Lector de Feeds

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-95386 , CVE-2026-95387 , CVE-2026-95388 , CVE-2026-95389 , CVE-2026-95390 , CVE-2026-95391 , CVE-2026-95392 , CVE-2026-95393 , CVE-2026-95394 , CVE-2026-95395 , CVE-2026-96415 , CVE-2026-96416 , CVE-2026-96417 , CVE-2026-96418 , CVE-2026-96419 , CVE-2026-96420 , CVE-2026-96421 , CVE-2026-96422 , CVE-2026-96423 Description
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark. (CVE-2026-95386) Heap-based Buffer Overflow in Wireshark. (CVE-2026-95387) Heap-based Buffer Overflow in Wireshark. (CVE-2026-95388) Heap-based Buffer Overflow in Wireshark. (CVE-2026-95389) NULL Pointer Dereference in Wireshark. (CVE-2026-95390) Use After Free in Wireshark. (CVE-2026-95391) Buffer Over-read in Wireshark. (CVE-2026-95392) Heap-based Buffer Overflow in Wireshark. (CVE-2026-95393) Unchecked Input for Loop Condition in Wireshark. (CVE-2026-95394) Missing Release of Memory after Effective Lifetime in Wireshark. (CVE-2026-95395) The Catapult DCT2000 protocol dissector could crash. (CVE-2026-96415) The IEEE 802.11 protocol dissector could crash. (CVE-2026-96416) The RF4CE protocol dissector could crash. (CVE-2026-96417) The TIFF protocol dissector could go into an infinite loop. (CVE-2026-96418) Importing a crafted configuration profile could crash Wireshark or execute arbitrary code. (CVE-2026-96419) The Toshiba file parser could crash. (CVE-2026-96420) The USB HID protocol dissector could go into an infinite loop and leak memory. (CVE-2026-96421) The Frame protocol metadissector could crash. (CVE-2026-96422) The X11 protocol dissector could crash. (CVE-2026-96423) References

• https://bugs.mageia.org/show_bug.cgi?id=36456
• https://lists.debian.org/debian-security-announce/2026/msg00455.html
• https://www.wireshark.org/security/wnpa-sec-2026-97
• https://gitlab.com/wireshark/wireshark/-/issues/21487
• https://www.wireshark.org/security/wnpa-sec-2026-101
• https://gitlab.com/wireshark/wireshark/-/issues/21545
• https://www.wireshark.org/security/wnpa-sec-2026-93
• https://gitlab.com/wireshark/wireshark/-/issues/21481
• https://www.wireshark.org/security/wnpa-sec-2026-100
• https://gitlab.com/wireshark/wireshark/-/issues/21549
• https://gitlab.com/wireshark/wireshark/-/issues/21550
• https://www.wireshark.org/security/wnpa-sec-2026-99
• https://gitlab.com/wireshark/wireshark/-/issues/21510
• https://www.wireshark.org/security/wnpa-sec-2026-98
• https://gitlab.com/wireshark/wireshark/-/issues/21523
• https://www.wireshark.org/security/wnpa-sec-2026-96
• https://gitlab.com/wireshark/wireshark/-/issues/21492
• https://www.wireshark.org/security/wnpa-sec-2026-110
• https://gitlab.com/wireshark/wireshark/-/issues/21589
• https://www.wireshark.org/security/wnpa-sec-2026-109
• https://gitlab.com/wireshark/wireshark/-/issues/21564
• https://www.wireshark.org/security/wnpa-sec-2026-104
• https://gitlab.com/wireshark/wireshark/-/issues/21574
• https://www.wireshark.org/security/wnpa-sec-2026-107
• https://gitlab.com/wireshark/wireshark/-/issues/21565
• https://www.wireshark.org/security/wnpa-sec-2026-106
• https://gitlab.com/wireshark/wireshark/-/issues/21553
• https://www.wireshark.org/security/wnpa-sec-2026-105
• https://gitlab.com/wireshark/wireshark/-/issues/21541
• https://www.wireshark.org/security/wnpa-sec-2026-103
• https://gitlab.com/wireshark/wireshark/-/issues/21566
• https://www.wireshark.org/security/wnpa-sec-2026-102
• https://gitlab.com/wireshark/wireshark/-/issues/21525
• https://www.wireshark.org/security/wnpa-sec-2026-108
• https://gitlab.com/wireshark/wireshark/-/issues/21563
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/C5DQL3SVTFVDEEP3UXXLRF6HOVKTIQNJ/
• https://www.wireshark.org/security/wnpa-sec-2026-94
• https://gitlab.com/wireshark/wireshark/-/issues/21501
• https://www.wireshark.org/security/wnpa-sec-2026-95
• https://gitlab.com/wireshark/wireshark/-/issues/21503
• https://www.wireshark.org/security/wnpa-sec-2026-92
• https://www.cve.org/CVERecord?id=CVE-2026-95386
• https://www.cve.org/CVERecord?id=CVE-2026-95387
• https://www.cve.org/CVERecord?id=CVE-2026-95388
• https://www.cve.org/CVERecord?id=CVE-2026-95389
• https://www.cve.org/CVERecord?id=CVE-2026-95390
• https://www.cve.org/CVERecord?id=CVE-2026-95391
• https://www.cve.org/CVERecord?id=CVE-2026-95392
• https://www.cve.org/CVERecord?id=CVE-2026-95393
• https://www.cve.org/CVERecord?id=CVE-2026-95394
• https://www.cve.org/CVERecord?id=CVE-2026-95395
• https://www.cve.org/CVERecord?id=CVE-2026-96415
• https://www.cve.org/CVERecord?id=CVE-2026-96416
• https://www.cve.org/CVERecord?id=CVE-2026-96417
• https://www.cve.org/CVERecord?id=CVE-2026-96418
• https://www.cve.org/CVERecord?id=CVE-2026-96419
• https://www.cve.org/CVERecord?id=CVE-2026-96420
• https://www.cve.org/CVERecord?id=CVE-2026-96421
• https://www.cve.org/CVERecord?id=CVE-2026-96422
• https://www.cve.org/CVERecord?id=CVE-2026-96423

SRPMS 10/core

• wireshark-4.6.9-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-103500 , CVE-2026-96869 , CVE-2026-100756 , CVE-2026-100757 , CVE-2026-100758 , CVE-2026-100759 , CVE-2026-100760 , CVE-2026-100762 , CVE-2026-100765 , CVE-2026-100766 , CVE-2026-100767 , CVE-2026-100769 , CVE-2026-100770 , CVE-2026-100771 , CVE-2026-100772 , CVE-2026-100773 , CVE-2026-100774 , CVE-2026-100775 , CVE-2026-100776 , CVE-2026-100777 , CVE-2026-100778 , CVE-2026-100779 , CVE-2026-100780 , CVE-2026-100781 , CVE-2026-100782 , CVE-2026-100783 , CVE-2026-100784 , CVE-2026-100785 , CVE-2026-100786 , CVE-2026-100787 , CVE-2026-100788 , CVE-2026-100789 , CVE-2026-100790 , CVE-2026-100791 , CVE-2026-100792 , CVE-2026-100794 , CVE-2026-100797 , CVE-2026-100798 , CVE-2026-100800 , CVE-2026-100801 , CVE-2026-100803 , CVE-2026-100806 , CVE-2026-100807 , CVE-2026-100808 , CVE-2026-100809 , CVE-2026-100811 , CVE-2026-100812 , CVE-2026-100814 , CVE-2026-100815 , CVE-2026-100816 , CVE-2026-100818 , CVE-2026-100819 , CVE-2026-100820 , CVE-2026-100821 , CVE-2026-100822 , CVE-2026-100824 , CVE-2026-100825 , CVE-2026-100826 , CVE-2026-100828 , CVE-2026-100829 , CVE-2026-100830 , CVE-2026-100831 , CVE-2026-100832 Description
Heap buffer overflow opening large email. (CVE-2026-103500) Incorrect boundary conditions in the Audio/Video: Playback component. (CVE-2026-100756) Use-after-free in the Widget component. (CVE-2026-100757) Sandbox escape in the DOM: Navigation component. (CVE-2026-100758) Uninitialized memory in the Storage: Quota Manager component. (CVE-2026-100759) Sandbox escape in the Security: Process Sandboxing component. (CVE-2026-100760) Sandbox escape due to use-after-free in the DOM: Content Processes component. (CVE-2026-100762) Use-after-free in the JavaScript: WebAssembly component. (CVE-2026-100765) Information disclosure in the Networking: JAR component. (CVE-2026-100766) Use-after-free in the Networking: Cache component. (CVE-2026-100767) Use-after-free in the JavaScript: WebAssembly component. (CVE-2026-100769) Sandbox escape due to use-after-free in the DOM: Content Processes component. (CVE-2026-100770) Undefined behavior in the DOM: Streams component. (CVE-2026-100771) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100772) Use-after-free in the Storage: IndexedDB component. (CVE-2026-100773) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100774) Sandbox escape in the Graphics component. (CVE-2026-100775) Use-after-free in the JavaScript: WebAssembly component. (CVE-2026-100776) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-100777) Sandbox escape due to use-after-free in the DOM: Core & HTML component. (CVE-2026-100778) Use-after-free in the XSLT component. (CVE-2026-100779) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100780) Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. (CVE-2026-100781) Privilege escalation due to incorrect boundary conditions in the Graphics component. (CVE-2026-100782) Uninitialized memory in the Audio/Video component. (CVE-2026-100783) Use-after-free in the Layout: Text and Fonts component. (CVE-2026-100784) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100785) Sandbox escape due to use-after-free in the Graphics component. (CVE-2026-100786) Sandbox escape in the XUL component. (CVE-2026-100787) Invalid pointer in the JavaScript: WebAssembly component. (CVE-2026-100788) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-100789) Use-after-free in the XSLT component. (CVE-2026-100790) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100791) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-100832) JIT miscompilation in the JavaScript: WebAssembly component. (CVE-2026-100792) Sandbox escape due to incorrect boundary conditions in the Internationalization component. (CVE-2026-100794) Information disclosure in the Networking component. (CVE-2026-96869) Privilege escalation due to use-after-free in the Graphics: WebRender component. (CVE-2026-100797) Cryptography misuse in Storage: Quota Manager component. (CVE-2026-100798) Sandbox escape due to use-after-free in the Disability Access APIs component. (CVE-2026-100800) Privilege escalation in the DLL Services component. (CVE-2026-100801) Same-origin policy bypass in the WebExtensions component. (CVE-2026-100803) Uninitialized memory in the Graphics: WebGPU component. (CVE-2026-100806) Privilege escalation in the DOM: Service Workers component. (CVE-2026-100807) Mitigation bypass in the DOM: Service Workers component. (CVE-2026-100808) Same-origin policy bypass in the DevTools component. (CVE-2026-100809) Sandbox escape due to use-after-free in the DOM: Core & HTML component. (CVE-2026-100811) Denial-of-service in the Graphics component. (CVE-2026-100812) Incorrect boundary conditions in the JavaScript Engine: JIT component. (CVE-2026-100814) Use-after-free in the CSS Parsing and Computation component. (CVE-2026-100815) Site isolation issue in the DOM: Networking component. (CVE-2026-100816) Sandbox escape due to use-after-free in the Widget: Gtk component. (CVE-2026-100818) Sandbox escape due to incorrect boundary conditions in the XPCOM component. (CVE-2026-100819) Privilege escalation in the Address Bar component. (CVE-2026-100820) Site isolation issue in the Panning and Zooming component. (CVE-2026-100821) Spoofing issue in the Networking: HTTP component. (CVE-2026-100822) Privilege escalation in the Places component. (CVE-2026-100824) Use-after-free in the JavaScript Engine: JIT component. (CVE-2026-100825) Denial-of-service in the Storage: StorageManager component. (CVE-2026-100826) Mitigation bypass in the Bookmarks & History component. (CVE-2026-100828) Mitigation bypass in the DOM: Security component. (CVE-2026-100829) Mitigation bypass in the DOM: Navigation component. (CVE-2026-100830) Use-after-free in the DOM: UI Events & Focus Handling component. (CVE-2026-100831) References

• https://bugs.mageia.org/show_bug.cgi?id=36416
• https://www.thunderbird.net/en-US/thunderbird/153.4.0esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/
• https://www.cve.org/CVERecord?id=CVE-2026-103500
• https://www.cve.org/CVERecord?id=CVE-2026-96869
• https://www.cve.org/CVERecord?id=CVE-2026-100756
• https://www.cve.org/CVERecord?id=CVE-2026-100757
• https://www.cve.org/CVERecord?id=CVE-2026-100758
• https://www.cve.org/CVERecord?id=CVE-2026-100759
• https://www.cve.org/CVERecord?id=CVE-2026-100760
• https://www.cve.org/CVERecord?id=CVE-2026-100762
• https://www.cve.org/CVERecord?id=CVE-2026-100765
• https://www.cve.org/CVERecord?id=CVE-2026-100766
• https://www.cve.org/CVERecord?id=CVE-2026-100767
• https://www.cve.org/CVERecord?id=CVE-2026-100769
• https://www.cve.org/CVERecord?id=CVE-2026-100770
• https://www.cve.org/CVERecord?id=CVE-2026-100771
• https://www.cve.org/CVERecord?id=CVE-2026-100772
• https://www.cve.org/CVERecord?id=CVE-2026-100773
• https://www.cve.org/CVERecord?id=CVE-2026-100774
• https://www.cve.org/CVERecord?id=CVE-2026-100775
• https://www.cve.org/CVERecord?id=CVE-2026-100776
• https://www.cve.org/CVERecord?id=CVE-2026-100777
• https://www.cve.org/CVERecord?id=CVE-2026-100778
• https://www.cve.org/CVERecord?id=CVE-2026-100779
• https://www.cve.org/CVERecord?id=CVE-2026-100780
• https://www.cve.org/CVERecord?id=CVE-2026-100781
• https://www.cve.org/CVERecord?id=CVE-2026-100782
• https://www.cve.org/CVERecord?id=CVE-2026-100783
• https://www.cve.org/CVERecord?id=CVE-2026-100784
• https://www.cve.org/CVERecord?id=CVE-2026-100785
• https://www.cve.org/CVERecord?id=CVE-2026-100786
• https://www.cve.org/CVERecord?id=CVE-2026-100787
• https://www.cve.org/CVERecord?id=CVE-2026-100788
• https://www.cve.org/CVERecord?id=CVE-2026-100789
• https://www.cve.org/CVERecord?id=CVE-2026-100790
• https://www.cve.org/CVERecord?id=CVE-2026-100791
• https://www.cve.org/CVERecord?id=CVE-2026-100792
• https://www.cve.org/CVERecord?id=CVE-2026-100794
• https://www.cve.org/CVERecord?id=CVE-2026-100797
• https://www.cve.org/CVERecord?id=CVE-2026-100798
• https://www.cve.org/CVERecord?id=CVE-2026-100800
• https://www.cve.org/CVERecord?id=CVE-2026-100801
• https://www.cve.org/CVERecord?id=CVE-2026-100803
• https://www.cve.org/CVERecord?id=CVE-2026-100806
• https://www.cve.org/CVERecord?id=CVE-2026-100807
• https://www.cve.org/CVERecord?id=CVE-2026-100808
• https://www.cve.org/CVERecord?id=CVE-2026-100809
• https://www.cve.org/CVERecord?id=CVE-2026-100811
• https://www.cve.org/CVERecord?id=CVE-2026-100812
• https://www.cve.org/CVERecord?id=CVE-2026-100814
• https://www.cve.org/CVERecord?id=CVE-2026-100815
• https://www.cve.org/CVERecord?id=CVE-2026-100816
• https://www.cve.org/CVERecord?id=CVE-2026-100818
• https://www.cve.org/CVERecord?id=CVE-2026-100819
• https://www.cve.org/CVERecord?id=CVE-2026-100820
• https://www.cve.org/CVERecord?id=CVE-2026-100821
• https://www.cve.org/CVERecord?id=CVE-2026-100822
• https://www.cve.org/CVERecord?id=CVE-2026-100824
• https://www.cve.org/CVERecord?id=CVE-2026-100825
• https://www.cve.org/CVERecord?id=CVE-2026-100826
• https://www.cve.org/CVERecord?id=CVE-2026-100828
• https://www.cve.org/CVERecord?id=CVE-2026-100829
• https://www.cve.org/CVERecord?id=CVE-2026-100830
• https://www.cve.org/CVERecord?id=CVE-2026-100831
• https://www.cve.org/CVERecord?id=CVE-2026-100832

SRPMS 10/core

• thunderbird-l10n-153.4.0-1.mga10
• thunderbird-153.4.0-3.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-96869 , CVE-2026-100756 , CVE-2026-100757 , CVE-2026-100758 , CVE-2026-100759 , CVE-2026-100760 , CVE-2026-100762 , CVE-2026-100765 , CVE-2026-100766 , CVE-2026-100767 , CVE-2026-100769 , CVE-2026-100770 , CVE-2026-100771 , CVE-2026-100772 , CVE-2026-100773 , CVE-2026-100774 , CVE-2026-100775 , CVE-2026-100776 , CVE-2026-100777 , CVE-2026-100778 , CVE-2026-100779 , CVE-2026-100780 , CVE-2026-100781 , CVE-2026-100782 , CVE-2026-100783 , CVE-2026-100784 , CVE-2026-100785 , CVE-2026-100786 , CVE-2026-100787 , CVE-2026-100788 , CVE-2026-100789 , CVE-2026-100790 , CVE-2026-100791 , CVE-2026-100792 , CVE-2026-100794 , CVE-2026-100797 , CVE-2026-100798 , CVE-2026-100800 , CVE-2026-100801 , CVE-2026-100803 , CVE-2026-100806 , CVE-2026-100807 , CVE-2026-100808 , CVE-2026-100809 , CVE-2026-100811 , CVE-2026-100812 , CVE-2026-100814 , CVE-2026-100815 , CVE-2026-100816 , CVE-2026-100818 , CVE-2026-100819 , CVE-2026-100820 , CVE-2026-100821 , CVE-2026-100822 , CVE-2026-100824 , CVE-2026-100825 , CVE-2026-100826 , CVE-2026-100828 , CVE-2026-100829 , CVE-2026-100830 , CVE-2026-100831 , CVE-2026-100832 Description
Incorrect boundary conditions in the Audio/Video: Playback component. (CVE-2026-100756) Use-after-free in the Widget component. (CVE-2026-100757) Sandbox escape in the DOM: Navigation component. (CVE-2026-100758) Uninitialized memory in the Storage: Quota Manager component. (CVE-2026-100759) Sandbox escape in the Security: Process Sandboxing component. (CVE-2026-100760) Sandbox escape due to use-after-free in the DOM: Content Processes component. (CVE-2026-100762) Use-after-free in the JavaScript: WebAssembly component. (CVE-2026-100765) Information disclosure in the Networking: JAR component. (CVE-2026-100766) Use-after-free in the Networking: Cache component. (CVE-2026-100767) Use-after-free in the JavaScript: WebAssembly component. (CVE-2026-100769) Sandbox escape due to use-after-free in the DOM: Content Processes component. (CVE-2026-100770) Undefined behavior in the DOM: Streams component. (CVE-2026-100771) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100772) Use-after-free in the Storage: IndexedDB component. (CVE-2026-100773) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100774) Sandbox escape in the Graphics component. (CVE-2026-100775) Use-after-free in the JavaScript: WebAssembly component. (CVE-2026-100776) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-100777) Sandbox escape due to use-after-free in the DOM: Core & HTML component. (CVE-2026-100778) Use-after-free in the XSLT component. (CVE-2026-100779) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100780) Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. (CVE-2026-100781) Privilege escalation due to incorrect boundary conditions in the Graphics component. (CVE-2026-100782) Uninitialized memory in the Audio/Video component. (CVE-2026-100783) Use-after-free in the Layout: Text and Fonts component. (CVE-2026-100784) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100785) Sandbox escape due to use-after-free in the Graphics component. (CVE-2026-100786) Sandbox escape in the XUL component. (CVE-2026-100787) Invalid pointer in the JavaScript: WebAssembly component. (CVE-2026-100788) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-100789) Use-after-free in the XSLT component. (CVE-2026-100790) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100791) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-100832) JIT miscompilation in the JavaScript: WebAssembly component. (CVE-2026-100792) Sandbox escape due to incorrect boundary conditions in the Internationalization component. (CVE-2026-100794) Information disclosure in the Networking component. (CVE-2026-96869) Privilege escalation due to use-after-free in the Graphics: WebRender component. (CVE-2026-100797) Cryptography misuse in Storage: Quota Manager component. (CVE-2026-100798) Sandbox escape due to use-after-free in the Disability Access APIs component. (CVE-2026-100800) Privilege escalation in the DLL Services component. (CVE-2026-100801) Same-origin policy bypass in the WebExtensions component. (CVE-2026-100803) Uninitialized memory in the Graphics: WebGPU component. (CVE-2026-100806) Privilege escalation in the DOM: Service Workers component. (CVE-2026-100807) Mitigation bypass in the DOM: Service Workers component. (CVE-2026-100808) Same-origin policy bypass in the DevTools component. (CVE-2026-100809) Sandbox escape due to use-after-free in the DOM: Core & HTML component. (CVE-2026-100811) Denial-of-service in the Graphics component. (CVE-2026-100812) Incorrect boundary conditions in the JavaScript Engine: JIT component. (CVE-2026-100814) Use-after-free in the CSS Parsing and Computation component. (CVE-2026-100815) Site isolation issue in the DOM: Networking component. (CVE-2026-100816) Sandbox escape due to use-after-free in the Widget: Gtk component. (CVE-2026-100818) Sandbox escape due to incorrect boundary conditions in the XPCOM component. (CVE-2026-100819) Privilege escalation in the Address Bar component. (CVE-2026-100820) Site isolation issue in the Panning and Zooming component. (CVE-2026-100821) Spoofing issue in the Networking: HTTP component. (CVE-2026-100822) Privilege escalation in the Places component. (CVE-2026-100824) Use-after-free in the JavaScript Engine: JIT component. (CVE-2026-100825) Denial-of-service in the Storage: StorageManager component. (CVE-2026-100826) Mitigation bypass in the Bookmarks & History component. (CVE-2026-100828) Mitigation bypass in the DOM: Security component. (CVE-2026-100829) Mitigation bypass in the DOM: Navigation component. (CVE-2026-100830) Use-after-free in the DOM: UI Events & Focus Handling component. (CVE-2026-100831) References

• https://bugs.mageia.org/show_bug.cgi?id=36413
• https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_130.html
• https://www.firefox.com/en-US/firefox/153.4.0/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/
• https://www.cve.org/CVERecord?id=CVE-2026-96869
• https://www.cve.org/CVERecord?id=CVE-2026-100756
• https://www.cve.org/CVERecord?id=CVE-2026-100757
• https://www.cve.org/CVERecord?id=CVE-2026-100758
• https://www.cve.org/CVERecord?id=CVE-2026-100759
• https://www.cve.org/CVERecord?id=CVE-2026-100760
• https://www.cve.org/CVERecord?id=CVE-2026-100762
• https://www.cve.org/CVERecord?id=CVE-2026-100765
• https://www.cve.org/CVERecord?id=CVE-2026-100766
• https://www.cve.org/CVERecord?id=CVE-2026-100767
• https://www.cve.org/CVERecord?id=CVE-2026-100769
• https://www.cve.org/CVERecord?id=CVE-2026-100770
• https://www.cve.org/CVERecord?id=CVE-2026-100771
• https://www.cve.org/CVERecord?id=CVE-2026-100772
• https://www.cve.org/CVERecord?id=CVE-2026-100773
• https://www.cve.org/CVERecord?id=CVE-2026-100774
• https://www.cve.org/CVERecord?id=CVE-2026-100775
• https://www.cve.org/CVERecord?id=CVE-2026-100776
• https://www.cve.org/CVERecord?id=CVE-2026-100777
• https://www.cve.org/CVERecord?id=CVE-2026-100778
• https://www.cve.org/CVERecord?id=CVE-2026-100779
• https://www.cve.org/CVERecord?id=CVE-2026-100780
• https://www.cve.org/CVERecord?id=CVE-2026-100781
• https://www.cve.org/CVERecord?id=CVE-2026-100782
• https://www.cve.org/CVERecord?id=CVE-2026-100783
• https://www.cve.org/CVERecord?id=CVE-2026-100784
• https://www.cve.org/CVERecord?id=CVE-2026-100785
• https://www.cve.org/CVERecord?id=CVE-2026-100786
• https://www.cve.org/CVERecord?id=CVE-2026-100787
• https://www.cve.org/CVERecord?id=CVE-2026-100788
• https://www.cve.org/CVERecord?id=CVE-2026-100789
• https://www.cve.org/CVERecord?id=CVE-2026-100790
• https://www.cve.org/CVERecord?id=CVE-2026-100791
• https://www.cve.org/CVERecord?id=CVE-2026-100792
• https://www.cve.org/CVERecord?id=CVE-2026-100794
• https://www.cve.org/CVERecord?id=CVE-2026-100797
• https://www.cve.org/CVERecord?id=CVE-2026-100798
• https://www.cve.org/CVERecord?id=CVE-2026-100800
• https://www.cve.org/CVERecord?id=CVE-2026-100801
• https://www.cve.org/CVERecord?id=CVE-2026-100803
• https://www.cve.org/CVERecord?id=CVE-2026-100806
• https://www.cve.org/CVERecord?id=CVE-2026-100807
• https://www.cve.org/CVERecord?id=CVE-2026-100808
• https://www.cve.org/CVERecord?id=CVE-2026-100809
• https://www.cve.org/CVERecord?id=CVE-2026-100811
• https://www.cve.org/CVERecord?id=CVE-2026-100812
• https://www.cve.org/CVERecord?id=CVE-2026-100814
• https://www.cve.org/CVERecord?id=CVE-2026-100815
• https://www.cve.org/CVERecord?id=CVE-2026-100816
• https://www.cve.org/CVERecord?id=CVE-2026-100818
• https://www.cve.org/CVERecord?id=CVE-2026-100819
• https://www.cve.org/CVERecord?id=CVE-2026-100820
• https://www.cve.org/CVERecord?id=CVE-2026-100821
• https://www.cve.org/CVERecord?id=CVE-2026-100822
• https://www.cve.org/CVERecord?id=CVE-2026-100824
• https://www.cve.org/CVERecord?id=CVE-2026-100825
• https://www.cve.org/CVERecord?id=CVE-2026-100826
• https://www.cve.org/CVERecord?id=CVE-2026-100828
• https://www.cve.org/CVERecord?id=CVE-2026-100829
• https://www.cve.org/CVERecord?id=CVE-2026-100830
• https://www.cve.org/CVERecord?id=CVE-2026-100831
• https://www.cve.org/CVERecord?id=CVE-2026-100832

SRPMS 10/core

• nss-3.130.0-1.mga10
• firefox-l10n-153.4.0-1.mga10
• firefox-153.4.0-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-35328 , CVE-2026-35329 , CVE-2026-35330 , CVE-2026-35331 , CVE-2026-35332 , CVE-2026-35333 , CVE-2026-35334 , CVE-2026-47895 , CVE-2026-78123 , CVE-2026-78124 , CVE-2026-78126 , CVE-2026-78127 , CVE-2026-78129 Description
Please see the links for aditional information about the vulnerabilities. References

• https://bugs.mageia.org/show_bug.cgi?id=35413
• https://lists.debian.org/debian-security-announce/2026/msg00137.html
• https://ubuntu.com/security/notices/USN-8407-1
• https://www.strongswan.org/blog/2026/06/08/strongswan-vulnerability-(cve-2026-47895).html
• https://lists.debian.org/debian-security-announce/2026/msg00246.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/72R2725DIUVMEB7TOVID7XNHTPDC3UIH/
• https://lists.debian.org/debian-security-announce/2026/msg00398.html
• https://ubuntu.com/security/notices/USN-8789-1
• https://www.cve.org/CVERecord?id=CVE-2026-35328
• https://www.cve.org/CVERecord?id=CVE-2026-35329
• https://www.cve.org/CVERecord?id=CVE-2026-35330
• https://www.cve.org/CVERecord?id=CVE-2026-35331
• https://www.cve.org/CVERecord?id=CVE-2026-35332
• https://www.cve.org/CVERecord?id=CVE-2026-35333
• https://www.cve.org/CVERecord?id=CVE-2026-35334
• https://www.cve.org/CVERecord?id=CVE-2026-47895
• https://www.cve.org/CVERecord?id=CVE-2026-78123
• https://www.cve.org/CVERecord?id=CVE-2026-78124
• https://www.cve.org/CVERecord?id=CVE-2026-78126
• https://www.cve.org/CVERecord?id=CVE-2026-78127
• https://www.cve.org/CVERecord?id=CVE-2026-78129

SRPMS 10/core

• strongswan-6.1.0-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
Description
This update fixes security issues: - Only accept a CONFLUX_LINK cell on a plain OR circuit, and refuse to turn a (pending) conflux leg into an introduction or rendezvous point. Previously a client could link a rendezvous-point circuit into a conflux set and then, with a forged sequence number in the LINK cell, make the relay tear the set down from inside the rendezvous splice, triggering a fatal assertion in assert_circuit_ok(). Also reject a LINK/LINKED cell whose last_seqno_recv is above what we ever sent on the set. - Correctly copy the MiddleOnly flag from routerstatuses to node objects. Without this fix, the MiddleOnly flag was ignored on non-authorities, and clients could use MiddleOnly relays for inappropriate roles in onion service circuits. Tracked as TROVE-2026-067. - Treat a router descriptor as expired if any of its family certificates has expired. Previously, we incorrectly ignored the expiration time of the family certificate. Tracked as TROVE-2026-062. References

• https://bugs.mageia.org/show_bug.cgi?id=36473
• https://www.openwall.com/lists/oss-security/2026/10/07/33

SRPMS 10/core

• tor-0.4.9.14-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-13503 Description
ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal. (CVE-2026-13503) References

• https://bugs.mageia.org/show_bug.cgi?id=35969
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AQBYU5CQQO6MHRX47JUHB4YRMYUNG45D/
• https://www.cve.org/CVERecord?id=CVE-2026-13503

SRPMS 10/core

• antlr4-project-4.13.2-3.1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-53783 , CVE-2026-53784 , CVE-2026-53785 , CVE-2026-53786 , CVE-2026-53788 , CVE-2026-53789 , CVE-2026-53790 , CVE-2026-53791 , CVE-2026-53792 , CVE-2026-53793 , CVE-2026-53794 , CVE-2026-53795 , CVE-2026-53796 , CVE-2026-53797 , CVE-2026-53798 , CVE-2026-53799 , CVE-2026-53800 , CVE-2026-53801 , CVE-2026-53802 , CVE-2026-53803 , CVE-2026-70452 , CVE-2026-70453 , CVE-2026-70454 , CVE-2026-70455 , CVE-2026-70456 , CVE-2026-70457 , CVE-2026-70458 , CVE-2026-70459 , CVE-2026-70460 , CVE-2026-70461 , CVE-2026-70462 , CVE-2026-70463 , CVE-2026-70464 Description
Several vulnerabilities were discovered in rsync, a fast, versatile, remote (and local) file-copying tool, which could result in local privilege escalation, bypass of intended access restrictions, information disclosure, denial of service or the execution of arbitrary code. References

• https://bugs.mageia.org/show_bug.cgi?id=36138
• https://www.openwall.com/lists/oss-security/2026/08/13/1
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AHYZL7IBFVF463AGDTJUQBYUJUW7JUAB/
• https://lists.debian.org/debian-security-announce/2026/msg00440.html
• https://www.cve.org/CVERecord?id=CVE-2026-53783
• https://www.cve.org/CVERecord?id=CVE-2026-53784
• https://www.cve.org/CVERecord?id=CVE-2026-53785
• https://www.cve.org/CVERecord?id=CVE-2026-53786
• https://www.cve.org/CVERecord?id=CVE-2026-53788
• https://www.cve.org/CVERecord?id=CVE-2026-53789
• https://www.cve.org/CVERecord?id=CVE-2026-53790
• https://www.cve.org/CVERecord?id=CVE-2026-53791
• https://www.cve.org/CVERecord?id=CVE-2026-53792
• https://www.cve.org/CVERecord?id=CVE-2026-53793
• https://www.cve.org/CVERecord?id=CVE-2026-53794
• https://www.cve.org/CVERecord?id=CVE-2026-53795
• https://www.cve.org/CVERecord?id=CVE-2026-53796
• https://www.cve.org/CVERecord?id=CVE-2026-53797
• https://www.cve.org/CVERecord?id=CVE-2026-53798
• https://www.cve.org/CVERecord?id=CVE-2026-53799
• https://www.cve.org/CVERecord?id=CVE-2026-53800
• https://www.cve.org/CVERecord?id=CVE-2026-53801
• https://www.cve.org/CVERecord?id=CVE-2026-53802
• https://www.cve.org/CVERecord?id=CVE-2026-53803
• https://www.cve.org/CVERecord?id=CVE-2026-70452
• https://www.cve.org/CVERecord?id=CVE-2026-70453
• https://www.cve.org/CVERecord?id=CVE-2026-70454
• https://www.cve.org/CVERecord?id=CVE-2026-70455
• https://www.cve.org/CVERecord?id=CVE-2026-70456
• https://www.cve.org/CVERecord?id=CVE-2026-70457
• https://www.cve.org/CVERecord?id=CVE-2026-70458
• https://www.cve.org/CVERecord?id=CVE-2026-70459
• https://www.cve.org/CVERecord?id=CVE-2026-70460
• https://www.cve.org/CVERecord?id=CVE-2026-70461
• https://www.cve.org/CVERecord?id=CVE-2026-70462
• https://www.cve.org/CVERecord?id=CVE-2026-70463
• https://www.cve.org/CVERecord?id=CVE-2026-70464

SRPMS 10/core

• rsync-3.5.1-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-78030 , CVE-2026-88815 , CVE-2026-88816 Description
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. (CVE-2026-78030) DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. (CVE-2026-88815) DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. (CVE-2026-88816) References

• https://bugs.mageia.org/show_bug.cgi?id=36312
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X2QBTFMS57S7DYK666C4OQBHWDRGW3Q7/
• https://www.openwall.com/lists/oss-security/2026/09/19/4
• https://www.openwall.com/lists/oss-security/2026/09/28/12
• https://www.openwall.com/lists/oss-security/2026/09/28/13
• https://www.cve.org/CVERecord?id=CVE-2026-78030
• https://www.cve.org/CVERecord?id=CVE-2026-88815
• https://www.cve.org/CVERecord?id=CVE-2026-88816

SRPMS 10/core

• perl-DBI-1.655.0-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-85498 Description
Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow. (CVE-2026-85498) References

• https://bugs.mageia.org/show_bug.cgi?id=36322
• https://ubuntu.com/security/notices/USN-8762-1
• https://www.cve.org/CVERecord?id=CVE-2026-85498

SRPMS 10/core

• polkit-127-3.1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-91752 , CVE-2026-100310 Description
GNU libextractor before 1.15 Stack Overflow via OLE2. (CVE-2026-91752) GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX. (CVE-2026-100310) References

• https://bugs.mageia.org/show_bug.cgi?id=36327
• https://www.openwall.com/lists/oss-security/2026/09/16/16
• https://www.vulncheck.com/advisories/gnu-libextractor-before-1.15-stack-overflow-via-ole2
• https://www.openwall.com/lists/oss-security/2026/09/25/25
• https://www.vulncheck.com/advisories/gnu-libextractor-before-1.16-privilege-escalation-via-libextractor-prefix
• https://www.cve.org/CVERecord?id=CVE-2026-91752
• https://www.cve.org/CVERecord?id=CVE-2026-100310

SRPMS 10/core

• libextractor-1.16-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-55453 , CVE-2026-55467 , CVE-2026-55480 , CVE-2026-61702 , CVE-2026-87875 , CVE-2026-87876 , CVE-2026-105326 Description
CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip. (CVE-2026-55453) CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix). (CVE-2026-55467) copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW. (CVE-2026-55480) root-side banner file disclosure. (CVE-2026-61702) Heap out-of-bounds read in cupsUTF32ToUTF8() via missing source-length bound — reachable from SNMP supply-description parsing (backend/snmp-supplies.c). (CVE-2026-87875) CVE-2026-27447 follow-up: remaining case-insensitive username matching in scheduler side paths. (CVE-2026-87876) Argument injection in mailto notifier allows unauthenticated remote code execution. (CVE-2026-105326) References

• https://bugs.mageia.org/show_bug.cgi?id=36331
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/KX5YFUOJ5JKV64QGD4WMERKGBI43OV3M/
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq
• https://www.openwall.com/lists/oss-security/2026/10/05/6
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-jj94-x3qh-ffp9
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-7j85-5r23-xhvh
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-gq9p-4w7m-2f5g
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-w9hj-hq9p-m7f6
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-qqm8-4q5h-jg55
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-fw7q-ww8w-phx8
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-gj33-wxpv-6fgg
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-r4wf-366f-f6g3
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7
• https://github.com/OpenPrinting/cups/security/advisories/GHSA-pwg4-pv39-8c22
• https://www.cve.org/CVERecord?id=CVE-2026-55453
• https://www.cve.org/CVERecord?id=CVE-2026-55467
• https://www.cve.org/CVERecord?id=CVE-2026-55480
• https://www.cve.org/CVERecord?id=CVE-2026-61702
• https://www.cve.org/CVERecord?id=CVE-2026-87875
• https://www.cve.org/CVERecord?id=CVE-2026-87876
• https://www.cve.org/CVERecord?id=CVE-2026-105326

SRPMS 10/core

• cups-2.4.20-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
Description
Heap buffer overflow in ntfs_acl_owner() Heap buffer overflow in ntfs_same_sid() Denial-of-service in ntfs_inode_attach_all_extents() Heap buffer overflow in ntfs_check_restart_area() Heap buffer overflow in ntfs_ea_check_wsldev() Heap buffer overflow in ntfs_external_attr_find() Heap data corruption in ntfs_mapping_pairs_decompress_i() Heap out of bounds read/write in ntfs_ie_add_vcn() References

• https://bugs.mageia.org/show_bug.cgi?id=36366
• https://www.openwall.com/lists/oss-security/2026/09/23/4

SRPMS 10/core

• ntfs-3g-2026.2.25-1.2.mga10

Publication date: 09 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-84782 , CVE-2026-35189 , CVE-2026-35191 , CVE-2026-42772 , CVE-2026-54872 , CVE-2026-54873 , CVE-2026-54875 , CVE-2026-72897 , CVE-2026-75804 , CVE-2026-75805 , CVE-2026-75806 , CVE-2026-77696 , CVE-2026-84784 Description
DTLS Retransmits Handshake Messages From a Stale Buffer Offset. (CVE-2026-84782) Excessive Memory Allocation in Relative CRLDP Processing. (CVE-2026-35189) QUIC Unvalidated Amplification Credit may be Over Accounted. (CVE-2026-35191) Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC. (CVE-2026-42772) Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves. (CVE-2026-54872) QUIC STREAM Fragment Metadata DoS. (CVE-2026-54873) Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V. (CVE-2026-54875) Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake. (CVE-2026-72897) QUIC Connection-Level Flow Control is Not Enforced for Streams. (CVE-2026-75804) NULL Pointer Dereference in CMP Client Revocation Response Handling. (CVE-2026-75805) Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS. (CVE-2026-75806) Timing Side-Channel in SM2 Signature Generation. (CVE-2026-77696) QUIC: Unbounded RETIRE_CONNECTION_ID Backlog. (CVE-2026-84784) References

• https://bugs.mageia.org/show_bug.cgi?id=36358
• https://www.openwall.com/lists/oss-security/2026/09/22/7
• https://www.openwall.com/lists/oss-security/2026/09/29/28
• https://lists.debian.org/debian-security-announce/2026/msg00444.html
• https://ubuntu.com/security/notices/USN-8847-1
• https://ubuntu.com/security/notices/USN-8861-1
• https://www.cve.org/CVERecord?id=CVE-2026-84782
• https://www.cve.org/CVERecord?id=CVE-2026-35189
• https://www.cve.org/CVERecord?id=CVE-2026-35191
• https://www.cve.org/CVERecord?id=CVE-2026-42772
• https://www.cve.org/CVERecord?id=CVE-2026-54872
• https://www.cve.org/CVERecord?id=CVE-2026-54873
• https://www.cve.org/CVERecord?id=CVE-2026-54875
• https://www.cve.org/CVERecord?id=CVE-2026-72897
• https://www.cve.org/CVERecord?id=CVE-2026-75804
• https://www.cve.org/CVERecord?id=CVE-2026-75805
• https://www.cve.org/CVERecord?id=CVE-2026-75806
• https://www.cve.org/CVERecord?id=CVE-2026-77696
• https://www.cve.org/CVERecord?id=CVE-2026-84784

SRPMS 10/core

• openssl-3.5.9-1.mga10

Publication date: 09 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-94422 Description
Message filtering bypass via reply serial. (CVE-2026-94422) References

• https://bugs.mageia.org/show_bug.cgi?id=36369
• https://www.openwall.com/lists/oss-security/2026/09/23/5
• https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq
• https://lists.debian.org/debian-security-announce/2026/msg00422.html
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/NKG63P7KLUREATNV6YUAI7RWYLCWSR6R/
• https://www.cve.org/CVERecord?id=CVE-2026-94422

SRPMS 10/core

• xdg-dbus-proxy-0.1.9-1.mga10

Publication date: 09 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-73581 , CVE-2026-75973 , CVE-2026-76183 , CVE-2026-77756 , CVE-2026-77762 , CVE-2026-77791 , CVE-2026-78383 , CVE-2026-78437 , CVE-2026-79677 , CVE-2026-86248 , CVE-2026-86350 , CVE-2026-87022 Description
OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. (CVE-2026-73581) Cross-context authentication mix-up with Jakarta Authentication configured. (CVE-2026-75973) Bypass of security constraints for WebSocket endpoints. (CVE-2026-76183) Transfer-Encoding honored for HTTP/1.0 requests. (CVE-2026-77756) Stale HPACK emitter injects trailers into recycled pooled Request. (CVE-2026-77762) DoS via busy wait during WebSocket close. (CVE-2026-77791) AJP DoS via missing request body. (CVE-2026-78383) HTTP/2 DoS via malformed request. (CVE-2026-78437) WebSocket DoS due to lost asynchronous write timeout. (CVE-2026-79677) Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled. (CVE-2026-86248) Regression in fix for CVE-2026-41293 can trigger request header mix-up. (CVE-2026-86350) WebSocket message smuggling with per-message-deflate. (CVE-2026-87022) References

• https://bugs.mageia.org/show_bug.cgi?id=36370
• https://www.openwall.com/lists/oss-security/2026/09/23/19
• https://www.openwall.com/lists/oss-security/2026/09/23/20
• https://www.openwall.com/lists/oss-security/2026/09/23/21
• https://www.openwall.com/lists/oss-security/2026/09/23/22
• https://www.openwall.com/lists/oss-security/2026/09/23/23
• https://www.openwall.com/lists/oss-security/2026/09/23/24
• https://www.openwall.com/lists/oss-security/2026/09/23/25
• https://www.openwall.com/lists/oss-security/2026/09/23/26
• https://www.openwall.com/lists/oss-security/2026/09/23/27
• https://www.openwall.com/lists/oss-security/2026/09/23/28
• https://www.openwall.com/lists/oss-security/2026/09/23/29
• https://www.openwall.com/lists/oss-security/2026/09/23/30
• https://www.cve.org/CVERecord?id=CVE-2026-73581
• https://www.cve.org/CVERecord?id=CVE-2026-75973
• https://www.cve.org/CVERecord?id=CVE-2026-76183
• https://www.cve.org/CVERecord?id=CVE-2026-77756
• https://www.cve.org/CVERecord?id=CVE-2026-77762
• https://www.cve.org/CVERecord?id=CVE-2026-77791
• https://www.cve.org/CVERecord?id=CVE-2026-78383
• https://www.cve.org/CVERecord?id=CVE-2026-78437
• https://www.cve.org/CVERecord?id=CVE-2026-79677
• https://www.cve.org/CVERecord?id=CVE-2026-86248
• https://www.cve.org/CVERecord?id=CVE-2026-86350
• https://www.cve.org/CVERecord?id=CVE-2026-87022

SRPMS 10/core

• tomcat-9.0.122-1.mga10

Publication date: 09 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-86145 , CVE-2026-103111 Description
PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API). (CVE-2026-86145) PCRE2: out-of-bounds write in JIT matching with large stack allocations. (CVE-2026-103111) References

• https://bugs.mageia.org/show_bug.cgi?id=36377
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4WZRH5FLU3A6ZQIPE6WRM7UV7K6S6UHP/
• https://www.openwall.com/lists/oss-security/2026/09/29/2
• https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.49
• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m
• https://lists.debian.org/debian-security-announce/2026/msg00443.html
• https://www.cve.org/CVERecord?id=CVE-2026-86145
• https://www.cve.org/CVERecord?id=CVE-2026-103111

SRPMS 10/core

• mingw-pcre2-10.49-1.mga10
• pcre2-10.49-1.mga10

Publication date: 09 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-97023 , CVE-2026-97024 , CVE-2026-97025 , CVE-2026-97026 , CVE-2026-97027 , CVE-2026-97029 Description
Arbitrary file deletion in root context via path traversal in deploy directory export/bin. (CVE-2026-97023) Arbitrary write in root context via path traversal in deploy directory files/etc. (CVE-2026-97024) World-readable oci authentication token in system-helper cache path. (CVE-2026-97025) World-writable temporary child repositories in system-helper cache path. (CVE-2026-97026) Denial of service via unsanitized keys in exported desktop entry / d-bus service files. (CVE-2026-97027) Sandboxed app can signal unsandboxed processes in the same process group. (CVE-2026-97029) References

• https://bugs.mageia.org/show_bug.cgi?id=36401
• https://www.openwall.com/lists/oss-security/2026/09/28/6
• https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf
• https://github.com/flatpak/flatpak/security/advisories/GHSA-5p67-xh8x-rq54
• https://github.com/flatpak/flatpak/security/advisories/GHSA-7rvf-rqr3-43j4
• https://github.com/flatpak/flatpak/security/advisories/GHSA-r9w3-qx54-qvc8
• https://github.com/flatpak/flatpak/security/advisories/GHSA-v64f-hrwr-j4vh
• https://github.com/flatpak/flatpak/security/advisories/GHSA-f3p8-vr7v-gxf2
• https://lists.debian.org/debian-security-announce/2026/msg00437.html
• https://www.cve.org/CVERecord?id=CVE-2026-97023
• https://www.cve.org/CVERecord?id=CVE-2026-97024
• https://www.cve.org/CVERecord?id=CVE-2026-97025
• https://www.cve.org/CVERecord?id=CVE-2026-97026
• https://www.cve.org/CVERecord?id=CVE-2026-97027
• https://www.cve.org/CVERecord?id=CVE-2026-97029

SRPMS 10/core

• flatpak-1.16.6-1.2.mga10

Publication date: 09 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-86243 , CVE-2026-86246 , CVE-2026-86247 Description
DoS via TLS handshake. (CVE-2026-86243) Insecure OpenSSL options enabled. (CVE-2026-86246) Client certificate requirements can be down-graded. (CVE-2026-86247) References

• https://bugs.mageia.org/show_bug.cgi?id=36469
• https://www.openwall.com/lists/oss-security/2026/09/23/31
• https://lists.apache.org/thread/8p4jf02w54m22x0cwpq2x53w3ov8o557
• https://www.openwall.com/lists/oss-security/2026/09/23/32
• https://lists.apache.org/thread/dgyvfwb24nbk45ptvlhdyhdhl5o7k5ol
• https://www.openwall.com/lists/oss-security/2026/09/23/33
• https://lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1
• https://www.cve.org/CVERecord?id=CVE-2026-86243
• https://www.cve.org/CVERecord?id=CVE-2026-86246
• https://www.cve.org/CVERecord?id=CVE-2026-86247

SRPMS 10/core

• tomcat-native-1.3.9-1.mga10

Publication date: 09 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-54634 Description
Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw() in tests/rigctl_parse.c, which writes a NUL byte at buf[buf_len + 1] outside its 200-byte stack buffer, and rig_send_raw() in src/rig.c, which copies reply_len - 1 bytes instead of the actual nbytes received. A remote client can send the CR terminator with a short payload to trigger both flaws in one command under the default no-password configuration. The out-of-bounds write can crash the daemon or corrupt adjacent stack memory, while the oversized copy can return up to 198 bytes of uninitialized stack data to the client. This issue is fixed in version 4.7.2. References

• https://bugs.mageia.org/show_bug.cgi?id=35756
• https://www.cve.org/CVERecord?id=CVE-2026-54634

SRPMS 10/core

• hamlib-4.7.2-1.mga10

Publication date: 09 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-32239 , CVE-2026-32240 Description
A negative Content-Length value was converted to unsigned, treating it as an impossibly large length instead (CVE-2026-32239). When using Transfer-Encoding: chunked, if a chunk's size parsed to a value of 2^64 or larger, it would be truncated to a 64-bit integer (CVE-2026-32240). References

• https://bugs.mageia.org/show_bug.cgi?id=36190
• https://ubuntu.com/security/notices/USN-8650-1
• https://github.com/capnproto/capnproto/security/advisories/GHSA-qjx3-pp3m-9jpm
• https://github.com/capnproto/capnproto/security/advisories/GHSA-vpcq-mx5v-32wm
• https://www.cve.org/CVERecord?id=CVE-2026-32239
• https://www.cve.org/CVERecord?id=CVE-2026-32240

SRPMS 10/core

• capnproto-1.5.0-1.mga10