83185 matches found
Rocky Linux 9 [CIQ] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc (crlsa-2026_19213)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619213 advisory. systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data CVE-2026-29111 Tenable has extracted the preceding description block...
Rocky Linux 8 [CIQ] Security Update: resource-agents / resource-agents-aliyun / etc Multiple Vulnerabilities (crlsa-2026_1241)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261241 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...
Rocky Linux 8 [CIQ] Security Update: fence-agents-aliyun / fence-agents-aliyun-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_1240)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261240 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...
AlmaLinux 9.6 [TuxCare] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc (ALMALINUX9.6:CLSA-2026:1779217317)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779217317 advisory. - systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with spuriou...
Rocky Linux 9 [CIQ] Security Update: python3.11-urllib3 Multiple Vulnerabilities (crlsa-2026_1089)
The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261089 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...
Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / bea-stax-api / etc Multiple Vulnerabilities (crlba-2019_3416)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlba-20193416 advisory. For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section. This advisory is provided by...
Rocky Linux 8 [CIQ] Security Update: crit / criu / criu-debuginfo / criu-debugsource / libslirp / etc (crlsa-2021_0531)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20210531 advisory. podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API CVE-2020-14370 Tenable has extracted the preceding...
CVE-2026-67106: Exposure of Sensitive Information to an Unauthorized Actor
HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks...
Rocky Linux 8 [CIQ] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc Multiple Vulnerabilities (crlsa-2020_5503)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20205503 advisory. mysql: C API unspecified vulnerability CPU Apr 2020 CVE-2020-2752 mysql: C API unspecified vulnerability CPU Apr 2020 CVE-2020-2922 mariadb-connector-c:...
Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo Multiple Vulnerabilities (crlsa-2021_4226)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214226 advisory. golang: crypto/elliptic: incorrect operations on the P-224 curve CVE-2021-3114 grafana: snapshot feature allow an unauthenticated remote attacker to trigge...
PT-2026-105920
Impact urllib3's streaming API is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When decoding a chunked-transfer-encoded response, this API reads each chunk's size field by buffering until...
PT-2026-105072
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...
PT-2026-105826
Summary A server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect the proxy's outbound request to a host of their choosing by smuggling an api base inside the user config request body, bypassing the existing parameter guard. Details LiteLLM Proxy validates request bodie...
PT-2026-103939
HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...
CVE-2026-67172: Exposure of Sensitive Information to an Unauthorized Actor
HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...
grafana: grafana: Authorization bypass via missing destination folder permission check
A flaw was found in Grafana. The application fails to verify creation permissions on destination folders during panel update operations. An authenticated user with edit permissions in one folder can exploit this vulnerability through the library elements API to move a library panel into a folder...
grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata
A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...
github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API
A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface API to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is...
CVE-2026-47096
AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...