Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

High max 7.5

ELSA-2026-8474 4 CVEs

Important: .NET 9.0 security update (Oracle Linux 9)

[9.0.116-1.0.1] - Add support for Oracle Linux [9.0.116-1] - Update to .NET SDK 9.0.116 and Runtime 9.0.15 - Resolves: RHEL-163394

Apr 16, 2026
High max 7.5

ELSA-2026-8510 2 CVEs

Important: libarchive security update (Oracle Linux 9)

[3.5.3-9] - Resolves: CVE-2026-4424 - Resolves: CVE-2026-5121 [3.5.3-8] - Release bump

Apr 16, 2026
High max 7.5

ELSA-2026-8492 1 CVE

Important: libarchive security update (Oracle Linux 10)

[3.7.7-8] - Resolves: CVE-2026-4424 [3.7.7-7] - Release bump for typo in dist [3.7.7-6] - Release bump

Apr 16, 2026
High max 7.5

ELSA-2026-8458 2 CVEs

Important: freerdp security update (Oracle Linux 10)

[2:3.10.3-5.6] - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162946, RHEL-162962

Apr 16, 2026
High max 7.5

ELSA-2026-8467 4 CVEs

Important: .NET 10.0 security update (Oracle Linux 10)

[10.0.106-1.0.1] - Add support for Oracle Linux [10.0.106-1] - Update to .NET SDK 10.0.106 and Runtime 10.0.6 - Resolves: RHEL-163385

Apr 16, 2026
High max 7.5

ELSA-2026-8470 4 CVEs

Important: .NET 8.0 security update (Oracle Linux 10)

[8.0.126-1.0.1] - Add support for Oracle Linux [8.0.126-1] - Update to .NET SDK 8.0.126 and Runtime 8.0.26 - Resolves: RHEL-163417

Apr 16, 2026
High max 7.5

ELSA-2026-8472 4 CVEs

Important: .NET 9.0 security update (Oracle Linux 10)

[9.0.116-1.0.1] - Add support for Oracle Linux [9.0.116-1] - Update to .NET SDK 9.0.116 and Runtime 9.0.15 - Resolves: RHEL-163396

Apr 16, 2026
Medium max 8.7

ELSA-2026-8093 1 CVE

Moderate: pcs security update (Oracle Linux 8)

[0.10.18-2.0.1.el8_10.9] - Replaced HAM-logo [0.10.18] - Debrand PCS [0.10.18-2.el8_10.9] - Fixed CVE-2026-31958 by patching bundled Tornado Resolves: RHEL-155293

Apr 15, 2026
High max 7.5

ELSA-2026-8352 1 CVE

Important: bind security update (Oracle Linux 8)

[32:9.11.36-16.7] - Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)

Apr 15, 2026
High max 7.8

ELSA-2026-50234 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.354.4.1] - Revert 'rds: Drop rds conn in connect worker if not in down state.' (Alok Tiwari) [Orabug: 39200399] [5.4.17-2136.354.4] - macvlan: fix possible UAF in macvlan_forward_source() (Eric Dumazet) [Orabug: 38887731] {CVE-2026-23001} - macvl…

Apr 15, 2026
High max 5.6

ELSA-2026-8259 3 CVEs

Important: vim security update (Oracle Linux 9)

[8.2.2637-23.0.1.el9_7.2] - Remove upstream references [Orabug: 31197557] [2:8.2.2637-23.2] - RHEL-155437 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin - RHEL-155422 CVE-2026-28421 vim: Vim: Denial of service a…

Apr 15, 2026
High max 9.8

ELSA-2026-50232 108 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-201.74.2.1] - Revert 'rds: Drop rds conn in connect worker if not in down state.' (Vijayendra Suman) [Orabug: 39200413] - io_uring/kbuf: check if target buffer list is still legacy on recycle (Jens Axboe) [Orabug: 39202438] - ipv6: use RCU in ip6_xmit…

Apr 15, 2026
High max 8.8

ELSA-2026-7677 4 CVEs

Important: fontforge security update (Oracle Linux 8)

[20200314-7] - Resolves: RHEL-138168 CVE-2025-15270 SFD File Parsing Remote Code Execution Vulnerability - Resolves: RHEL-138174 CVE-2025-15279 GUtils BMP File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138190 CVE-2025-15275 SFD File Parsing Heap-bas…

Apr 14, 2026
High max 9.8

ELSA-2026-8052 5 CVEs

Important: firefox security update (Oracle Linux 8)

[140.9.1-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] [140.9.1] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.9.1-1] - Update to 140.9.1 ESR

Apr 14, 2026
High max 7.5

ELSA-2026-8155 1 CVE

Important: bind9.16 security update (Oracle Linux 8)

[32:9.16.23-0.22.5] - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)

Apr 14, 2026
High max 8.7

ELSA-2026-7896 4 CVEs

Important: nodejs:20 security update (Oracle Linux 9)

nodejs [1:20.20.2-1] - Update to version 20.20.2 Patch nghttp2 to version 1.68.1 and disable tests which would fail due to this change. Resolves: RHEL-164336 Fixes: CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-25547 CVE-2026-21710 nodejs-nodemon [3.0…

Apr 14, 2026
High max 7.5

ELSA-2026-7915 1 CVE

Important: bind9.18 security update (Oracle Linux 9)

[32:9.18.29-5.4] - Correct backport issue in the patch (CVE-2026-1519) [32:9.18.29-5.3] - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)

Apr 14, 2026
High max 7.5

ELSA-2026-8075 1 CVE

Important: bind security update (Oracle Linux 9)

[9.16.23-34.0.1.el9_7.2] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-34.2] - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) [32:9.16.23-34.1] - Prevent cache poisoning due to weak…

Apr 14, 2026
Critical max 9.8

ELSA-2026-7383 1 CVE

Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection (Oracle Linux 10)

[344-3.0.1] - Storage: Enable btrfs support [Orabug: 37464632] - Replaced upstream urls in documentation with oracle links [Orabug: 36528753] - Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110] - Remove duplicate reference to server in c…

Apr 14, 2026
High max 7.5

ELSA-2026-7992 1 CVE

Important: golang-github-openprinting-ipp-usb security update (Oracle Linux 10)

[0.9.27-5.1] - rebuilt to fix CVE-2026-25679

Apr 14, 2026
High max 9.2

ELSA-2026-8119 2 CVEs

Important: squid security update (Oracle Linux 10)

[7:6.10-6.3] - Resolves: RHEL-160667 - squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748) [7:6.10-6.2] - Resolves: RHEL-160665 - squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)

Apr 14, 2026
High max 7.5

ELSA-2026-7667 1 CVE

Important: nghttp2 security update (Oracle Linux 8)

[1.33.0-6.2] - fix Denial of service: Assertion failure due to the missing state validation (CVE-2026-27135)

Apr 13, 2026
High max 8.7

ELSA-2026-7670 17 CVEs

Important: nodejs:24 security update (Oracle Linux 8)

nodejs [1:24.14.1-2] - Update bundled nghttp2 to 1.68.1 Related: RHEL-151374 [1:24.14.1-1] - Update to 24.14.0 Resolves: RHEL-151374 nodejs-nodemon [3.0.3-1] - Initial import into nodejs:24 module nodejs-packaging [2021.06-6] - Properly handle @group/package …

Apr 13, 2026
High max 9.8

ELSA-2026-7681 2 CVEs

Important: perl-XML-Parser security update (Oracle Linux 8)

[2.44-12.0.1] - Add perl(LWP), perl(URI), perl(URI::file) Requires [2.44-12] - Fix CVE-2006-10002, CVE-2006-10003

Apr 13, 2026
High max 7.5

ELSA-2026-7668 1 CVE

Important: nghttp2 security update (Oracle Linux 9)

[1.43.0-6.1] - fix Denial of service: Assertion failure due to the missing state validation (CVE-2026-27135)

Apr 13, 2026
High max 9.8

ELSA-2026-7671 5 CVEs

Important: firefox security update (Oracle Linux 9)

[140.9.1-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.9.1] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Ab…

Apr 13, 2026
High max 9.8

ELSA-2026-7679 2 CVEs

Important: perl-XML-Parser security update (Oracle Linux 9)

[2.46-9.1.0.1] - Add perl(LWP), perl(URI), perl(URI::file) Requires [2.46-9.1] - Fix CVE-2006-10002, CVE-2006-10003

Apr 13, 2026
High max 8.4

ELSA-2026-7682 1 CVE

Important: openexr security update (Oracle Linux 10)

[3.1.10-8.1] - fix CVE-2026-27622

Apr 13, 2026
High max 9.8

ELSA-2026-7672 5 CVEs

Important: firefox security update (Oracle Linux 10)

[140.9.1-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.9.1-1] - Update to 140.9.1 ESR

Apr 13, 2026
High max 9.8

ELSA-2026-7680 2 CVEs

Important: perl-XML-Parser security update (Oracle Linux 10)

[2.47-6.1.0.1] - Add perl(LWP) Requires [2.47-6.1] - Fix CVE-2006-10002, CVE-2006-10003

Apr 13, 2026
High max 5.6

ELSA-2026-7711 3 CVEs

Important: vim security update (Oracle Linux 10)

[9.1.083-6.0.1.el10_1.3] - Remove upstream references [Orabug: 31197557] [2:9.1.083-6.3] - RHEL-159615 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function [2:9.1.083-6.2] - RHEL-155409 CVE-2026-28421 vim: Vim: Denial of …

Apr 13, 2026
High max 7.5

ELSA-2026-7666 1 CVE

Important: nghttp2 security update (Oracle Linux 10)

[1.64.0-2.1] - fix Denial of service: Assertion failure due to the missing state validation (CVE-2026-27135)

Apr 12, 2026
High max 8.2

ELSA-2026-7343 4 CVEs

Important: nginx:1.26 security update (Oracle Linux 9)

[2:1.26.3-2.0.1.1] - Require oracle-indexhtml [2:1.26.3-6] - Resolves: RHEL-157887 - CVE-2026-32647 nginx:1.26/nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files [2:1.26.3-5] - Resolves: RHEL-159446 - CVE-2026-27651 nginx:1.26/n…

Apr 11, 2026
High max 9.2

ELSA-2026-7302 9 CVEs

Important: nodejs:22 security update (Oracle Linux 9)

nodejs [1:22.22.2-1] - Update to version 22.22.2 - introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135 - disabled failing tests in nghttp2 due to newer version - patch for npm/braces CVE-2026-25547 Resolves: RHEL-163369 Fixes: CVE-2026-1528 …

Apr 10, 2026
High max 9.2

ELSA-2026-7350 18 CVEs

Important: nodejs:24 security update (Oracle Linux 9)

nodejs [1:24.14.1-2] - Update bundled nghttp2 to 1.68.1 [1:24.14.1-1] - Update to version 24.14.1 nodejs-nodemon [3.0.3-3] - Keep BR on just npm [3.0.3-2] - Fix BR for nodejs-npm nodejs-packaging [2021.06-6] - Properly handle @group/package deps in nodejs-sym…

Apr 10, 2026
Critical max 9.8

ELSA-2026-7384 1 CVE

Critical: cockpit: Unauthenticated remote code execution due to SSH command-line argument injection (Oracle Linux 9)

[344-2.0.1] - Storage: Enable btrfs support [Orabug: 37464632] - Replaced upstream urls in documentation with oracle links [Orabug: 36528753] - Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110] - Remove duplicate reference to server in c…

Apr 10, 2026
High max 7.5

ELSA-2026-7342 1 CVE

Important: kea security update (Oracle Linux 10)

[3.0.1-3] - Fixes CVE-2026-3608

Apr 10, 2026
High max 7.5

ELSA-2026-7011 1 CVE

Important: grafana security update (Oracle Linux 8)

[9.2.10-29.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-29] - Resolves RHEL-156639: CVE-2026-25679

Apr 9, 2026
High max 9.2

ELSA-2026-7123 9 CVEs

Important: nodejs:22 security update (Oracle Linux 8)

nodejs [1:22.22.2-1] - Update to version 22.22.2 Resolves: RHEL-154019 Fixes: CVE-2026-1528 CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-27135 CVE-2026-1528 nodejs-nodemon [3.0.1-1] - Exclude ix86 arches from building. Related: RHEL-35991 [3.0.1-1] -…

Apr 9, 2026
High max 7.5

ELSA-2026-7259 1 CVE

Important: git-lfs security update (Oracle Linux 9)

[3.6.1-8] - Rebuild with new Golang - Resolves: RHEL-158724

Apr 9, 2026