Red Hat Enterprise Linux 8.6

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force

crypto: algif_aead - Revert to operating out-of-place

Microsoft ASP.NET Core Security Feature Bypass Vulnerability

Xorg: xmayland: value overflow in xkbsetcompatmap()

Xorg: xwayland: use-after-free in xkb client resource removal

A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of the share.

A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS