Mageia Security

Publication date: 13 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-6735 , CVE-2026-7259 , CVE-2025-14179 , CVE-2026-6722 , CVE-2026-7261 , CVE-2026-7262 , CVE-2026-7568 , CVE-2026-7258 Description FPM: Fixed GHSA-7qg2-v9fj-4mwv (XSS within status endpoint). (CVE-2026-6735) MBString: Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (CVE-2026-7259) OpenSSL: Fix compatibility issues with OpenSSL 4.0. PDO_Firebird: Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in quoted strings). (CVE-2025-14179) SOAP: - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (CVE-2026-6722) - Fixed GHSA-m33r-qmcv-p97q (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (CVE-2026-7261) - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check). (CVE-2026-7262) Standard: - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568) - Fixed GHSA-m8rr-4c36-8gq4 (Consistently pass unsigned char to ctype.h functions). (CVE-2026-7258) References

• https://bugs.mageia.org/show_bug.cgi?id=35481
• https://www.php.net/ChangeLog-8.php#8.2.31
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6735
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7259
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14179
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6722
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7261
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7262
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7568
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7258

SRPMS 9/core

• php-8.2.31-1.mga9

Publication date: 10 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-35058 , CVE-2026-40215 Description CVE-2026-35058 - fix server ASSERT() on receiving a suitably malformed packet with a valid tls-crypt-v2 key CVE-2026-40215 - fix race condition in TLS handshake that could lead to leaking of packet data from a previous handshake under specific circumstances References

• https://bugs.mageia.org/show_bug.cgi?id=35442
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFR4RR6F447AZK2ZTKVGZP3NKKWFW6DW/
• https://community.openvpn.net/Security%20Announcements/CVE-2026-35058
• https://community.openvpn.net/Security%20Announcements/CVE-2026-40215
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35058
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40215

SRPMS 9/core

• openvpn-2.6.20-1.1.mga9

Publication date: 09 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-6746 , CVE-2026-6747 , CVE-2026-6748 , CVE-2026-6749 , CVE-2026-6750 , CVE-2026-6751 , CVE-2026-6752 , CVE-2026-6753 , CVE-2026-6754 , CVE-2026-6757 , CVE-2026-6759 , CVE-2026-6761 , CVE-2026-6762 , CVE-2026-6763 , CVE-2026-6764 , CVE-2026-6765 , CVE-2026-6769 Description Use-after-free in the DOM: Core & HTML component. (CVE-2026-6746) Use-after-free in the WebRTC component. (CVE-2026-6747) Uninitialized memory in the Audio/Video: Web Codecs component. (CVE-2026-6748) Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. (CVE-2026-6749) Privilege escalation in the Graphics: WebRender component. (CVE-2026-6750) Uninitialized memory in the Audio/Video: Web Codecs component. (CVE-2026-6751) Incorrect boundary conditions in the WebRTC component. (CVE-2026-6752) Incorrect boundary conditions in the WebRTC component. (CVE-2026-6753) Use-after-free in the JavaScript Engine component. (CVE-2026-6754) Invalid pointer in the JavaScript: WebAssembly component. (CVE-2026-6757) Use-after-free in the Widget: Cocoa component. (CVE-2026-6759) Privilege escalation in the Networking component. (CVE-2026-6761) Spoofing issue in the DOM: Core & HTML component. (CVE-2026-6762) Mitigation bypass in the File Handling component. (CVE-2026-6763) Incorrect boundary conditions in the DOM: Device Interfaces component. (CVE-2026-6764) Information disclosure in the Form Autofill component. (CVE-2026-6765) Privilege escalation in the Debugger component. (CVE-2026-6769) Other issue in the Storage: IndexedDB component. (CVE-2026-6770) Mitigation bypass in the DOM: Security component. (CVE-2026-6771) Incorrect boundary conditions in the WebRTC: Networking component. (CVE-2026-6776) Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150. (CVE-2026-6785) Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150. (CVE-2026-6786) Information disclosure due to incorrect boundary conditions in the Audio/Video component. (CVE-2026-7320) Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. (CVE-2026-7321) Memory safety bugs fixed in Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1. (CVE-2026-7322) Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1. (CVE-2026-7323) References

• https://bugs.mageia.org/show_bug.cgi?id=35404
• https://www.thunderbird.net/en-US/thunderbird/140.10.0esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-34/
• https://www.thunderbird.net/en-US/thunderbird/140.10.1esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-39/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6746
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6747
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6748
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6749
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6750
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6751
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6752
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6753
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6754
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6757
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6759
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6761
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6762
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6763
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6764
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6765
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6769

SRPMS 9/core

• thunderbird-140.10.1-1.mga9
• thunderbird-l10n-140.10.1-1.mga9

Publication date: 09 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-6746 , CVE-2026-6747 , CVE-2026-6748 , CVE-2026-6749 , CVE-2026-6750 , CVE-2026-6751 , CVE-2026-6752 , CVE-2026-6753 , CVE-2026-6754 , CVE-2026-6757 , CVE-2026-6759 , CVE-2026-6761 , CVE-2026-6762 , CVE-2026-6763 , CVE-2026-6764 , CVE-2026-6765 , CVE-2026-6766 Description Use-after-free in the DOM: Core & HTML component. (CVE-2026-6746) Use-after-free in the WebRTC component. (CVE-2026-6747) Uninitialized memory in the Audio/Video: Web Codecs component. (CVE-2026-6748) Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. (CVE-2026-6749) Privilege escalation in the Graphics: WebRender component. (CVE-2026-6750) Uninitialized memory in the Audio/Video: Web Codecs component. (CVE-2026-6751) Incorrect boundary conditions in the WebRTC component. (CVE-2026-6752) Incorrect boundary conditions in the WebRTC component. (CVE-2026-6753) Use-after-free in the JavaScript Engine component. (CVE-2026-6754) Invalid pointer in the JavaScript: WebAssembly component. (CVE-2026-6757) Use-after-free in the Widget: Cocoa component. (CVE-2026-6759) Privilege escalation in the Networking component. (CVE-2026-6761) Spoofing issue in the DOM: Core & HTML component. (CVE-2026-6762) Mitigation bypass in the File Handling component. (CVE-2026-6763) Incorrect boundary conditions in the DOM: Device Interfaces component. (CVE-2026-6764) Information disclosure in the Form Autofill component. (CVE-2026-6765) Incorrect boundary conditions in the Libraries component in NSS. (CVE-2026-6766) Other issue in the Libraries component in NSS. (CVE-2026-6767) Privilege escalation in the Debugger component. (CVE-2026-6769) Other issue in the Storage: IndexedDB component. (CVE-2026-6770) Mitigation bypass in the DOM: Security component. (CVE-2026-6771) Incorrect boundary conditions in the Libraries component in NSS. (CVE-2026-6772) Incorrect boundary conditions in the WebRTC: Networking component. (CVE-2026-6776) Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150. (CVE-2026-6785) Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150. (CVE-2026-6786) Information disclosure due to incorrect boundary conditions in the Audio/Video component. (CVE-2026-7320) Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. (CVE-2026-7321) Memory safety bugs fixed in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. (CVE-2026-7322) Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1. (CVE-2026-7323) References

• https://bugs.mageia.org/show_bug.cgi?id=35403
• https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_123.html
• https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_123_1.html
• https://www.firefox.com/en-US/firefox/140.10.0/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-32/
• https://www.firefox.com/en-US/firefox/140.10.1/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-36/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6746
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6747
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6748
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6749
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6750
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6751
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6752
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6753
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6754
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6757
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6759
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6761
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6762
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6763
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6764
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6765
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6766

SRPMS 9/core

• rootcerts-20260412.00-1.mga9
• nss-3.123.1-1.mga9
• firefox-140.10.1-1.mga9
• firefox-l10n-140.10.1-1.mga9

Publication date: 09 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-39881 , CVE-2026-41411 , CVE-2026-42307 Description Ex command injection in Vims NetBeans integration. (CVE-2026-39881) Command injection via backtick expansion in tag filenames in Vim < v9.2.0357. (CVE-2026-41411) OS Command Injection in netrw affects Vim < 9.2.0383. (CVE-2026-42307) OS Command Injection via 'path' completion affects Vim < 9.2.0435. References

• https://bugs.mageia.org/show_bug.cgi?id=35332
• https://www.openwall.com/lists/oss-security/2026/04/07/13
• https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6
• https://www.openwall.com/lists/oss-security/2026/04/15/7
• https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8
• https://www.openwall.com/lists/oss-security/2026/04/22/8
• https://github.com/vim/vim/security/advisories/GHSA-85ch-p2qr-m5gx
• https://www.openwall.com/lists/oss-security/2026/05/03/11
• https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-wvvg
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39881
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41411
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42307

SRPMS 9/core

• vim-9.2.437-1.mga9

Publication date: 07 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-32746 Description telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full. (CVE-2026-32746) References

• https://bugs.mageia.org/show_bug.cgi?id=35468
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/X5ABJVGBTZGH3FCDZEF3XQAMMJVC5AWA/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32746

SRPMS 9/core

• krb5-appl-1.0.3-16.1.mga9

Publication date: 07 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-6842 , CVE-2026-6843 Description Local attacker can inject malicious .desktop launcher due to insecure directory permissions. (CVE-2026-6842) Format string vulnerability leads to denial of service. (CVE-2026-6843) References

• https://bugs.mageia.org/show_bug.cgi?id=35466
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLLMINU5CKQDNMS5OT7OKS5V6YQFIJUC/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6842
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6843

SRPMS 9/core

• nano-7.2-1.2.mga9

Publication date: 07 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-40561 Description Starlet versions through 0.31 for Perl allow HTTP Request Smuggling via Improper Header Precedence. (CVE-2026-40561) References

• https://bugs.mageia.org/show_bug.cgi?id=35464
• https://www.openwall.com/lists/oss-security/2026/05/03/1
• https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40561

SRPMS 9/core

• perl-Starlet-0.310.0-4.1.mga9

Publication date: 07 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-40560 Description Starman versions before 0.4018 for Perl allow HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy. References

• https://bugs.mageia.org/show_bug.cgi?id=35448
• https://www.openwall.com/lists/oss-security/2026/04/29/1
• https://metacpan.org/release/MIYAGAWA/Starman-0.4018/changes
• https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40560

SRPMS 9/core

• perl-Starman-0.401.800-1.mga9

Publication date: 07 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-40706 Description In NTFS-3G 2022.10.3 before 2026.2.25, a heap buffer overflow exists in ntfs_build_permissions_posix() in acls.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered on the READ path (stat, readdir, open) when processing a security descriptor with multiple ACCESS_DENIED ACEs containing WRITE_OWNER from distinct group SIDs. (CVE-2026-40706) References

• https://bugs.mageia.org/show_bug.cgi?id=35412
• https://www.openwall.com/lists/oss-security/2026/04/21/4
• https://lists.debian.org/debian-security-announce/2026/msg00131.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40706

SRPMS 9/core

• ntfs-3g-2022.10.3-1.2.mga9

Publication date: 07 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-26284 , CVE-2026-33535 Description ImageMagick has a heap overflow in the pcd decoder that leads to an out of bounds read. (CVE-2026-26284) ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction. (CVE-2026-33535) References

• https://bugs.mageia.org/show_bug.cgi?id=35408
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/BMSWBU7XGK6MZYTE62GVV7BFJIH6PSZU/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/NPVKK6XVDNZQVOOYGCEQVGQHUWYX64EY/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26284
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33535

SRPMS 9/core

• graphicsmagick-1.3.40-1.5.mga9

9/tainted

• graphicsmagick-1.3.40-1.5.mga9.tainted

Publication date: 07 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-41082 Description In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. (CVE-2026-41082) References

• https://bugs.mageia.org/show_bug.cgi?id=35405
• https://lists.debian.org/debian-security-announce/2026/msg00126.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41082

SRPMS 9/core

• opam-2.1.3-1.1.mga9

Publication date: 07 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-40198 , CVE-2026-40199 Description Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass. (CVE-2026-40198) Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass. (CVE-2026-40199) References

• https://bugs.mageia.org/show_bug.cgi?id=35348
• https://www.openwall.com/lists/oss-security/2026/04/11/1
• https://www.openwall.com/lists/oss-security/2026/04/11/2
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SKKSURTDDZIA5TCZ3QL5KFVFSKVVMRSQ/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40198
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40199

SRPMS 9/core

• perl-Net-CIDR-Lite-0.230.0-1.mga9

Publication date: 07 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-4775 Description Arbitrary code execution or denial of service via signed integer overflow in tiff file processing. (CVE-2026-4775) References

• https://bugs.mageia.org/show_bug.cgi?id=35340
• https://lwn.net/Articles/1066930/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4775

SRPMS 9/core

• libtiff-4.5.1-1.8.mga9

Publication date: 07 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-25061 Description tcpflow has TIM Element OOB Write in wifipcap. (CVE-2026-25061) References

• https://bugs.mageia.org/show_bug.cgi?id=35327
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWJ2HTXROZUA6IP467KMWZFIYTXEGVZK/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25061

SRPMS 9/core

• tcpflow-1.6.1-3.1.mga9

Publication date: 07 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-32775 , CVE-2026-40385 , CVE-2026-40386 Description CVE-2026-32775: libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow. CVE-2026-40385: In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be used by local attackers to cause crashes or information leaks. This only affects 32bit systems. CVE-2026-40386: In libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote decoding could be used by attackers to crash or leak information out of libexif-using programs. References

• https://bugs.mageia.org/show_bug.cgi?id=35368
• http://www.slackware.com/security/viewer.php?l=slackware-security&y=2026&m=slackware-security.368011
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32775
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40385
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40386

SRPMS 9/core

• libexif-0.6.26-1.mga9

Publication date: 07 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-27654 , CVE-2026-27784 , CVE-2026-32647 , CVE-2026-27651 , CVE-2026-28753 , CVE-2026-28755 Description Buffer overflow in ngx_http_dav_module (CVE-2026-27654) Buffer overflow in the ngx_http_mp4_module (CVE-2026-27784) Buffer overflow in the ngx_http_mp4_module (CVE-2026-32647) NULL pointer dereference while using CRAM-MD5 or APOP (CVE-2026-27651) Injection in auth_http and XCLIENT (CVE-2026-28753) OCSP result bypass in stream (CVE-2026-28755) References

• https://bugs.mageia.org/show_bug.cgi?id=35280
• https://www.openwall.com/lists/oss-security/2026/03/26/3
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27654
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27784
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32647
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27651
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28753
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28755

SRPMS 9/core

• nginx-1.29.7-1.mga9

Publication date: 07 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-23414 , CVE-2026-31408 , CVE-2026-31414 , CVE-2026-31415 , CVE-2026-31416 , CVE-2026-31417 , CVE-2026-31418 , CVE-2026-31421 , CVE-2026-31422 , CVE-2026-31423 , CVE-2026-31424 , CVE-2026-31425 , CVE-2026-31426 , CVE-2026-31427 , CVE-2026-31428 , CVE-2026-31430 , CVE-2026-31431 , CVE-2026-31433 , CVE-2026-31434 , CVE-2026-31439 , CVE-2026-31441 , CVE-2026-31444 , CVE-2026-31446 , CVE-2026-31447 , CVE-2026-31448 , CVE-2026-31450 , CVE-2026-31451 , CVE-2026-31452 , CVE-2026-31453 , CVE-2026-31454 , CVE-2026-31455 , CVE-2026-31458 , CVE-2026-31464 , CVE-2026-31466 , CVE-2026-31467 , CVE-2026-31469 , CVE-2026-31473 , CVE-2026-31474 , CVE-2026-31476 , CVE-2026-31477 , CVE-2026-31478 , CVE-2026-31480 , CVE-2026-31482 , CVE-2026-31483 , CVE-2026-31485 , CVE-2026-31492 , CVE-2026-31494 , CVE-2026-31495 , CVE-2026-31496 , CVE-2026-31497 , CVE-2026-31498 , CVE-2026-31500 , CVE-2026-31503 , CVE-2026-31504 , CVE-2026-31507 , CVE-2026-31508 , CVE-2026-31509 , CVE-2026-31510 , CVE-2026-31512 , CVE-2026-31515 , CVE-2026-31518 , CVE-2026-31519 , CVE-2026-31520 , CVE-2026-31521 , CVE-2026-31522 , CVE-2026-31523 , CVE-2026-31524 , CVE-2026-31525 , CVE-2026-31528 , CVE-2026-31533 , CVE-2026-31555 , CVE-2026-31563 , CVE-2026-31565 , CVE-2026-31566 , CVE-2026-31570 , CVE-2026-31628 , CVE-2026-31634 , CVE-2026-31637 , CVE-2026-31638 , CVE-2026-31639 , CVE-2026-31642 , CVE-2026-31646 , CVE-2026-31648 , CVE-2026-31649 , CVE-2026-31651 , CVE-2026-31655 , CVE-2026-31656 , CVE-2026-31657 , CVE-2026-31658 , CVE-2026-31659 , CVE-2026-31660 , CVE-2026-31661 , CVE-2026-31662 , CVE-2026-31664 , CVE-2026-31665 , CVE-2026-31667 , CVE-2026-31668 , CVE-2026-31669 , CVE-2026-31670 , CVE-2026-31671 , CVE-2026-31672 , CVE-2026-31674 , CVE-2026-31675 , CVE-2026-31678 , CVE-2026-31679 , CVE-2026-31680 , CVE-2026-31682 , CVE-2026-31686 , CVE-2026-31689 , CVE-2026-31694 , CVE-2026-31695 , CVE-2026-31696 , CVE-2026-31697 , CVE-2026-31698 , CVE-2026-31699 , CVE-2026-31700 , CVE-2026-31701 , CVE-2026-31702 , CVE-2026-31704 , CVE-2026-31705 , CVE-2026-31708 , CVE-2026-31711 , CVE-2026-31714 , CVE-2026-31716 , CVE-2026-31720 , CVE-2026-31721 , CVE-2026-31726 , CVE-2026-31728 , CVE-2026-31730 , CVE-2026-31737 , CVE-2026-31738 , CVE-2026-31740 , CVE-2026-31741 , CVE-2026-31747 , CVE-2026-31748 , CVE-2026-31749 , CVE-2026-31751 , CVE-2026-31752 , CVE-2026-31754 , CVE-2026-31755 , CVE-2026-31756 , CVE-2026-31758 , CVE-2026-31759 , CVE-2026-31761 , CVE-2026-31762 , CVE-2026-31763 , CVE-2026-31768 , CVE-2026-31770 , CVE-2026-31773 , CVE-2026-31776 , CVE-2026-31778 , CVE-2026-31779 , CVE-2026-31780 , CVE-2026-31781 , CVE-2026-31786 , CVE-2026-31787 , CVE-2026-43007 , CVE-2026-43011 , CVE-2026-43013 , CVE-2026-43014 , CVE-2026-43015 , CVE-2026-43016 , CVE-2026-43017 , CVE-2026-43018 , CVE-2026-43020 , CVE-2026-43023 , CVE-2026-43024 , CVE-2026-43025 , CVE-2026-43026 , CVE-2026-43027 , CVE-2026-43028 , CVE-2026-43030 , CVE-2026-43032 , CVE-2026-43033 , CVE-2026-43035 , CVE-2026-43037 , CVE-2026-43038 , CVE-2026-43040 , CVE-2026-43041 , CVE-2026-43043 , CVE-2026-43044 , CVE-2026-43046 , CVE-2026-43047 , CVE-2026-43050 , CVE-2026-43051 , CVE-2026-43054 , CVE-2026-43056 , CVE-2026-43057 , CVE-2026-43058 Description Vanilla upstream kernel version 6.6.137 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links. References

• https://bugs.mageia.org/show_bug.cgi?id=35460
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.131
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.132
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.133
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.134
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.135
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.136
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.137
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23414
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31408
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31414
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31415
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31416
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31417
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31418
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31421
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31422
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31423
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31424
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31425
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31426
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31427
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31428
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31430
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31431
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31433
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31434
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31439
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31441
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31444
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31446
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31447
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31448
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31450
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31451
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31452
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31453
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31454
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31455
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31458
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31464
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31466
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31467
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31469
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31473
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31474
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31476
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31477
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31478
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31480
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31482
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31483
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31485
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31492
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31494
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31495
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31496
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31497
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31498
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31500
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31503
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31504
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31507
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31509
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31510
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31512
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31515
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31518
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31519
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31520
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31521
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31522
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31523
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31524
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31525
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31528
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31533
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31555
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31563
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31565
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31570
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31628
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31634
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31637
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31638
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31639
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31642
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31646
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31648
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31649
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31651
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31655
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31657
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31658
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31659
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31660
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31661
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31662
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31664
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31665
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31667
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31668
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31670
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31671
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31672
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31674
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31675
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31679
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31680
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31682
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31686
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31689
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31694
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31695
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31696
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31697
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31698
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31699
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31700
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31701
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31702
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31704
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31705
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31708
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31711
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31714
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31716
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31720
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31721
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31726
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31728
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31730
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31737
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31738
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31740
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31741
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31747
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31748
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31749
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31751
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31752
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31754
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31755
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31756
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31758
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31759
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31761
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31762
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31763
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31768
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31770
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31773
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31776
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31778
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31779
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31780
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31781
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31786
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43007
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43011
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43013
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43014
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43015
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43016
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43017
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43018
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43020
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43023
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43024
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43025
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43026
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43027
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43028
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43030
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43032
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43033
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43035
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43038
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43040
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43041
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43043
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43044
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43046
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43047
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43050
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43051
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43054
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43057
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43058

SRPMS 9/core

• kernel-linus-6.6.137-1.mga9

Publication date: 06 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-35230 , CVE-2026-35242 , CVE-2026-35245 , CVE-2026-35246 , CVE-2026-35247 , CVE-2026-35248 , CVE-2026-35249 , CVE-2026-35250 , CVE-2026-35251 Description Some security vulnerabilities are fixed by this update; please see the links. If you will not update to kernel 6.6.137 flavors, please think in use dkms-virtualbox package instead of virtualbox-kernel as those packages have not been updated for previous kernels. References

• https://bugs.mageia.org/show_bug.cgi?id=35425
• https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixOVIR
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35230
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35242
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35245
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35246
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35247
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35248
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35249
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35250
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35251

SRPMS 9/core

• virtualbox-7.1.18-1.mga9

Publication date: 04 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-23414 , CVE-2026-31408 , CVE-2026-31414 , CVE-2026-31415 , CVE-2026-31416 , CVE-2026-31417 , CVE-2026-31418 , CVE-2026-31421 , CVE-2026-31422 , CVE-2026-31423 , CVE-2026-31424 , CVE-2026-31425 , CVE-2026-31426 , CVE-2026-31427 , CVE-2026-31428 , CVE-2026-31430 , CVE-2026-31431 , CVE-2026-31433 , CVE-2026-31434 , CVE-2026-31439 , CVE-2026-31441 , CVE-2026-31444 , CVE-2026-31446 , CVE-2026-31447 , CVE-2026-31448 , CVE-2026-31450 , CVE-2026-31451 , CVE-2026-31452 , CVE-2026-31453 , CVE-2026-31454 , CVE-2026-31455 , CVE-2026-31458 , CVE-2026-31464 , CVE-2026-31466 , CVE-2026-31467 , CVE-2026-31469 , CVE-2026-31473 , CVE-2026-31474 , CVE-2026-31476 , CVE-2026-31477 , CVE-2026-31478 , CVE-2026-31480 , CVE-2026-31482 , CVE-2026-31483 , CVE-2026-31485 , CVE-2026-31492 , CVE-2026-31494 , CVE-2026-31495 , CVE-2026-31496 , CVE-2026-31497 , CVE-2026-31498 , CVE-2026-31500 , CVE-2026-31503 , CVE-2026-31504 , CVE-2026-31507 , CVE-2026-31508 , CVE-2026-31509 , CVE-2026-31510 , CVE-2026-31512 , CVE-2026-31515 , CVE-2026-31518 , CVE-2026-31519 , CVE-2026-31520 , CVE-2026-31521 , CVE-2026-31522 , CVE-2026-31523 , CVE-2026-31524 , CVE-2026-31525 , CVE-2026-31528 , CVE-2026-31533 , CVE-2026-31555 , CVE-2026-31563 , CVE-2026-31565 , CVE-2026-31566 , CVE-2026-31570 , CVE-2026-31628 , CVE-2026-31634 , CVE-2026-31637 , CVE-2026-31638 , CVE-2026-31639 , CVE-2026-31642 , CVE-2026-31646 , CVE-2026-31648 , CVE-2026-31649 , CVE-2026-31651 , CVE-2026-31655 , CVE-2026-31656 , CVE-2026-31657 , CVE-2026-31658 , CVE-2026-31659 , CVE-2026-31660 , CVE-2026-31661 , CVE-2026-31662 , CVE-2026-31664 , CVE-2026-31665 , CVE-2026-31667 , CVE-2026-31668 , CVE-2026-31669 , CVE-2026-31670 , CVE-2026-31671 , CVE-2026-31672 , CVE-2026-31674 , CVE-2026-31675 , CVE-2026-31678 , CVE-2026-31679 , CVE-2026-31680 , CVE-2026-31682 , CVE-2026-31686 , CVE-2026-31689 , CVE-2026-31694 , CVE-2026-31695 , CVE-2026-31696 , CVE-2026-31697 , CVE-2026-31698 , CVE-2026-31699 , CVE-2026-31700 , CVE-2026-31701 , CVE-2026-31702 , CVE-2026-31704 , CVE-2026-31705 , CVE-2026-31708 , CVE-2026-31711 , CVE-2026-31714 , CVE-2026-31716 , CVE-2026-31720 , CVE-2026-31721 , CVE-2026-31726 , CVE-2026-31728 , CVE-2026-31730 , CVE-2026-31737 , CVE-2026-31738 , CVE-2026-31740 , CVE-2026-31741 , CVE-2026-31747 , CVE-2026-31748 , CVE-2026-31749 , CVE-2026-31751 , CVE-2026-31752 , CVE-2026-31754 , CVE-2026-31755 , CVE-2026-31756 , CVE-2026-31758 , CVE-2026-31759 , CVE-2026-31761 , CVE-2026-31762 , CVE-2026-31763 , CVE-2026-31768 , CVE-2026-31770 , CVE-2026-31773 , CVE-2026-31776 , CVE-2026-31778 , CVE-2026-31779 , CVE-2026-31780 , CVE-2026-31781 , CVE-2026-31786 , CVE-2026-31787 , CVE-2026-43007 , CVE-2026-43011 , CVE-2026-43013 , CVE-2026-43014 , CVE-2026-43015 , CVE-2026-43016 , CVE-2026-43017 , CVE-2026-43018 , CVE-2026-43020 , CVE-2026-43023 , CVE-2026-43024 , CVE-2026-43025 , CVE-2026-43026 , CVE-2026-43027 , CVE-2026-43028 , CVE-2026-43030 , CVE-2026-43032 , CVE-2026-43033 , CVE-2026-43035 , CVE-2026-43037 , CVE-2026-43038 , CVE-2026-43040 , CVE-2026-43041 , CVE-2026-43043 , CVE-2026-43044 , CVE-2026-43046 , CVE-2026-43047 , CVE-2026-43050 , CVE-2026-43051 , CVE-2026-43054 , CVE-2026-43056 , CVE-2026-43057 , CVE-2026-43058 Description Upstream kernel version 6.6.137 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel. References

• https://bugs.mageia.org/show_bug.cgi?id=35459
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.131
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.132
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.133
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.134
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.135
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.136
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.137
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23414
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31408
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31414
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31415
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31416
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31417
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31418
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31421
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31422
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31423
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31424
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31425
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31426
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31427
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31428
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31430
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31431
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31433
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31434
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31439
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31441
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31444
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31446
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31447
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31448
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31450
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31451
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31452
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31453
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31454
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31455
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31458
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31464
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31466
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31467
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31469
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31473
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31474
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31476
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31477
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31478
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31480
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31482
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31483
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31485
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31492
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31494
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31495
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31496
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31497
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31498
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31500
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31503
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31504
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31507
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31508
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31509
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31510
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31512
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31515
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31518
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31519
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31520
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31521
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31522
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31523
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31524
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31525
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31528
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31533
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31555
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31563
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31565
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31566
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31570
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31628
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31634
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31637
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31638
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31639
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31642
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31646
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31648
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31649
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31651
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31655
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31656
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31657
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31658
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31659
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31660
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31661
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31662
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31664
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31665
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31667
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31668
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31669
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31670
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31671
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31672
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31674
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31675
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31678
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31679
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31680
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31682
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31686
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31689
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31694
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31695
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31696
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31697
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31698
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31699
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31700
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31701
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31702
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31704
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31705
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31708
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31711
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31714
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31716
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31720
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31721
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31726
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31728
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31730
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31737
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31738
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31740
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31741
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31747
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31748
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31749
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31751
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31752
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31754
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31755
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31756
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31758
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31759
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31761
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31762
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31763
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31768
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31770
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31773
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31776
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31778
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31779
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31780
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31781
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31786
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31787
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43007
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43011
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43013
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43014
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43015
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43016
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43017
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43018
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43020
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43023
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43024
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43025
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43026
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43027
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43028
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43030
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43032
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43033
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43035
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43037
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43038
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43040
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43041
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43043
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43044
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43046
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43047
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43050
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43051
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43054
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43056
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43057
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43058

SRPMS 9/core

• kernel-6.6.137-1.mga9
• kmod-virtualbox-7.1.18-18.mga9
• kmod-xtables-addons-3.24-90.mga9