Security Leftovers

posted by Roy Schestowitz on Nov 13, 2026

• LWN ☛ Security updates for Wednesday

  Security updates have been issued by AlmaLinux (edk2), Debian (openexr, rsyslog, and srt), Fedora (alertmanager, dotnet11.0, gdal, mstflint, nextcloud, python-crate-ingredients, rust-ingredients, rust-pore, rust-pulldown-cmark, rust-rbw, rust-sequoia-sq, rust-siguldry-fedora-autopen, tigervnc, unbound, and zchunk), Gentoo (Brotli, git, and libde265), Mageia (mopidy, python-dulwich, rust-similar3, rclone, and sofia-sip), Oracle (dpdk, edk2, firefox, glibc, kernel, kernel-uek, nodejs-nodemon, nodejs22, nodejs:24, patch, ruby, ruby4.0, squid:4, and thunderbird), Red Hat (.NET 10.0, .NET 11.0, .NET 8.0, .NET 9.0, bind, bind9.16, bind9.18, buildah, c-ares, containernetworking-plugins, delve, flatpak-builder, gcc, gcc-toolset-15-gcc, gcc-toolset-16-gcc, go-fdo-client, go-fdo-server, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, gvfs, gvisor-tap-vsock, nginx, nginx:1.24, nginx:1.26, oci-delta, podman, python-oauthlib, python3, python3.12, python3.9, qt5-qtbase, qt6-qtbase, rhc, runc, skopeo, squid, squid:4, tesseract, util-linux, xdg-dbus-proxy, and yggdrasil), Slackware (xorg-server), SUSE (aliyun-cli, amazon-cloudwatch-agent, ansible-core, aspell, azure-storage-azcopy, bind, cups, dlib-devel, docker, dolphin, dpdk, evolution, firefox, flannel, fuse-overlayfs, gnome-podcasts, google-cloud-sap-agent, GraphicsMagick, graphicsmagick, haproxy, istioctl, kernel, kubevirt, kured, libvips-devel, libXi, mozilla-nss, nvidia-open-driver-G06-signed-check, okteto, openssl-1_1, pcre2, poppler, poppler-qt, poppler-qt5, poppler, poppler-qt5, proftpd, psqlodbc, python-graphql-core, python-M2Crypto, python-pillow, python-soupsieve, python-urllib3_1, python313-wyoming, qt6-coap, rust-keylime, sbc, scribus, SDL2_image, tar, terraform-provider-susepubliccloud, the linux kernel (live patch 18 for suse linux, vsftpd, xen, xorg-x11-server, and zchunk), and Ubuntu (ca-certificates-java, gst-plugins-good1.0, gst-plugins-base1.0, hplip, linux-azure-fde, linux-nvidia, linux-nvidia-7.0, linux-nvidia-bos, linux-nvidia-lowlatency, python-tornado, rust-coreutils, and unbound).

• TechRadar ☛ Running your own Amnezia VPN server? You need to patch this critical Linux flaw now

  Amnezia VPN has warned people who run their own servers through its app that a critical Linux kernel flaw leaves them exposed, and those using the Xray protocol need to rebuild their setups to stay safe.

  The bug, tracked as CVE-2026-98432, sits in the code Linux uses to accept new IPv4 TCP connections and has been present since Linux 4.4. The kernel's security team gave it a severity score of 9.8 out of 10.

• Amnezia warns self-hosted Xray servers need a Linux kernel update

• Qt ☛ Security Advisory CVE-2026-114366: Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework

  An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module has been discovered and has been assigned the CVE id CVE-2026-114366.

• Qt ☛ Security Advisory CVE-2026-116337: Uncontrolled resource consumption vulnerability in HTTP response handling of Qt Network impacts Qt Framework

  Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module has been discovered and has been assigned the CVE id CVE-2026-116337.

• Qt ☛ Security advisory: CVE-2026-8461 Memory corruption vulnerability in the FFmpeg media backend impacts Qt Multimedia

  CVE-2026-8461, a memory corruption vulnerability in the third-party FFmpeg library, has been found to affect Qt Multimedia. The Qt Multimedia versions listed below include a vulnerable version of FFmpeg, which is used by the Qt Multimedia FFmpeg media backend. Users of Qt Multimedia should update.

• Qt ☛ Security advisory: CVE-2026-82292 NULL pointer dereference vulnerability in QDomDocument::setContent() XML parsing impacts Qt

  A NULL pointer dereference vulnerability in the Qt Framework QDomDocument::setContent() XML parsing path of the Qt XML module (qtbase) has been discovered and has been assigned the CVE id CVE-2026-82292.

• Security Week ☛ Threat Actors Exploit Openwave, Cisco BroadWorks Vulnerabilities

  The flaws, CVE-2026-111793 and CVE-2026-20320, let attackers leak sensitive information, including configuration data.

• Security Week ☛ ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure

  Pre-Patch Tuesday advisories were published by VDE CERT, Phoenix Contact, Johnson Controls, and Hitachi Energy. 

• Security Week ☛ Fortinet Patches Nearly 100 Vulnerabilities

  The massive drop comes after the company integrated frontier Hey Hi (AI) models into its product security testing.

• Security Week ☛ Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities

  Attackers could exploit the bugs to tamper with certificate entries, achieve remote code execution, and compromise hosts.

• Security Week ☛ Asus, Zoom Release Security Patches

  Attackers could exploit them for command execution, memory overwrites, and privilege escalation.

• Security Week ☛ Critical Xen Orchestra Flaws Exploited in Attacks

  A critical authentication bypass allows attackers to execute arbitrary code as admin and take over XCP-ng nodes.

• Windows TCO / Windows Bot Nets

  • SANS ☛ Microsoft Patch Tuesday November 2026, (Tue, Nov 10th)

    Microsoft continues its AI-induced patch surge, addressing 1,260 different vulnerabilities this month. 68 of these vulnerabilities are considered critical. 167 of the vulnerabilities are Chromium issues affecting Abusive Monopolist Microsoft Edge.