Lector de Feeds

Publication date: 14 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-29509 Description
Patool < 4.0.5 Path Traversal via safe_extract() Function. (CVE-2026-29509) References

• https://bugs.mageia.org/show_bug.cgi?id=36356
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2KERDMQUL5APBLZX45J7IOQLRIR47LTF/
• https://www.cve.org/CVERecord?id=CVE-2026-29509

SRPMS 10/core

• patool-4.0.5-1.mga10

Publication date: 14 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-16768 , CVE-2026-81893 Description
out-of-bounds read in ico parser. (CVE-2026-16768) Invalid write in jpeg icc profile parser on error recovery. (CVE-2026-81893) References

• https://bugs.mageia.org/show_bug.cgi?id=36395
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBRMUGTKQY4SKAETRTPGKJJLAFAKW2BC/
• https://www.cve.org/CVERecord?id=CVE-2026-16768
• https://www.cve.org/CVERecord?id=CVE-2026-81893

SRPMS 10/core

• mingw-gdk-pixbuf-2.44.4-1.1.mga10

Publication date: 14 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-42356 , CVE-2026-42528 , CVE-2026-46729 , CVE-2026-47360 , CVE-2026-48005 , CVE-2026-56153 , CVE-2026-56154 , CVE-2026-56449 , CVE-2026-57941 , CVE-2026-58415 , CVE-2026-59685 , CVE-2026-59797 , CVE-2026-63045 , CVE-2026-63292 , CVE-2026-63686 , CVE-2026-63718 , CVE-2026-73636 , CVE-2026-73637 , CVE-2026-79768 , CVE-2026-93546 Description
Limited RCE for some internal redirects to non-CGI files in CGI directories. (CVE-2026-42356) mod_dav shared lock overflow. (CVE-2026-42528) mod_heartmonitor denial of service. (CVE-2026-46729) mod_session: Session cookie not removed during internal redirect. (CVE-2026-47360) mod_auth_digest reauthentication attack. (CVE-2026-48005) mod_charset_lite: Heap overflow in finish_partial_char. (CVE-2026-56153) mod_rewrite use-after-free via %{LA-U:HTTP:...}. (CVE-2026-56154) mod_proxy_html: crash in dump_content. (CVE-2026-56449) mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy. (CVE-2026-57941) mod_dav_fs property database read access. (CVE-2026-58415) Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM. (CVE-2026-59685) mod_ssl SSLRequire allows .htaccess ap_expr file-function. (CVE-2026-59797) mod_proxy_ftp PASV address handling. (CVE-2026-63045) mod_vhost_alias stack overflow. (CVE-2026-63292) mod_xml2enc crash on charset conversion failure. (CVE-2026-63686) mod_proxy_uwsgi Transfer-Encoding response smuggling. (CVE-2026-63718) mod_auth_digest one-time-nonce replay attack. (CVE-2026-73636) mod_auth_digest DoS attack. (CVE-2026-73637) mod_userdir information disclosure. (CVE-2026-79768) mod_dav_fs namespace overflow. (CVE-2026-93546) References

• https://bugs.mageia.org/show_bug.cgi?id=36432
• https://www.openwall.com/lists/oss-security/2026/10/01/11
• https://www.openwall.com/lists/oss-security/2026/10/01/12
• https://www.openwall.com/lists/oss-security/2026/10/01/13
• https://www.openwall.com/lists/oss-security/2026/10/01/14
• https://www.openwall.com/lists/oss-security/2026/10/01/15
• https://www.openwall.com/lists/oss-security/2026/10/01/16
• https://www.openwall.com/lists/oss-security/2026/10/01/17
• https://www.openwall.com/lists/oss-security/2026/10/01/18
• https://www.openwall.com/lists/oss-security/2026/10/01/19
• https://www.openwall.com/lists/oss-security/2026/10/01/20
• https://www.openwall.com/lists/oss-security/2026/10/01/21
• https://www.openwall.com/lists/oss-security/2026/10/01/22
• https://www.openwall.com/lists/oss-security/2026/10/01/23
• https://www.openwall.com/lists/oss-security/2026/10/01/24
• https://www.openwall.com/lists/oss-security/2026/10/01/25
• https://www.openwall.com/lists/oss-security/2026/10/01/26
• https://www.openwall.com/lists/oss-security/2026/10/01/27
• https://www.openwall.com/lists/oss-security/2026/10/01/28
• https://www.openwall.com/lists/oss-security/2026/10/01/29
• https://www.openwall.com/lists/oss-security/2026/10/01/30
• https://www.cve.org/CVERecord?id=CVE-2026-42356
• https://www.cve.org/CVERecord?id=CVE-2026-42528
• https://www.cve.org/CVERecord?id=CVE-2026-46729
• https://www.cve.org/CVERecord?id=CVE-2026-47360
• https://www.cve.org/CVERecord?id=CVE-2026-48005
• https://www.cve.org/CVERecord?id=CVE-2026-56153
• https://www.cve.org/CVERecord?id=CVE-2026-56154
• https://www.cve.org/CVERecord?id=CVE-2026-56449
• https://www.cve.org/CVERecord?id=CVE-2026-57941
• https://www.cve.org/CVERecord?id=CVE-2026-58415
• https://www.cve.org/CVERecord?id=CVE-2026-59685
• https://www.cve.org/CVERecord?id=CVE-2026-59797
• https://www.cve.org/CVERecord?id=CVE-2026-63045
• https://www.cve.org/CVERecord?id=CVE-2026-63292
• https://www.cve.org/CVERecord?id=CVE-2026-63686
• https://www.cve.org/CVERecord?id=CVE-2026-63718
• https://www.cve.org/CVERecord?id=CVE-2026-73636
• https://www.cve.org/CVERecord?id=CVE-2026-73637
• https://www.cve.org/CVERecord?id=CVE-2026-79768
• https://www.cve.org/CVERecord?id=CVE-2026-93546

SRPMS 10/core

• apache-2.4.69-1.mga10

Publication date: 14 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-97222 Description
Heap use-after-free when opening a malformed workbook. (CVE-2026-97222) References

• https://bugs.mageia.org/show_bug.cgi?id=36457
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/NTONDWDOTUVKZVERMNC4B4CDJHVOI63F/
• https://gitlab.gnome.org/GNOME/gnumeric/-/issues/897
• https://www.cve.org/CVERecord?id=CVE-2026-97222

SRPMS 10/core

• gnumeric-1.12.59-4.1.mga10

Publication date: 13 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-73638 , CVE-2026-93018 , CVE-2026-93019 , CVE-2026-102504 , CVE-2026-102505 Description
Buffer read underflows on 32-bit size_t systems decoding EXIF data. (CVE-2026-73638) Palette off-by-one discloses uninitialized heap memory. (CVE-2026-93018) TGA reader: signed colourmaplength causes process-killing allocator abort. (CVE-2026-93019) Unvalidated raw_datachannels can cause incorrect memory allocations. (CVE-2026-102504) getsamples(... type => "float") called on a paletted image allocated buffer overflow. (CVE-2026-102505) References

• https://bugs.mageia.org/show_bug.cgi?id=36330
• https://www.openwall.com/lists/oss-security/2026/09/17/5
• https://github.com/tonycoz/imager/security/advisories/GHSA-j47j-8w8p-3mmc
• https://github.com/tonycoz/imager/issues/568
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144226
• https://metacpan.org/release/TONYC/Imager-1.035/changes
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2IGAORFTDV6NM2L2NZCBWRWLAWHXUHK/
• https://lists.security.metacpan.org/cve-announce/msg/43654795/
• https://github.com/tonycoz/imager/security/advisories/GHSA-j7v7-cm4g-vrgf
• https://lists.security.metacpan.org/cve-announce/msg/43654761/
• https://github.com/tonycoz/imager/security/advisories/GHSA-p4vw-rc54-p2c2
• https://www.openwall.com/lists/oss-security/2026/10/01/9
• https://github.com/tonycoz/imager/security/advisories/GHSA-g549-r73g-x7x6
• https://metacpan.org/release/TONYC/Imager-1.037/changes
• https://www.openwall.com/lists/oss-security/2026/10/01/10
• https://github.com/tonycoz/imager/security/advisories/GHSA-4rx6-cgv3-fmxp
• https://www.cve.org/CVERecord?id=CVE-2026-73638
• https://www.cve.org/CVERecord?id=CVE-2026-93018
• https://www.cve.org/CVERecord?id=CVE-2026-93019
• https://www.cve.org/CVERecord?id=CVE-2026-102504
• https://www.cve.org/CVERecord?id=CVE-2026-102505

SRPMS 10/core

• perl-Imager-1.37.0-1.mga10

Publication date: 13 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-90439 Description
NGINX ngx_http_v3_module vulnerability. (CVE-2026-90439) References

• https://bugs.mageia.org/show_bug.cgi?id=36350
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/JMZSWT7GG4DHCGJVXSFXVBFASZL3EYRJ/
• https://my.f5.com/manage/s/article/K000162604
• https://www.cve.org/CVERecord?id=CVE-2026-90439

SRPMS 10/core

• nginx-1.30.5-1.mga10

Publication date: 13 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-84471 , CVE-2026-84732 Description
Improve on check_session_buf_not_used(), catch possible double-free in the lame duck case. (CVE-2026-84471) Reliability layer: avoid unbounded reliable TLS timeout, and ignore acks for packets that cannot be outstanding. (CVE-2026-84732) References

• https://bugs.mageia.org/show_bug.cgi?id=36429
• https://ubuntu.com/security/notices/USN-8852-1
• https://github.com/OpenVPN/openvpn/releases/tag/v2.6.23
• https://www.cve.org/CVERecord?id=CVE-2026-84471
• https://www.cve.org/CVERecord?id=CVE-2026-84732

SRPMS 10/core

• openvpn-2.6.23-1.mga10

Publication date: 13 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-97032 , CVE-2026-78659 , CVE-2026-97031 , CVE-2026-94444 , CVE-2026-94447 , CVE-2026-94448 , CVE-2026-97030 , CVE-2026-94440 , CVE-2026-56866 , CVE-2026-94439 , CVE-2026-78669 , CVE-2026-78660 , CVE-2026-78667 , CVE-2026-78663 Description
net/http: HTTP/2 server crash due to HPACK encoder race net/http: HTTP/2 server memory exhaustion due to Trailer headers crypto/tls: reject malformed ECH outer extension references cmd/go: checksum bypass for golang.org/fips140 cmd/go: checksum database bypass for golang.org/toolchain html/template: reset context tracking on consecutive template expressions html/template: recognize |yield| as regexp preceder keyword net/textproto, mime/multipart: memory limit bypass when parsing MIME headers net/http: HTTP/1 client connection desynchronization after CONNECT rejection net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response net/http: excessive CPU consumption from repeated initial window changes net/http: HTTP/2 transport accepts malformed framing-related headers net/http: lack of limit on size of parsed Range headers net/http: double flow control refund on HTTP/2 server streams References

• https://bugs.mageia.org/show_bug.cgi?id=36481
• https://www.openwall.com/lists/oss-security/2026/10/08/9
• https://www.cve.org/CVERecord?id=CVE-2026-97032
• https://www.cve.org/CVERecord?id=CVE-2026-78659
• https://www.cve.org/CVERecord?id=CVE-2026-97031
• https://www.cve.org/CVERecord?id=CVE-2026-94444
• https://www.cve.org/CVERecord?id=CVE-2026-94447
• https://www.cve.org/CVERecord?id=CVE-2026-94448
• https://www.cve.org/CVERecord?id=CVE-2026-97030
• https://www.cve.org/CVERecord?id=CVE-2026-94440
• https://www.cve.org/CVERecord?id=CVE-2026-56866
• https://www.cve.org/CVERecord?id=CVE-2026-94439
• https://www.cve.org/CVERecord?id=CVE-2026-78669
• https://www.cve.org/CVERecord?id=CVE-2026-78660
• https://www.cve.org/CVERecord?id=CVE-2026-78667
• https://www.cve.org/CVERecord?id=CVE-2026-78663

SRPMS 10/core

• golang-1.26.9-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-53938 , CVE-2026-53939 Description
The updated packages fix security vulnerabilities: Heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW). (CVE-2026-53938) All-zero Content Encryption Key used for AES-CBC-HMAC JWE encryption. (CVE-2026-53939) References

• https://bugs.mageia.org/show_bug.cgi?id=36320
• https://lists.debian.org/debian-security-announce/2026/msg00410.html
• https://github.com/OpenIDC/cjose/security/advisories/GHSA-75r7-f5cv-g3wj
• https://github.com/OpenIDC/cjose/security/advisories/GHSA-f6wf-pqg3-6wqq
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/2D6S3Z3ZBW3G2GOAA7DPZOCHKZ67LAUY/
• https://www.cve.org/CVERecord?id=CVE-2026-53938
• https://www.cve.org/CVERecord?id=CVE-2026-53939

SRPMS 10/core

• cjose-0.6.2.4-1.1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2025-15614 Description
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process. References

• https://bugs.mageia.org/show_bug.cgi?id=36487
• https://github.com/Genivia/ugrep/issues/511
• https://github.com/Genivia/ugrep/releases/tag/v7.6.0
• https://www.cve.org/CVERecord?id=CVE-2025-15614

SRPMS 10/core

• ugrep-7.8.5-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-56711 , CVE-2026-73324 Description
VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability. (CVE-2026-56711) VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability. (CVE-2026-73324) References

• https://bugs.mageia.org/show_bug.cgi?id=36405
• https://www.cve.org/CVERecord?id=CVE-2026-56711
• https://www.cve.org/CVERecord?id=CVE-2026-73324

SRPMS 10/core

• vlc-3.0.24-1.mga10

10/tainted

• vlc-3.0.24-1.mga10.tainted

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-95386 , CVE-2026-95387 , CVE-2026-95388 , CVE-2026-95389 , CVE-2026-95390 , CVE-2026-95391 , CVE-2026-95392 , CVE-2026-95393 , CVE-2026-95394 , CVE-2026-95395 , CVE-2026-96415 , CVE-2026-96416 , CVE-2026-96417 , CVE-2026-96418 , CVE-2026-96419 , CVE-2026-96420 , CVE-2026-96421 , CVE-2026-96422 , CVE-2026-96423 Description
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark. (CVE-2026-95386) Heap-based Buffer Overflow in Wireshark. (CVE-2026-95387) Heap-based Buffer Overflow in Wireshark. (CVE-2026-95388) Heap-based Buffer Overflow in Wireshark. (CVE-2026-95389) NULL Pointer Dereference in Wireshark. (CVE-2026-95390) Use After Free in Wireshark. (CVE-2026-95391) Buffer Over-read in Wireshark. (CVE-2026-95392) Heap-based Buffer Overflow in Wireshark. (CVE-2026-95393) Unchecked Input for Loop Condition in Wireshark. (CVE-2026-95394) Missing Release of Memory after Effective Lifetime in Wireshark. (CVE-2026-95395) The Catapult DCT2000 protocol dissector could crash. (CVE-2026-96415) The IEEE 802.11 protocol dissector could crash. (CVE-2026-96416) The RF4CE protocol dissector could crash. (CVE-2026-96417) The TIFF protocol dissector could go into an infinite loop. (CVE-2026-96418) Importing a crafted configuration profile could crash Wireshark or execute arbitrary code. (CVE-2026-96419) The Toshiba file parser could crash. (CVE-2026-96420) The USB HID protocol dissector could go into an infinite loop and leak memory. (CVE-2026-96421) The Frame protocol metadissector could crash. (CVE-2026-96422) The X11 protocol dissector could crash. (CVE-2026-96423) References

• https://bugs.mageia.org/show_bug.cgi?id=36456
• https://lists.debian.org/debian-security-announce/2026/msg00455.html
• https://www.wireshark.org/security/wnpa-sec-2026-97
• https://gitlab.com/wireshark/wireshark/-/issues/21487
• https://www.wireshark.org/security/wnpa-sec-2026-101
• https://gitlab.com/wireshark/wireshark/-/issues/21545
• https://www.wireshark.org/security/wnpa-sec-2026-93
• https://gitlab.com/wireshark/wireshark/-/issues/21481
• https://www.wireshark.org/security/wnpa-sec-2026-100
• https://gitlab.com/wireshark/wireshark/-/issues/21549
• https://gitlab.com/wireshark/wireshark/-/issues/21550
• https://www.wireshark.org/security/wnpa-sec-2026-99
• https://gitlab.com/wireshark/wireshark/-/issues/21510
• https://www.wireshark.org/security/wnpa-sec-2026-98
• https://gitlab.com/wireshark/wireshark/-/issues/21523
• https://www.wireshark.org/security/wnpa-sec-2026-96
• https://gitlab.com/wireshark/wireshark/-/issues/21492
• https://www.wireshark.org/security/wnpa-sec-2026-110
• https://gitlab.com/wireshark/wireshark/-/issues/21589
• https://www.wireshark.org/security/wnpa-sec-2026-109
• https://gitlab.com/wireshark/wireshark/-/issues/21564
• https://www.wireshark.org/security/wnpa-sec-2026-104
• https://gitlab.com/wireshark/wireshark/-/issues/21574
• https://www.wireshark.org/security/wnpa-sec-2026-107
• https://gitlab.com/wireshark/wireshark/-/issues/21565
• https://www.wireshark.org/security/wnpa-sec-2026-106
• https://gitlab.com/wireshark/wireshark/-/issues/21553
• https://www.wireshark.org/security/wnpa-sec-2026-105
• https://gitlab.com/wireshark/wireshark/-/issues/21541
• https://www.wireshark.org/security/wnpa-sec-2026-103
• https://gitlab.com/wireshark/wireshark/-/issues/21566
• https://www.wireshark.org/security/wnpa-sec-2026-102
• https://gitlab.com/wireshark/wireshark/-/issues/21525
• https://www.wireshark.org/security/wnpa-sec-2026-108
• https://gitlab.com/wireshark/wireshark/-/issues/21563
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/C5DQL3SVTFVDEEP3UXXLRF6HOVKTIQNJ/
• https://www.wireshark.org/security/wnpa-sec-2026-94
• https://gitlab.com/wireshark/wireshark/-/issues/21501
• https://www.wireshark.org/security/wnpa-sec-2026-95
• https://gitlab.com/wireshark/wireshark/-/issues/21503
• https://www.wireshark.org/security/wnpa-sec-2026-92
• https://www.cve.org/CVERecord?id=CVE-2026-95386
• https://www.cve.org/CVERecord?id=CVE-2026-95387
• https://www.cve.org/CVERecord?id=CVE-2026-95388
• https://www.cve.org/CVERecord?id=CVE-2026-95389
• https://www.cve.org/CVERecord?id=CVE-2026-95390
• https://www.cve.org/CVERecord?id=CVE-2026-95391
• https://www.cve.org/CVERecord?id=CVE-2026-95392
• https://www.cve.org/CVERecord?id=CVE-2026-95393
• https://www.cve.org/CVERecord?id=CVE-2026-95394
• https://www.cve.org/CVERecord?id=CVE-2026-95395
• https://www.cve.org/CVERecord?id=CVE-2026-96415
• https://www.cve.org/CVERecord?id=CVE-2026-96416
• https://www.cve.org/CVERecord?id=CVE-2026-96417
• https://www.cve.org/CVERecord?id=CVE-2026-96418
• https://www.cve.org/CVERecord?id=CVE-2026-96419
• https://www.cve.org/CVERecord?id=CVE-2026-96420
• https://www.cve.org/CVERecord?id=CVE-2026-96421
• https://www.cve.org/CVERecord?id=CVE-2026-96422
• https://www.cve.org/CVERecord?id=CVE-2026-96423

SRPMS 10/core

• wireshark-4.6.9-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-103500 , CVE-2026-96869 , CVE-2026-100756 , CVE-2026-100757 , CVE-2026-100758 , CVE-2026-100759 , CVE-2026-100760 , CVE-2026-100762 , CVE-2026-100765 , CVE-2026-100766 , CVE-2026-100767 , CVE-2026-100769 , CVE-2026-100770 , CVE-2026-100771 , CVE-2026-100772 , CVE-2026-100773 , CVE-2026-100774 , CVE-2026-100775 , CVE-2026-100776 , CVE-2026-100777 , CVE-2026-100778 , CVE-2026-100779 , CVE-2026-100780 , CVE-2026-100781 , CVE-2026-100782 , CVE-2026-100783 , CVE-2026-100784 , CVE-2026-100785 , CVE-2026-100786 , CVE-2026-100787 , CVE-2026-100788 , CVE-2026-100789 , CVE-2026-100790 , CVE-2026-100791 , CVE-2026-100792 , CVE-2026-100794 , CVE-2026-100797 , CVE-2026-100798 , CVE-2026-100800 , CVE-2026-100801 , CVE-2026-100803 , CVE-2026-100806 , CVE-2026-100807 , CVE-2026-100808 , CVE-2026-100809 , CVE-2026-100811 , CVE-2026-100812 , CVE-2026-100814 , CVE-2026-100815 , CVE-2026-100816 , CVE-2026-100818 , CVE-2026-100819 , CVE-2026-100820 , CVE-2026-100821 , CVE-2026-100822 , CVE-2026-100824 , CVE-2026-100825 , CVE-2026-100826 , CVE-2026-100828 , CVE-2026-100829 , CVE-2026-100830 , CVE-2026-100831 , CVE-2026-100832 Description
Heap buffer overflow opening large email. (CVE-2026-103500) Incorrect boundary conditions in the Audio/Video: Playback component. (CVE-2026-100756) Use-after-free in the Widget component. (CVE-2026-100757) Sandbox escape in the DOM: Navigation component. (CVE-2026-100758) Uninitialized memory in the Storage: Quota Manager component. (CVE-2026-100759) Sandbox escape in the Security: Process Sandboxing component. (CVE-2026-100760) Sandbox escape due to use-after-free in the DOM: Content Processes component. (CVE-2026-100762) Use-after-free in the JavaScript: WebAssembly component. (CVE-2026-100765) Information disclosure in the Networking: JAR component. (CVE-2026-100766) Use-after-free in the Networking: Cache component. (CVE-2026-100767) Use-after-free in the JavaScript: WebAssembly component. (CVE-2026-100769) Sandbox escape due to use-after-free in the DOM: Content Processes component. (CVE-2026-100770) Undefined behavior in the DOM: Streams component. (CVE-2026-100771) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100772) Use-after-free in the Storage: IndexedDB component. (CVE-2026-100773) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100774) Sandbox escape in the Graphics component. (CVE-2026-100775) Use-after-free in the JavaScript: WebAssembly component. (CVE-2026-100776) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-100777) Sandbox escape due to use-after-free in the DOM: Core & HTML component. (CVE-2026-100778) Use-after-free in the XSLT component. (CVE-2026-100779) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100780) Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. (CVE-2026-100781) Privilege escalation due to incorrect boundary conditions in the Graphics component. (CVE-2026-100782) Uninitialized memory in the Audio/Video component. (CVE-2026-100783) Use-after-free in the Layout: Text and Fonts component. (CVE-2026-100784) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100785) Sandbox escape due to use-after-free in the Graphics component. (CVE-2026-100786) Sandbox escape in the XUL component. (CVE-2026-100787) Invalid pointer in the JavaScript: WebAssembly component. (CVE-2026-100788) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-100789) Use-after-free in the XSLT component. (CVE-2026-100790) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100791) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-100832) JIT miscompilation in the JavaScript: WebAssembly component. (CVE-2026-100792) Sandbox escape due to incorrect boundary conditions in the Internationalization component. (CVE-2026-100794) Information disclosure in the Networking component. (CVE-2026-96869) Privilege escalation due to use-after-free in the Graphics: WebRender component. (CVE-2026-100797) Cryptography misuse in Storage: Quota Manager component. (CVE-2026-100798) Sandbox escape due to use-after-free in the Disability Access APIs component. (CVE-2026-100800) Privilege escalation in the DLL Services component. (CVE-2026-100801) Same-origin policy bypass in the WebExtensions component. (CVE-2026-100803) Uninitialized memory in the Graphics: WebGPU component. (CVE-2026-100806) Privilege escalation in the DOM: Service Workers component. (CVE-2026-100807) Mitigation bypass in the DOM: Service Workers component. (CVE-2026-100808) Same-origin policy bypass in the DevTools component. (CVE-2026-100809) Sandbox escape due to use-after-free in the DOM: Core & HTML component. (CVE-2026-100811) Denial-of-service in the Graphics component. (CVE-2026-100812) Incorrect boundary conditions in the JavaScript Engine: JIT component. (CVE-2026-100814) Use-after-free in the CSS Parsing and Computation component. (CVE-2026-100815) Site isolation issue in the DOM: Networking component. (CVE-2026-100816) Sandbox escape due to use-after-free in the Widget: Gtk component. (CVE-2026-100818) Sandbox escape due to incorrect boundary conditions in the XPCOM component. (CVE-2026-100819) Privilege escalation in the Address Bar component. (CVE-2026-100820) Site isolation issue in the Panning and Zooming component. (CVE-2026-100821) Spoofing issue in the Networking: HTTP component. (CVE-2026-100822) Privilege escalation in the Places component. (CVE-2026-100824) Use-after-free in the JavaScript Engine: JIT component. (CVE-2026-100825) Denial-of-service in the Storage: StorageManager component. (CVE-2026-100826) Mitigation bypass in the Bookmarks & History component. (CVE-2026-100828) Mitigation bypass in the DOM: Security component. (CVE-2026-100829) Mitigation bypass in the DOM: Navigation component. (CVE-2026-100830) Use-after-free in the DOM: UI Events & Focus Handling component. (CVE-2026-100831) References

• https://bugs.mageia.org/show_bug.cgi?id=36416
• https://www.thunderbird.net/en-US/thunderbird/153.4.0esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/
• https://www.cve.org/CVERecord?id=CVE-2026-103500
• https://www.cve.org/CVERecord?id=CVE-2026-96869
• https://www.cve.org/CVERecord?id=CVE-2026-100756
• https://www.cve.org/CVERecord?id=CVE-2026-100757
• https://www.cve.org/CVERecord?id=CVE-2026-100758
• https://www.cve.org/CVERecord?id=CVE-2026-100759
• https://www.cve.org/CVERecord?id=CVE-2026-100760
• https://www.cve.org/CVERecord?id=CVE-2026-100762
• https://www.cve.org/CVERecord?id=CVE-2026-100765
• https://www.cve.org/CVERecord?id=CVE-2026-100766
• https://www.cve.org/CVERecord?id=CVE-2026-100767
• https://www.cve.org/CVERecord?id=CVE-2026-100769
• https://www.cve.org/CVERecord?id=CVE-2026-100770
• https://www.cve.org/CVERecord?id=CVE-2026-100771
• https://www.cve.org/CVERecord?id=CVE-2026-100772
• https://www.cve.org/CVERecord?id=CVE-2026-100773
• https://www.cve.org/CVERecord?id=CVE-2026-100774
• https://www.cve.org/CVERecord?id=CVE-2026-100775
• https://www.cve.org/CVERecord?id=CVE-2026-100776
• https://www.cve.org/CVERecord?id=CVE-2026-100777
• https://www.cve.org/CVERecord?id=CVE-2026-100778
• https://www.cve.org/CVERecord?id=CVE-2026-100779
• https://www.cve.org/CVERecord?id=CVE-2026-100780
• https://www.cve.org/CVERecord?id=CVE-2026-100781
• https://www.cve.org/CVERecord?id=CVE-2026-100782
• https://www.cve.org/CVERecord?id=CVE-2026-100783
• https://www.cve.org/CVERecord?id=CVE-2026-100784
• https://www.cve.org/CVERecord?id=CVE-2026-100785
• https://www.cve.org/CVERecord?id=CVE-2026-100786
• https://www.cve.org/CVERecord?id=CVE-2026-100787
• https://www.cve.org/CVERecord?id=CVE-2026-100788
• https://www.cve.org/CVERecord?id=CVE-2026-100789
• https://www.cve.org/CVERecord?id=CVE-2026-100790
• https://www.cve.org/CVERecord?id=CVE-2026-100791
• https://www.cve.org/CVERecord?id=CVE-2026-100792
• https://www.cve.org/CVERecord?id=CVE-2026-100794
• https://www.cve.org/CVERecord?id=CVE-2026-100797
• https://www.cve.org/CVERecord?id=CVE-2026-100798
• https://www.cve.org/CVERecord?id=CVE-2026-100800
• https://www.cve.org/CVERecord?id=CVE-2026-100801
• https://www.cve.org/CVERecord?id=CVE-2026-100803
• https://www.cve.org/CVERecord?id=CVE-2026-100806
• https://www.cve.org/CVERecord?id=CVE-2026-100807
• https://www.cve.org/CVERecord?id=CVE-2026-100808
• https://www.cve.org/CVERecord?id=CVE-2026-100809
• https://www.cve.org/CVERecord?id=CVE-2026-100811
• https://www.cve.org/CVERecord?id=CVE-2026-100812
• https://www.cve.org/CVERecord?id=CVE-2026-100814
• https://www.cve.org/CVERecord?id=CVE-2026-100815
• https://www.cve.org/CVERecord?id=CVE-2026-100816
• https://www.cve.org/CVERecord?id=CVE-2026-100818
• https://www.cve.org/CVERecord?id=CVE-2026-100819
• https://www.cve.org/CVERecord?id=CVE-2026-100820
• https://www.cve.org/CVERecord?id=CVE-2026-100821
• https://www.cve.org/CVERecord?id=CVE-2026-100822
• https://www.cve.org/CVERecord?id=CVE-2026-100824
• https://www.cve.org/CVERecord?id=CVE-2026-100825
• https://www.cve.org/CVERecord?id=CVE-2026-100826
• https://www.cve.org/CVERecord?id=CVE-2026-100828
• https://www.cve.org/CVERecord?id=CVE-2026-100829
• https://www.cve.org/CVERecord?id=CVE-2026-100830
• https://www.cve.org/CVERecord?id=CVE-2026-100831
• https://www.cve.org/CVERecord?id=CVE-2026-100832

SRPMS 10/core

• thunderbird-l10n-153.4.0-1.mga10
• thunderbird-153.4.0-3.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-96869 , CVE-2026-100756 , CVE-2026-100757 , CVE-2026-100758 , CVE-2026-100759 , CVE-2026-100760 , CVE-2026-100762 , CVE-2026-100765 , CVE-2026-100766 , CVE-2026-100767 , CVE-2026-100769 , CVE-2026-100770 , CVE-2026-100771 , CVE-2026-100772 , CVE-2026-100773 , CVE-2026-100774 , CVE-2026-100775 , CVE-2026-100776 , CVE-2026-100777 , CVE-2026-100778 , CVE-2026-100779 , CVE-2026-100780 , CVE-2026-100781 , CVE-2026-100782 , CVE-2026-100783 , CVE-2026-100784 , CVE-2026-100785 , CVE-2026-100786 , CVE-2026-100787 , CVE-2026-100788 , CVE-2026-100789 , CVE-2026-100790 , CVE-2026-100791 , CVE-2026-100792 , CVE-2026-100794 , CVE-2026-100797 , CVE-2026-100798 , CVE-2026-100800 , CVE-2026-100801 , CVE-2026-100803 , CVE-2026-100806 , CVE-2026-100807 , CVE-2026-100808 , CVE-2026-100809 , CVE-2026-100811 , CVE-2026-100812 , CVE-2026-100814 , CVE-2026-100815 , CVE-2026-100816 , CVE-2026-100818 , CVE-2026-100819 , CVE-2026-100820 , CVE-2026-100821 , CVE-2026-100822 , CVE-2026-100824 , CVE-2026-100825 , CVE-2026-100826 , CVE-2026-100828 , CVE-2026-100829 , CVE-2026-100830 , CVE-2026-100831 , CVE-2026-100832 Description
Incorrect boundary conditions in the Audio/Video: Playback component. (CVE-2026-100756) Use-after-free in the Widget component. (CVE-2026-100757) Sandbox escape in the DOM: Navigation component. (CVE-2026-100758) Uninitialized memory in the Storage: Quota Manager component. (CVE-2026-100759) Sandbox escape in the Security: Process Sandboxing component. (CVE-2026-100760) Sandbox escape due to use-after-free in the DOM: Content Processes component. (CVE-2026-100762) Use-after-free in the JavaScript: WebAssembly component. (CVE-2026-100765) Information disclosure in the Networking: JAR component. (CVE-2026-100766) Use-after-free in the Networking: Cache component. (CVE-2026-100767) Use-after-free in the JavaScript: WebAssembly component. (CVE-2026-100769) Sandbox escape due to use-after-free in the DOM: Content Processes component. (CVE-2026-100770) Undefined behavior in the DOM: Streams component. (CVE-2026-100771) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100772) Use-after-free in the Storage: IndexedDB component. (CVE-2026-100773) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100774) Sandbox escape in the Graphics component. (CVE-2026-100775) Use-after-free in the JavaScript: WebAssembly component. (CVE-2026-100776) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-100777) Sandbox escape due to use-after-free in the DOM: Core & HTML component. (CVE-2026-100778) Use-after-free in the XSLT component. (CVE-2026-100779) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100780) Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. (CVE-2026-100781) Privilege escalation due to incorrect boundary conditions in the Graphics component. (CVE-2026-100782) Uninitialized memory in the Audio/Video component. (CVE-2026-100783) Use-after-free in the Layout: Text and Fonts component. (CVE-2026-100784) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100785) Sandbox escape due to use-after-free in the Graphics component. (CVE-2026-100786) Sandbox escape in the XUL component. (CVE-2026-100787) Invalid pointer in the JavaScript: WebAssembly component. (CVE-2026-100788) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-100789) Use-after-free in the XSLT component. (CVE-2026-100790) Use-after-free in the DOM: Core & HTML component. (CVE-2026-100791) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-100832) JIT miscompilation in the JavaScript: WebAssembly component. (CVE-2026-100792) Sandbox escape due to incorrect boundary conditions in the Internationalization component. (CVE-2026-100794) Information disclosure in the Networking component. (CVE-2026-96869) Privilege escalation due to use-after-free in the Graphics: WebRender component. (CVE-2026-100797) Cryptography misuse in Storage: Quota Manager component. (CVE-2026-100798) Sandbox escape due to use-after-free in the Disability Access APIs component. (CVE-2026-100800) Privilege escalation in the DLL Services component. (CVE-2026-100801) Same-origin policy bypass in the WebExtensions component. (CVE-2026-100803) Uninitialized memory in the Graphics: WebGPU component. (CVE-2026-100806) Privilege escalation in the DOM: Service Workers component. (CVE-2026-100807) Mitigation bypass in the DOM: Service Workers component. (CVE-2026-100808) Same-origin policy bypass in the DevTools component. (CVE-2026-100809) Sandbox escape due to use-after-free in the DOM: Core & HTML component. (CVE-2026-100811) Denial-of-service in the Graphics component. (CVE-2026-100812) Incorrect boundary conditions in the JavaScript Engine: JIT component. (CVE-2026-100814) Use-after-free in the CSS Parsing and Computation component. (CVE-2026-100815) Site isolation issue in the DOM: Networking component. (CVE-2026-100816) Sandbox escape due to use-after-free in the Widget: Gtk component. (CVE-2026-100818) Sandbox escape due to incorrect boundary conditions in the XPCOM component. (CVE-2026-100819) Privilege escalation in the Address Bar component. (CVE-2026-100820) Site isolation issue in the Panning and Zooming component. (CVE-2026-100821) Spoofing issue in the Networking: HTTP component. (CVE-2026-100822) Privilege escalation in the Places component. (CVE-2026-100824) Use-after-free in the JavaScript Engine: JIT component. (CVE-2026-100825) Denial-of-service in the Storage: StorageManager component. (CVE-2026-100826) Mitigation bypass in the Bookmarks & History component. (CVE-2026-100828) Mitigation bypass in the DOM: Security component. (CVE-2026-100829) Mitigation bypass in the DOM: Navigation component. (CVE-2026-100830) Use-after-free in the DOM: UI Events & Focus Handling component. (CVE-2026-100831) References

• https://bugs.mageia.org/show_bug.cgi?id=36413
• https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_130.html
• https://www.firefox.com/en-US/firefox/153.4.0/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/
• https://www.cve.org/CVERecord?id=CVE-2026-96869
• https://www.cve.org/CVERecord?id=CVE-2026-100756
• https://www.cve.org/CVERecord?id=CVE-2026-100757
• https://www.cve.org/CVERecord?id=CVE-2026-100758
• https://www.cve.org/CVERecord?id=CVE-2026-100759
• https://www.cve.org/CVERecord?id=CVE-2026-100760
• https://www.cve.org/CVERecord?id=CVE-2026-100762
• https://www.cve.org/CVERecord?id=CVE-2026-100765
• https://www.cve.org/CVERecord?id=CVE-2026-100766
• https://www.cve.org/CVERecord?id=CVE-2026-100767
• https://www.cve.org/CVERecord?id=CVE-2026-100769
• https://www.cve.org/CVERecord?id=CVE-2026-100770
• https://www.cve.org/CVERecord?id=CVE-2026-100771
• https://www.cve.org/CVERecord?id=CVE-2026-100772
• https://www.cve.org/CVERecord?id=CVE-2026-100773
• https://www.cve.org/CVERecord?id=CVE-2026-100774
• https://www.cve.org/CVERecord?id=CVE-2026-100775
• https://www.cve.org/CVERecord?id=CVE-2026-100776
• https://www.cve.org/CVERecord?id=CVE-2026-100777
• https://www.cve.org/CVERecord?id=CVE-2026-100778
• https://www.cve.org/CVERecord?id=CVE-2026-100779
• https://www.cve.org/CVERecord?id=CVE-2026-100780
• https://www.cve.org/CVERecord?id=CVE-2026-100781
• https://www.cve.org/CVERecord?id=CVE-2026-100782
• https://www.cve.org/CVERecord?id=CVE-2026-100783
• https://www.cve.org/CVERecord?id=CVE-2026-100784
• https://www.cve.org/CVERecord?id=CVE-2026-100785
• https://www.cve.org/CVERecord?id=CVE-2026-100786
• https://www.cve.org/CVERecord?id=CVE-2026-100787
• https://www.cve.org/CVERecord?id=CVE-2026-100788
• https://www.cve.org/CVERecord?id=CVE-2026-100789
• https://www.cve.org/CVERecord?id=CVE-2026-100790
• https://www.cve.org/CVERecord?id=CVE-2026-100791
• https://www.cve.org/CVERecord?id=CVE-2026-100792
• https://www.cve.org/CVERecord?id=CVE-2026-100794
• https://www.cve.org/CVERecord?id=CVE-2026-100797
• https://www.cve.org/CVERecord?id=CVE-2026-100798
• https://www.cve.org/CVERecord?id=CVE-2026-100800
• https://www.cve.org/CVERecord?id=CVE-2026-100801
• https://www.cve.org/CVERecord?id=CVE-2026-100803
• https://www.cve.org/CVERecord?id=CVE-2026-100806
• https://www.cve.org/CVERecord?id=CVE-2026-100807
• https://www.cve.org/CVERecord?id=CVE-2026-100808
• https://www.cve.org/CVERecord?id=CVE-2026-100809
• https://www.cve.org/CVERecord?id=CVE-2026-100811
• https://www.cve.org/CVERecord?id=CVE-2026-100812
• https://www.cve.org/CVERecord?id=CVE-2026-100814
• https://www.cve.org/CVERecord?id=CVE-2026-100815
• https://www.cve.org/CVERecord?id=CVE-2026-100816
• https://www.cve.org/CVERecord?id=CVE-2026-100818
• https://www.cve.org/CVERecord?id=CVE-2026-100819
• https://www.cve.org/CVERecord?id=CVE-2026-100820
• https://www.cve.org/CVERecord?id=CVE-2026-100821
• https://www.cve.org/CVERecord?id=CVE-2026-100822
• https://www.cve.org/CVERecord?id=CVE-2026-100824
• https://www.cve.org/CVERecord?id=CVE-2026-100825
• https://www.cve.org/CVERecord?id=CVE-2026-100826
• https://www.cve.org/CVERecord?id=CVE-2026-100828
• https://www.cve.org/CVERecord?id=CVE-2026-100829
• https://www.cve.org/CVERecord?id=CVE-2026-100830
• https://www.cve.org/CVERecord?id=CVE-2026-100831
• https://www.cve.org/CVERecord?id=CVE-2026-100832

SRPMS 10/core

• nss-3.130.0-1.mga10
• firefox-l10n-153.4.0-1.mga10
• firefox-153.4.0-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-35328 , CVE-2026-35329 , CVE-2026-35330 , CVE-2026-35331 , CVE-2026-35332 , CVE-2026-35333 , CVE-2026-35334 , CVE-2026-47895 , CVE-2026-78123 , CVE-2026-78124 , CVE-2026-78126 , CVE-2026-78127 , CVE-2026-78129 Description
Please see the links for aditional information about the vulnerabilities. References

• https://bugs.mageia.org/show_bug.cgi?id=35413
• https://lists.debian.org/debian-security-announce/2026/msg00137.html
• https://ubuntu.com/security/notices/USN-8407-1
• https://www.strongswan.org/blog/2026/06/08/strongswan-vulnerability-(cve-2026-47895).html
• https://lists.debian.org/debian-security-announce/2026/msg00246.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/72R2725DIUVMEB7TOVID7XNHTPDC3UIH/
• https://lists.debian.org/debian-security-announce/2026/msg00398.html
• https://ubuntu.com/security/notices/USN-8789-1
• https://www.cve.org/CVERecord?id=CVE-2026-35328
• https://www.cve.org/CVERecord?id=CVE-2026-35329
• https://www.cve.org/CVERecord?id=CVE-2026-35330
• https://www.cve.org/CVERecord?id=CVE-2026-35331
• https://www.cve.org/CVERecord?id=CVE-2026-35332
• https://www.cve.org/CVERecord?id=CVE-2026-35333
• https://www.cve.org/CVERecord?id=CVE-2026-35334
• https://www.cve.org/CVERecord?id=CVE-2026-47895
• https://www.cve.org/CVERecord?id=CVE-2026-78123
• https://www.cve.org/CVERecord?id=CVE-2026-78124
• https://www.cve.org/CVERecord?id=CVE-2026-78126
• https://www.cve.org/CVERecord?id=CVE-2026-78127
• https://www.cve.org/CVERecord?id=CVE-2026-78129

SRPMS 10/core

• strongswan-6.1.0-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
Description
This update fixes security issues: - Only accept a CONFLUX_LINK cell on a plain OR circuit, and refuse to turn a (pending) conflux leg into an introduction or rendezvous point. Previously a client could link a rendezvous-point circuit into a conflux set and then, with a forged sequence number in the LINK cell, make the relay tear the set down from inside the rendezvous splice, triggering a fatal assertion in assert_circuit_ok(). Also reject a LINK/LINKED cell whose last_seqno_recv is above what we ever sent on the set. - Correctly copy the MiddleOnly flag from routerstatuses to node objects. Without this fix, the MiddleOnly flag was ignored on non-authorities, and clients could use MiddleOnly relays for inappropriate roles in onion service circuits. Tracked as TROVE-2026-067. - Treat a router descriptor as expired if any of its family certificates has expired. Previously, we incorrectly ignored the expiration time of the family certificate. Tracked as TROVE-2026-062. References

• https://bugs.mageia.org/show_bug.cgi?id=36473
• https://www.openwall.com/lists/oss-security/2026/10/07/33

SRPMS 10/core

• tor-0.4.9.14-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-13503 Description
ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal. (CVE-2026-13503) References

• https://bugs.mageia.org/show_bug.cgi?id=35969
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AQBYU5CQQO6MHRX47JUHB4YRMYUNG45D/
• https://www.cve.org/CVERecord?id=CVE-2026-13503

SRPMS 10/core

• antlr4-project-4.13.2-3.1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-53783 , CVE-2026-53784 , CVE-2026-53785 , CVE-2026-53786 , CVE-2026-53788 , CVE-2026-53789 , CVE-2026-53790 , CVE-2026-53791 , CVE-2026-53792 , CVE-2026-53793 , CVE-2026-53794 , CVE-2026-53795 , CVE-2026-53796 , CVE-2026-53797 , CVE-2026-53798 , CVE-2026-53799 , CVE-2026-53800 , CVE-2026-53801 , CVE-2026-53802 , CVE-2026-53803 , CVE-2026-70452 , CVE-2026-70453 , CVE-2026-70454 , CVE-2026-70455 , CVE-2026-70456 , CVE-2026-70457 , CVE-2026-70458 , CVE-2026-70459 , CVE-2026-70460 , CVE-2026-70461 , CVE-2026-70462 , CVE-2026-70463 , CVE-2026-70464 Description
Several vulnerabilities were discovered in rsync, a fast, versatile, remote (and local) file-copying tool, which could result in local privilege escalation, bypass of intended access restrictions, information disclosure, denial of service or the execution of arbitrary code. References

• https://bugs.mageia.org/show_bug.cgi?id=36138
• https://www.openwall.com/lists/oss-security/2026/08/13/1
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AHYZL7IBFVF463AGDTJUQBYUJUW7JUAB/
• https://lists.debian.org/debian-security-announce/2026/msg00440.html
• https://www.cve.org/CVERecord?id=CVE-2026-53783
• https://www.cve.org/CVERecord?id=CVE-2026-53784
• https://www.cve.org/CVERecord?id=CVE-2026-53785
• https://www.cve.org/CVERecord?id=CVE-2026-53786
• https://www.cve.org/CVERecord?id=CVE-2026-53788
• https://www.cve.org/CVERecord?id=CVE-2026-53789
• https://www.cve.org/CVERecord?id=CVE-2026-53790
• https://www.cve.org/CVERecord?id=CVE-2026-53791
• https://www.cve.org/CVERecord?id=CVE-2026-53792
• https://www.cve.org/CVERecord?id=CVE-2026-53793
• https://www.cve.org/CVERecord?id=CVE-2026-53794
• https://www.cve.org/CVERecord?id=CVE-2026-53795
• https://www.cve.org/CVERecord?id=CVE-2026-53796
• https://www.cve.org/CVERecord?id=CVE-2026-53797
• https://www.cve.org/CVERecord?id=CVE-2026-53798
• https://www.cve.org/CVERecord?id=CVE-2026-53799
• https://www.cve.org/CVERecord?id=CVE-2026-53800
• https://www.cve.org/CVERecord?id=CVE-2026-53801
• https://www.cve.org/CVERecord?id=CVE-2026-53802
• https://www.cve.org/CVERecord?id=CVE-2026-53803
• https://www.cve.org/CVERecord?id=CVE-2026-70452
• https://www.cve.org/CVERecord?id=CVE-2026-70453
• https://www.cve.org/CVERecord?id=CVE-2026-70454
• https://www.cve.org/CVERecord?id=CVE-2026-70455
• https://www.cve.org/CVERecord?id=CVE-2026-70456
• https://www.cve.org/CVERecord?id=CVE-2026-70457
• https://www.cve.org/CVERecord?id=CVE-2026-70458
• https://www.cve.org/CVERecord?id=CVE-2026-70459
• https://www.cve.org/CVERecord?id=CVE-2026-70460
• https://www.cve.org/CVERecord?id=CVE-2026-70461
• https://www.cve.org/CVERecord?id=CVE-2026-70462
• https://www.cve.org/CVERecord?id=CVE-2026-70463
• https://www.cve.org/CVERecord?id=CVE-2026-70464

SRPMS 10/core

• rsync-3.5.1-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-78030 , CVE-2026-88815 , CVE-2026-88816 Description
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. (CVE-2026-78030) DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. (CVE-2026-88815) DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. (CVE-2026-88816) References

• https://bugs.mageia.org/show_bug.cgi?id=36312
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X2QBTFMS57S7DYK666C4OQBHWDRGW3Q7/
• https://www.openwall.com/lists/oss-security/2026/09/19/4
• https://www.openwall.com/lists/oss-security/2026/09/28/12
• https://www.openwall.com/lists/oss-security/2026/09/28/13
• https://www.cve.org/CVERecord?id=CVE-2026-78030
• https://www.cve.org/CVERecord?id=CVE-2026-88815
• https://www.cve.org/CVERecord?id=CVE-2026-88816

SRPMS 10/core

• perl-DBI-1.655.0-1.mga10

Publication date: 12 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-85498 Description
Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow. (CVE-2026-85498) References

• https://bugs.mageia.org/show_bug.cgi?id=36322
• https://ubuntu.com/security/notices/USN-8762-1
• https://www.cve.org/CVERecord?id=CVE-2026-85498

SRPMS 10/core

• polkit-127-3.1.mga10