal. (CVE-2026-53584) Unbounded Memory Allocation via Delta Object Result-Size Header. (CVE-2026-53585) HTTP transport can leak credentials to an offsite redirect target. (CVE-2026-53586) Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data. (CVE-2026-53587) Shell Command Injection via ssh_libssh2 Backend. (CVE-2026-5917) References

• https://bugs.mageia.org/show_bug.cgi?id=35993
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VHH635RSSSNGD55XOG7MSUBAC6CK77E2/
• https://www.openwall.com/lists/oss-security/2026/08/20/4
• https://ubuntu.com/security/notices/USN-8628-1
• https://lists.debian.org/debian-security-announce/2026/msg00364.html
• https://www.cve.org/CVERecord?id=CVE-2026-53583
• https://www.cve.org/CVERecord?id=CVE-2026-53584
• https://www.cve.org/CVERecord?id=CVE-2026-53585
• https://www.cve.org/CVERecord?id=CVE-2026-53586
• https://www.cve.org/CVERecord?id=CVE-2026-53587
• https://www.cve.org/CVERecord?id=CVE-2026-5917

SRPMS 10/core

• libgit2-1.9.2-1.1.mga10

Publication date: 30 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-48863 , CVE-2026-9149 , CVE-2026-9150 Description
Stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service. (CVE-2026-48863) Heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file. (CVE-2026-9149) Stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums. (CVE-2026-9150) References

• https://bugs.mageia.org/show_bug.cgi?id=35622
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/PL7NOS4HGJC62EYY2MRUQZ4UUZOKY7C2/
• https://bugzilla.redhat.com/show_bug.cgi?id=2460975
• https://bugzilla.redhat.com/show_bug.cgi?id=2460380
• https://bugzilla.redhat.com/show_bug.cgi?id=2460379
• https://www.cve.org/CVERecord?id=CVE-2026-48863
• https://www.cve.org/CVERecord?id=CVE-2026-9149
• https://www.cve.org/CVERecord?id=CVE-2026-9150

SRPMS 10/core

• libsolv-0.7.39-1.mga10

Publication date: 30 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
Move Isodumper in MCC to the "local disks" section, show the entry even when it isn't installed (let then clicking it install it) - mga#29966 Mageia Control Center and cia, were not following the dark theme in Plasma. - mga#26460 Add a link to our tool for removing unused localisations and translations, remove-unused-packages - mga#27372 Hovering over an unselected item in the left panel of MCC makes it almost invisible (black on dark blue) - mga#32431 Add trac to wizards - mga#33817 References

• https://bugs.mageia.org/show_bug.cgi?id=29966
• https://bugs.mageia.org/show_bug.cgi?id=26460
• https://bugs.mageia.org/show_bug.cgi?id=27372
• https://bugs.mageia.org/show_bug.cgi?id=32431
• https://bugs.mageia.org/show_bug.cgi?id=33817

SRPMS 10/core

• drakconf-13.45-1.mga10

Publication date: 30 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-74048 , CVE-2026-74049 , CVE-2026-80353 , CVE-2026-88041 , CVE-2026-93446 , CVE-2026-101296 , CVE-2026-101356 Description
OpenSSL-FFM FIPS failure does not prevent start-up. (CVE-2026-74048) Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE). (CVE-2026-74049) TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector. (CVE-2026-80353) HTTP/2 trailer header cross-contamination. (CVE-2026-88041) Possible TLS 1.3 connection failures. (CVE-2026-93446) JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms. (CVE-2026-101296) HTTP/2 request/response mix-up after error during async processing. (CVE-2026-101356) References

• https://bugs.mageia.org/show_bug.cgi?id=36554
• https://www.openwall.com/lists/oss-security/2026/10/20/21
• https://www.openwall.com/lists/oss-security/2026/10/20/22
• https://www.openwall.com/lists/oss-security/2026/10/20/23
• https://www.openwall.com/lists/oss-security/2026/10/20/24
• https://www.openwall.com/lists/oss-security/2026/10/20/25
• https://www.openwall.com/lists/oss-security/2026/10/20/26
• https://www.openwall.com/lists/oss-security/2026/10/20/27
• https://www.cve.org/CVERecord?id=CVE-2026-74048
• https://www.cve.org/CVERecord?id=CVE-2026-74049
• https://www.cve.org/CVERecord?id=CVE-2026-80353
• https://www.cve.org/CVERecord?id=CVE-2026-88041
• https://www.cve.org/CVERecord?id=CVE-2026-93446
• https://www.cve.org/CVERecord?id=CVE-2026-101296
• https://www.cve.org/CVERecord?id=CVE-2026-101356

SRPMS 10/core

• tomcat-9.0.123-1.mga10

Publication date: 30 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-111124 , CVE-2026-111125 Description
CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read through fits_open_file() and fits_read_pix(), to cause crashes or leak heap contents in decoded pixels. References

• https://bugs.mageia.org/show_bug.cgi?id=36537
• https://github.com/HEASARC/cfitsio
• https://www.cve.org/CVERecord?id=CVE-2026-111124
• https://www.cve.org/CVERecord?id=CVE-2026-111125

SRPMS 10/core

• cfitsio-4.7.0-1.mga10

Publication date: 30 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-41252 , CVE-2026-41521 , CVE-2026-44178 , CVE-2026-42218 , CVE-2026-44978 , CVE-2026-54538 , CVE-2026-55238 , CVE-2026-55626 , CVE-2026-55639 , CVE-2026-55645 Description
lib_palette_update Heap Buffer Overflow & RCE. (CVE-2026-41252) lib_framebuffer_update Has Integer Overflow Heap Info Leak & ASLR Bypass. (CVE-2026-41521) Channel Data Forwarding Fixed-Size Buffer Overflow. (CVE-2026-44178) XRDP is vulnerable to a server timing attack, leading to user enumeration. (CVE-2026-42218) Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification. (CVE-2026-44978) Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER. (CVE-2026-54538) Malformed Confirm Active capability sets cause out-of-bounds reads. (CVE-2026-55238) No authentication required with Xvnc backend. (CVE-2026-55626) Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY). (CVE-2026-55639) Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control). (CVE-2026-55645) References

• https://bugs.mageia.org/show_bug.cgi?id=35945
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5ZQ6QE47Z3SMILAAOHQ2RKDQFJOK2M4X/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JWYOEVBA3574FXNPXKDS3FPNCQ3SDAOM/
• https://lists.debian.org/debian-security-announce/2026/msg00380.html
• https://www.cve.org/CVERecord?id=CVE-2026-41252
• https://www.cve.org/CVERecord?id=CVE-2026-41521
• https://www.cve.org/CVERecord?id=CVE-2026-44178
• https://www.cve.org/CVERecord?id=CVE-2026-42218
• https://www.cve.org/CVERecord?id=CVE-2026-44978
• https://www.cve.org/CVERecord?id=CVE-2026-54538
• https://www.cve.org/CVERecord?id=CVE-2026-55238
• https://www.cve.org/CVERecord?id=CVE-2026-55626
• https://www.cve.org/CVERecord?id=CVE-2026-55639
• https://www.cve.org/CVERecord?id=CVE-2026-55645

SRPMS 10/core

• xrdp-0.10.6.1-2.mga10

Publication date: 30 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
This last version of guayadeque-1.0.2-3 corrects some bugs that appeared when using previous 0.7.* versions References

• https://bugs.mageia.org/show_bug.cgi?id=36535
• https://codeberg.org/thothix/guayadeque/releases/tag/v1.0.2
• https://codeberg.org/thothix/guayadeque/releases/tag/v1.0.1
• https://codeberg.org/thothix/guayadeque/releases/tag/v1.0.0

SRPMS 10/core

• guayadeque-1.0.2-3.mga10

Publication date: 29 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-12345 , CVE-2026-19553 , CVE-2026-19445 , CVE-2026-114583 Description
CVE-2026-12345 The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms. CVE-2026-19553 `ssl.SSLContext.wrap_bio()` didn't require the `server_hostname` argument to not be `None` if `ssl.SSLContext.check_hostname` was set. Due to a missing parameter check in `SSLObject`, if the `server_hostname` argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with `SSLContext.check_hostname = True` and no `ValueError` being raised due to misconfiguration. If the program passes a `server_hostname` value that isn't an empty string or `None` to any of these APIs then certificate hostname verification proceeds as expected and the program is not affected by this vulnerability. Mitigating this vulnerability doesn't require updating Python or applying the patch. To mitigate, pass a valid non-`None` and non-empty `server_hostname` value to `SSLContext.wrap_bio()`, `asyncio.create_connection()`, or `asyncio.loop.start_tls()` and certificate hostname verification will proceed as expected. Upgrading to the latest version of Python or applying the patch only changes the behavior from silently skipping hostname verification to raising a `ValueError`, similar to `SSLContext.wrap_socket()`, when `server_hostname` isn't supplied. CVE-2026-19445 A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected. CVE-2026-114583 tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter. References

• https://bugs.mageia.org/show_bug.cgi?id=36420
• https://www.openwall.com/lists/oss-security/2026/09/29/40
• https://www.openwall.com/lists/oss-security/2026/09/30/16
• https://www.openwall.com/lists/oss-security/2026/09/30/17
• https://www.openwall.com/lists/oss-security/2026/10/22/33
• https://www.cve.org/CVERecord?id=CVE-2026-12345
• https://www.cve.org/CVERecord?id=CVE-2026-19553
• https://www.cve.org/CVERecord?id=CVE-2026-19445
• https://www.cve.org/CVERecord?id=CVE-2026-114583

SRPMS 10/core

• python3-3.13.17-1.mga10
• python-pip-26.2.2-1.mga10

Publication date: 28 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
'urpme --auto-orphans' can't be used without removing all backup kernels (mga#31699) 'urpme --auto-orphans' will remove the currently running kernel if a newer one is installed (mga#31799) When starting drakrpm from the command line, there is a long list of messages saying it would install instead of upgrade kernel packages (mga#32936) When aria2 is set as the downloader, mgaapplet fails to detect new distributions (mga#35872) References

• https://bugs.mageia.org/show_bug.cgi?id=36528
• https://bugs.mageia.org/show_bug.cgi?id=31699
• https://bugs.mageia.org/show_bug.cgi?id=31799
• https://bugs.mageia.org/show_bug.cgi?id=32936
• https://bugs.mageia.org/show_bug.cgi?id=35872

SRPMS 10/core

• urpmi-8.137-1.1.mga10

Publication date: 28 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-30656 Description
A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option. The callback function str_fdp_pli_cb() does not validate the input pointer and calls strdup() on a NULL value when the option is specified without an argument. This results in a segmentation fault and process crash. (CVE-2026-30656) References

• https://bugs.mageia.org/show_bug.cgi?id=36480
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/GV237ENVXHS5VMJOZ2CB5ESWMM43O5X6/
• https://www.cve.org/CVERecord?id=CVE-2026-30656

SRPMS 10/core

• fio-3.41-4.2.mga10

Publication date: 28 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
mgaapplet-upgrade-helper crash under a Wayland session. - mga#29182 Plasma 6.8 drops its X11 session which will produce issues if you migrate to Cauldron while working on Plasma X11. We now prevent users from performing a migration in those conditions. - mga#36526 References

• https://bugs.mageia.org/show_bug.cgi?id=29182
• https://bugs.mageia.org/show_bug.cgi?id=36526

SRPMS 10/core

• mgaonline-3.36-1.mga10

Publication date: 28 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
This update makes harddrake2 provide more information about the memory installed in the system. References

• https://bugs.mageia.org/show_bug.cgi?id=15922

SRPMS 10/core

• drakxtools-18.83-1.mga10

Publication date: 28 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-110752 , CVE-2026-110753 , CVE-2026-110754 , CVE-2026-110755 , CVE-2026-110756 , CVE-2026-110757 , CVE-2026-110758 , CVE-2026-110759 Description
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. (CVE-2026-110752) Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. (CVE-2026-110753) Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. (CVE-2026-110754) Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. (CVE-2026-110755) Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. (CVE-2026-110756) Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. (CVE-2026-110757) Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. (CVE-2026-110758) Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. (CVE-2026-110759) References

• https://bugs.mageia.org/show_bug.cgi?id=36532
• https://www.openwall.com/lists/oss-security/2026/10/16/38
• https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes
• https://www.cve.org/CVERecord?id=CVE-2026-110752
• https://www.cve.org/CVERecord?id=CVE-2026-110753
• https://www.cve.org/CVERecord?id=CVE-2026-110754
• https://www.cve.org/CVERecord?id=CVE-2026-110755
• https://www.cve.org/CVERecord?id=CVE-2026-110756
• https://www.cve.org/CVERecord?id=CVE-2026-110757
• https://www.cve.org/CVERecord?id=CVE-2026-110758
• https://www.cve.org/CVERecord?id=CVE-2026-110759

SRPMS 10/core

• perl-Text-CSV_XS-1.650.0-1.mga10

Publication date: 28 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-94652 , CVE-2026-94657 , CVE-2026-83632 , CVE-2026-85088 , CVE-2026-66055 , CVE-2026-90440 , CVE-2026-94656 , CVE-2026-66859 , CVE-2026-87117 , CVE-2026-96287 , CVE-2026-94645 , CVE-2026-61373 , CVE-2026-96294 , CVE-2026-96292 Description
The updated packages fix many security vulnerabilities. Please see the links for additional information. References

• https://bugs.mageia.org/show_bug.cgi?id=36534
• https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1
• https://lists.apache.org/thread/nodwz7gjvogkkh3w1jwbsslk1c7t0727
• https://lists.apache.org/thread/lpcmo2xjfyfww474xdyyfypkqthk9s14
• https://lists.apache.org/thread/zjv6hjmhl4tb4l4l1dk4bmc2whxh0lb4
• https://lists.apache.org/thread/zcgm7lx6037lvgvn87rc1tj3p0zhv371
• https://lists.apache.org/thread/nxlmlhgsh7fwr4mo1fkhtkw3v266qhcx
• https://lists.apache.org/thread/s8fjltl6c1pkm7vg9v4qkr89b5b74jbg
• https://lists.apache.org/thread/lg97w2yvg3c6z06l8m5xs3j3v2m6mvj8
• https://lists.apache.org/thread/n9rogg2166hl9y4ycq5njpvnxndr8y5o
• https://lists.apache.org/thread/y05tvpv19ow44j16gtbcy9ht7lb0qjpy
• https://lists.apache.org/thread/tcg16jr59z5nry066dw7ym60vl25dxt9
• https://lists.apache.org/thread/p96mokqfy16mnqfyon46mf6g8nr9ghb6
• https://lists.apache.org/thread/shy1rrm2g383wlbdb2p7w19c868ntdjp
• https://lists.apache.org/thread/52gwhsy947hj9qhgn0dql726z1q927g4
• https://lists.apache.org/thread/3wmvtvv56rky5wtszn4zr8w12kg928qn
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/PJ2VIEPTDKVT3ZHU4YTZOASQWMORN2PV/
• https://www.cve.org/CVERecord?id=CVE-2026-94652
• https://www.cve.org/CVERecord?id=CVE-2026-94657
• https://www.cve.org/CVERecord?id=CVE-2026-83632
• https://www.cve.org/CVERecord?id=CVE-2026-85088
• https://www.cve.org/CVERecord?id=CVE-2026-66055
• https://www.cve.org/CVERecord?id=CVE-2026-90440
• https://www.cve.org/CVERecord?id=CVE-2026-94656
• https://www.cve.org/CVERecord?id=CVE-2026-66859
• https://www.cve.org/CVERecord?id=CVE-2026-87117
• https://www.cve.org/CVERecord?id=CVE-2026-96287
• https://www.cve.org/CVERecord?id=CVE-2026-94645
• https://www.cve.org/CVERecord?id=CVE-2026-61373
• https://www.cve.org/CVERecord?id=CVE-2026-96294
• https://www.cve.org/CVERecord?id=CVE-2026-96292

SRPMS 10/core

• arrow-17.0.0-4.1.mga10
• thrift-0.25.0-1.mga10
• ceph-20.2.4-1.1.mga10

Publication date: 27 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-53524 , CVE-2026-53525 Description
Decompression Bomb in Relay WebSocket (DoS). (CVE-2026-53524) Non-Constant-Time Password Hash Comparison in Relay Authentication. (CVE-2026-53525) References

• https://bugs.mageia.org/show_bug.cgi?id=36178
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VFSQ7FTIVCLLWHLTI3PZWITYB7QEHYLO/
• https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3
• https://weechat.org/doc/weechat/security/WSA-2026-1/
• https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc
• https://weechat.org/doc/weechat/security/WSA-2026-2/
• https://www.cve.org/CVERecord?id=CVE-2026-53524
• https://www.cve.org/CVERecord?id=CVE-2026-53525

SRPMS 10/core

• weechat-4.10.0-1.mga10

Publication date: 27 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2024-28085 , CVE-2026-53612 , CVE-2026-53613 , CVE-2026-53614 , CVE-2026-76642 , CVE-2026-78408 , CVE-2026-78409 , CVE-2026-78410 Description
Additional fix for CVE-2024-28085. Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown. (CVE-2026-53612) Local Privilege Escalation via TOCTOU in mount(8) — Target Path Redirection. (CVE-2026-53613) Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable — nosuid/noexec Bypass in SUID mount(8). (CVE-2026-53614) mount(8) post-mount hooks execute after helper failure. (CVE-2026-76642) nsenter(1), unshare(1) file descriptor leak. (CVE-2026-78408) mount(8) X-mount.subdir symlink escape. (CVE-2026-78409) mount(8) TOCTOU race on source path. (CVE-2026-78410) References

• https://bugs.mageia.org/show_bug.cgi?id=35435
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PG6GOWBLE22WLLWIN3COAYZZJEQKI62R/
• https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh
• https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g
• https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YOV3MY4NAWRGHXQY54MU5FVY6DSEV4CV/
• https://lists.debian.org/debian-security-announce/2026/msg00353.html
• https://ubuntu.com/security/notices/USN-8702-1
• https://www.openwall.com/lists/oss-security/2026/09/04/6
• https://www.openwall.com/lists/oss-security/2026/09/05/2
• https://www.cve.org/CVERecord?id=CVE-2024-28085
• https://www.cve.org/CVERecord?id=CVE-2026-53612
• https://www.cve.org/CVERecord?id=CVE-2026-53613
• https://www.cve.org/CVERecord?id=CVE-2026-53614
• https://www.cve.org/CVERecord?id=CVE-2026-76642
• https://www.cve.org/CVERecord?id=CVE-2026-78408
• https://www.cve.org/CVERecord?id=CVE-2026-78409
• https://www.cve.org/CVERecord?id=CVE-2026-78410

SRPMS 10/core

• util-linux-2.42.4-1.mga10