Skip to content
OpenAdvisories

Source

Rocky Linux Security Advisories

Source: https://errata.rockylinux.org/

All Critical High Medium Low With exploited CVEs

2,966 results · Clear filters · Feed

  • High max 8.2
    RLSA-2026:3094 1 CVE

    Important: protobuf security update

    The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Se…

  • High max 5.6
    RLSA-2026:3067 3 CVEs

    Important: freerdp security update

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP heap-buffer…

  • High max 8.7
    RLSA-2026:3068 5 CVEs

    Important: freerdp security update

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP heap-buffer…

  • High max 7.7
    RLSA-2026:3033 1 CVE

    Important: munge security update

    MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote…

  • High max 7.7
    RLSA-2026:3032 1 CVE

    Important: munge security update

    MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote…

  • High max 8.3
    RLSA-2026:3031 1 CVE

    Important: libpng15 security update

    The libpng15 package provides libpng 1.5, an older version of the libpng. library for manipulating PNG (Portable Network Graphics) image format files. This version should be used only if you are unable to use the current version of libpng. Security Fix(es): *…

  • High max 9.1
    RLSA-2026:2920 5 CVEs

    Important: grafana security update

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * grafana/g…

  • High max 9.1
    RLSA-2026:2914 5 CVEs

    Important: grafana security update

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729) * grafana/g…

  • High max 8.4
    RLSA-2026:2719 1 CVE

    Important: gnupg2 security update

    The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards. Security Fix(es): * GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution (CVE-2…

  • High max 8.2
    RLSA-2026:3095 1 CVE

    Important: protobuf security update

    The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Se…

  • High max 9.1
    RLSA-2026:3040 3 CVEs

    Important: grafana-pcp security update

    The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * crypto/x509: golang: Denial of Servi…

  • High max 7.7
    RLSA-2026:3034 1 CVE

    Important: munge security update

    MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote…

  • High max 7.5
    RLSA-2026:2781 6 CVEs

    Important: nodejs:24 security update

    Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-20…

  • High max 7.8
    RLSA-2026:2707 1 CVE

    Important: gimp security update

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-lev…

  • High max 7.5
    RLSA-2026:2783 6 CVEs

    Important: nodejs:20 security update

    Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-20…

  • High max 7.5
    RLSA-2026:2782 6 CVEs

    Important: nodejs:22 security update

    Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-20…

  • High max 9.1
    RLSA-2026:2709 4 CVEs

    Important: golang security update

    The golang packages provide the Go programming language compiler. Security Fix(es): * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in…

  • High max 9.1
    RLSA-2026:2708 4 CVEs

    Important: go-toolset:rhel8 security update

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory …

  • High max 9.1
    RLSA-2026:2706 4 CVEs

    Important: golang security update

    The golang packages provide the Go programming language compiler. Security Fix(es): * golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * golang: net/url: Memory exhaustion in query parameter parsing in…

  • High max 8.6
    RLSA-2026:2410 1 CVE

    Important: libsoup3 security update

    Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is des…

  • High max 8.6
    RLSA-2026:2216 2 CVEs

    Important: libsoup security update

    The libsoup packages provide an HTTP client and server library for GNOME. Security Fix(es): * libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication (CVE-2026-0719) * libsoup: Stack-Based Buffer Over…

  • High max 7.5
    RLSA-2026:0933 5 CVEs

    Important: java-25-openjdk security update

    The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enha…

  • High max 6.9
    RLSA-2026:2452 1 CVE

    Important: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465) For more details about the security issue(s), including the…

  • High max 8.9
    RLSA-2026:1240 3 CVEs

    Important: fence-agents security update

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: urllib3: Unbounded d…

  • High max 8.8
    RLSA-2026:2230 3 CVEs

    Important: fontforge security update

    FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: FontForge: Rem…

  • High max 7.7
    RLSA-2026:2222 7 CVEs

    Important: freerdp security update

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Heap buffe…

  • High max 8.9
    RLSA-2026:1089 3 CVEs

    Important: python3.11-urllib3 security update

    Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…

  • High max 8.9
    RLSA-2026:1088 3 CVEs

    Important: python3.12-urllib3 security update

    Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…

  • High max 8.9
    RLSA-2026:1087 3 CVEs

    Important: python-urllib3 security update

    Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…

  • High max 8.9
    RLSA-2026:1086 3 CVEs

    Important: python-urllib3 security update

    Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…

  • High max 8.9
    RLSA-2026:1239 3 CVEs

    Important: fence-agents security update

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * urllib3: urllib3: Unbounded d…

  • High max 7.5
    RLSA-2026:2421 6 CVEs

    Important: nodejs:22 security update

    Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-20…

  • High max 8.9
    RLSA-2026:1224 3 CVEs

    Important: python3.11-urllib3 security update

    Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…

  • High max 7.5
    RLSA-2026:2422 6 CVEs

    Important: nodejs:20 security update

    Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-20…

  • High max 7.5
    RLSA-2026:2420 6 CVEs

    Important: nodejs:24 security update

    Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132) * nodejs: Nodejs denial of service (CVE-20…

  • High max 7.5
    RLSA-2026:2323 1 CVE

    Important: git-lfs security update

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * crypto/x509: golang: Denial of Service due to excess…

  • High max 8.6
    RLSA-2026:2215 2 CVEs

    Important: libsoup security update

    The libsoup packages provide an HTTP client and server library for GNOME. Security Fix(es): * libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication (CVE-2026-0719) * libsoup: Stack-Based Buffer Over…

  • High max 8.9
    RLSA-2026:1254 3 CVEs

    Important: python-urllib3 security update

    Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…

  • High max 8.9
    RLSA-2026:1226 3 CVEs

    Important: python3.12-urllib3 security update

    Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…

  • High max 7.5
    RLSA-2026:2389 1 CVE

    Important: brotli security update

    Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available g…