PT-2026-105578

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API in github.com/kubeedge/kubeedge...

PT-2026-103902

Name of the Vulnerable Software and Affected Versions Fortra BoKS Manager affected versions not specified Description An authenticated user with permissions to add CRL URLs can trigger shell command substitution. This occurs when using the BCC, the WSI REST or SOAP API, or the cacrl command-line...

PT-2026-103741

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.15 Description Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access and above to perform Stored Cross-Site Scripting. Attackers can inject arbitrar...

CVE-2026-51895

Ragflow versions 0.24.0 and prior are affected by an improper access control vulnerability within the update_metadata_setting function located in api/apps/kb_app.py. This flaw allows an attacker to perform unauthorized cross-session or privilege-crossing operations, depending on the specific expo...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo Multiple Vulnerabilities (crlsa-2021_4226)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214226 advisory. golang: crypto/elliptic: incorrect operations on the P-224 curve CVE-2021-3114 grafana: snapshot feature allow an unauthenticated remote attacker to trigge...

Rocky Linux 9 [CIQ] Security Update: bind9.18 / bind9.18-chroot / bind9.18-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_24368)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202624368 advisory. bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation CVE-2026-3039 bind: BIND: Denial of Service via specially crafted DNS messages...

Rocky Linux 10.2 [CIQ] Security Update: bind / bind-chroot / bind-debuginfo / bind-debugsource / bind-devel / etc Multiple Vulnerabilities (crlsa-2026_24338)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202624338 advisory. bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation CVE-2026-3039 bind: BIND: Denial of Service via specially crafted DNS messages...

Rocky Linux 9 [CIQ] Security Update: python3-urllib3 Multiple Vulnerabilities (crlsa-2026_1087)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261087 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...

CentOS Linux 7 [TuxCare] Security Update: python3-pip Multiple Vulnerabilities (CENTOS7:CLSA-2026:1775723090)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1775723090 advisory. - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly...

Rocky Linux 9 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc Multiple Vulnerabilities (crlsa-2026_1239)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261239 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...

CentOS Linux 8.5 [TuxCare] Security Update: systemd / systemd-container / systemd-devel / etc (CENTOS8.5:CLSA-2026:1784813658)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1784813658 advisory. - systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with spuriou...

PT-2026-105482

Summary /api/storage/getOutlineStorage is registered with CheckAuth only and performs no authorization of any kind. Given a document identifier it returns that document's stored outline state, regardless of the document's publish tier. The two write endpoints for the same data, setOutlineStorage...

PT-2026-104043

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.9.4 Description An authenticated attacker can execute arbitrary Python code on the server via a code injection flaw. The issue exists because a public-facing route accepts raw Python source and forwards...

Rocky Linux 8 [CIQ] Security Update: bind9.16 / bind9.16-chroot / bind9.16-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_23360)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202623360 advisory. bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation CVE-2026-3039 bind: BIND: Denial of Service via specially crafted DNS messages...

PT-2026-105154

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is authorized/2 uses is authorized monitor for all methods. DELETE resets rabbit core metrics:reset auth attempt metrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbit mgmt w...

CVE-2026-82825: Missing Authentication for Critical Function

Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. Thi...

CVE-2026-103281: Insertion of Sensitive Information Into Sent Data

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

CVE-2026-12405: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

PT-2026-103938

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks...

PT-2026-105072

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...