CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

PT-2026-103803

Name of the Vulnerable Software and Affected Versions Ghost versions 4.0.0 through 6.62.0 Description A flaw in the content API allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts...

CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...

PT-2026-104048

Name of the Vulnerable Software and Affected Versions Ragflow versions prior to 0.24.1 Description Improper access control exists in the update metadata setting function located in the api/apps/kb app.py file. This flaw allows an attacker to perform unauthorized cross-session or privilege-crossin...

CentOS Linux 8.4 [TuxCare] Security Update: systemd / systemd-container / systemd-devel / etc (CENTOS8.4:CLSA-2026:1784813597)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1784813597 advisory. - systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with spuriou...

AlmaLinux 9.6 [TuxCare] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc (ALMALINUX9.6:CLSA-2026:1779217317)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779217317 advisory. - systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with spuriou...

Rocky Linux 8 [CIQ] Security Update: bind9.16 / bind9.16-chroot / bind9.16-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_23360)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202623360 advisory. bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation CVE-2026-3039 bind: BIND: Denial of Service via specially crafted DNS messages...

CentOS Linux 8.5 [TuxCare] Security Update: systemd / systemd-container / systemd-devel / etc (CENTOS8.5:CLSA-2026:1784813658)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1784813658 advisory. - systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with spuriou...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo Multiple Vulnerabilities (crlsa-2021_4226)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214226 advisory. golang: crypto/elliptic: incorrect operations on the P-224 curve CVE-2021-3114 grafana: snapshot feature allow an unauthenticated remote attacker to trigge...

Rocky Linux 10.2 [CIQ] Security Update: bind / bind-chroot / bind-debuginfo / bind-debugsource / bind-devel / etc Multiple Vulnerabilities (crlsa-2026_24338)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202624338 advisory. bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation CVE-2026-3039 bind: BIND: Denial of Service via specially crafted DNS messages...

Rocky Linux 9 [CIQ] Security Update: bind9.18 / bind9.18-chroot / bind9.18-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_24368)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202624368 advisory. bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation CVE-2026-3039 bind: BIND: Denial of Service via specially crafted DNS messages...

PT-2026-105174

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits 3-4M short tag strings. An administrator can...

PT-2026-105126

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An...

PT-2026-103969

🚨 CVE-2026-104059 Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, ...

CVE-2026-51888

The langflow-ai langflow software, specifically versions up to 1.8.4 , is vulnerable to an absolute path traversal vulnerability in the knowledge_bases-create_knowledge_base-a-live-http-post-to-create-knowledge_base endpoint. The root cause is a lack of boundary enforcement in src/backend/base/la...

Rocky Linux 10.1 [CIQ] Security Update: libudisks2 / libudisks2-debuginfo / libudisks2-devel / udisks2 / etc Multiple Vulnerabilities (crlsa-2026_3476)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20263476 advisory. udisks: Missing Authorization Check Allows Unprivileged Users to Back Up LUKS Headers via udisks D-Bus API CVE-2026-26104 udisks: Missing Authorization...

Rocky Linux 9 [CIQ] Security Update: sqlite / sqlite-debuginfo / sqlite-debugsource / sqlite-devel / etc (crlsa-2023_0339)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230339 advisory. sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C API CVE-2022-35737 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2023_7500)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237500 advisory. Mozilla: Out-of-bound memory access in WebGL2 blitFramebuffer CVE-2023-6204 Mozilla: Use-after-free in MessagePort::Entangled CVE-2023-6205 Mozilla:...

Rocky Linux 9.6 [TuxCare] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc (ALMALINUX9.6:CLSA-2026:1779217317)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779217317 advisory. - systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with...

Linux Distros Unpatched Vulnerability : CVE-2026-102999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachment...