Fedora Security Advisories

FEDORA-2026-597e8f9de1 Packages in this update:

• llvm-22.1.8-4.fc44

Update description:

Backport fixes from LLVM 23

• Fix an issue that could cause a buffer overflow when reading a corrupted bitcode file.
• Fix a miscompilation known to affect rust applications.
• Fix a miscompilation in x86 vectorized code.
• Fix 2 issues in LLD.

FEDORA-2026-7e524e4412 Packages in this update:

• firefox-153.0-1.fc43

Update description:

• Updated to latest upstream (153.0)

FEDORA-2026-bf44fd38de Packages in this update:

• firefox-153.0-1.fc44

Update description:

• Updated to latest upstream (153.0)

FEDORA-2026-0e46c91ccf Packages in this update:

• libssh-0.12.1-1.fc44

Update description:

New upstream security release

FEDORA-2026-ce5dac2ed8 Packages in this update:

• nodejs24-24.18.0-1.fc44

Update description:

Update to version 24.18.0

FEDORA-EPEL-2026-80f5d69973 Packages in this update:

• chromium-150.0.7871.128-1.el10_3

Update description:

Update to 150.0.7871.128

* CVE-2026-15899: Use after free in CameraCapture * CVE-2026-15900: Use after free in GPU * CVE-2026-15901: Use after free in Network * CVE-2026-15902: Use after free in Cast * CVE-2026-15903: Out of bounds read and write in V8 * CVE-2026-15904: Use after free in Ozone * CVE-2026-15905: Use after free in Aura

FEDORA-2026-310f620a68 Packages in this update:

• chromium-150.0.7871.128-1.fc44

Update description:

Update to 150.0.7871.128

* CVE-2026-15899: Use after free in CameraCapture * CVE-2026-15900: Use after free in GPU * CVE-2026-15901: Use after free in Network * CVE-2026-15902: Use after free in Cast * CVE-2026-15903: Out of bounds read and write in V8 * CVE-2026-15904: Use after free in Ozone * CVE-2026-15905: Use after free in Aura

FEDORA-EPEL-2026-a72ac31b48 Packages in this update:

• chromium-150.0.7871.128-1.el9

Update description:

Update to 150.0.7871.128

* CVE-2026-15899: Use after free in CameraCapture * CVE-2026-15900: Use after free in GPU * CVE-2026-15901: Use after free in Network * CVE-2026-15902: Use after free in Cast * CVE-2026-15903: Out of bounds read and write in V8 * CVE-2026-15904: Use after free in Ozone * CVE-2026-15905: Use after free in Aura

FEDORA-EPEL-2026-81064cea8f Packages in this update:

• chromium-150.0.7871.128-1.el10_2

Update description:

Update to 150.0.7871.128

* CVE-2026-15899: Use after free in CameraCapture * CVE-2026-15900: Use after free in GPU * CVE-2026-15901: Use after free in Network * CVE-2026-15902: Use after free in Cast * CVE-2026-15903: Out of bounds read and write in V8 * CVE-2026-15904: Use after free in Ozone * CVE-2026-15905: Use after free in Aura

FEDORA-2026-ac712bf651 Packages in this update:

• chromium-150.0.7871.128-1.fc43

Update description:

Update to 150.0.7871.128

* CVE-2026-15899: Use after free in CameraCapture * CVE-2026-15900: Use after free in GPU * CVE-2026-15901: Use after free in Network * CVE-2026-15902: Use after free in Cast * CVE-2026-15903: Out of bounds read and write in V8 * CVE-2026-15904: Use after free in Ozone * CVE-2026-15905: Use after free in Aura

FEDORA-EPEL-2026-b847a0b309 Packages in this update:

• wordpress-6.9.5-1.el9

Update description: Version 6.9.5

Security updates

• A facilitated SQL injection issue
• A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

FEDORA-EPEL-2026-224c06e2c7 Packages in this update:

• wordpress-6.9.5-1.el10_2

Update description: Version 6.9.5

Security updates

• A facilitated SQL injection issue
• A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

FEDORA-2026-46346e9637 Packages in this update:

• wordpress-6.9.5-1.fc43

Update description: Version 6.9.5

Security updates

• A facilitated SQL injection issue
• A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

FEDORA-2026-2b8250197a Packages in this update:

• wordpress-6.9.5-1.fc44

Update description: Version 6.9.5

Security updates

• A facilitated SQL injection issue
• A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

FEDORA-EPEL-2026-604236f7b8 Packages in this update:

• wordpress-7.0.2-1.el10_3

Update description: Version 7.0.2

Security updates

• A facilitated SQL injection issue
• A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

FEDORA-EPEL-2026-6fe04abf84 Packages in this update:

• ntfs-3g-2022.10.3-10.el9

Update description:

Backport upstream fixes for CVE-2023-52890 and CVE-2026-40706.

FEDORA-EPEL-2026-ede554e3f3 Packages in this update:

• ntfs-3g-2022.10.3-10.el10_2

Update description:

Backport upstream fix for CVE-2026-40706.

FEDORA-2026-336f10ee31 Packages in this update:

• kernel-7.1.4-101.fc43

Update description:

The 7.1.4-101/201 stable kernel update contains a fix for a rather important security issue with net/can.

FEDORA-2026-eb0b86b6f9 Packages in this update:

• kernel-7.1.4-201.fc44

Update description:

The 7.1.4-101/201 stable kernel update contains a fix for a rather important security issue with net/can.

FEDORA-2026-d1cd8e3d25 Packages in this update:

• nginx-1.30.4-1.fc45
• nginx-mod-brotli-1.0.0~rc-13.fc45
• nginx-mod-fancyindex-0.6.0-8.fc45
• nginx-mod-headers-more-0.40-3.fc45
• nginx-mod-js-challenge-0^20230517.gitda6852d-11.fc45
• nginx-mod-modsecurity-1.0.4-16.fc45
• nginx-mod-naxsi-1.6-21.fc45
• nginx-mod-vts-0.2.4-13.fc45

Update description:

nginx-mod-fancyindex:

Rebuild for 1.30.4

nginx-mod-modsecurity:

Rebuild for 1.30.4

nginx-mod-naxsi:

Rebuild for 1.30.4

nginx-mod-headers-more:

Rebuild for 1.30.4

nginx-mod-brotli:

Rebuild for 1.30.4

nginx-mod-js-challenge:

Rebuild for 1.30.4

nginx-mod-vts:

Rebuild for 1.30.4

nginx:

update to 1.30.4 fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434