CVE-2026-103264: Improper Authentication

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

PT-2026-104068

Name of the Vulnerable Software and Affected Versions Meari IoT Cloud Platform OpenAPI Service affected versions not specified Description An authorization flaw exists in the OpenAPI Service that allows authenticated users to manipulate configurations of devices they do not own. This issue enable...

PT-2026-104070

Name of the Vulnerable Software and Affected Versions Meari IoT Cloud Platform OpenAPI Service affected versions not specified Description An authorization flaw exists in the OpenAPI Service that allows authenticated users to access the complete device shadow of any device. By specifying a device...

PT-2026-105126

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An...

PT-2026-105143

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-55251: Improper Control of Generation of Code

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

PT-2026-103797

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

PT-2026-105916

In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to...

Rocky Linux 9 [CIQ] Security Update: ghostscript / ghostscript-debuginfo / ghostscript-debugsource / etc (crlsa-2024_3999)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243999 advisory. ghostscript: OPVP device arbitrary code execution via custom Driver library CVE-2024-33871 Tenable has extracted the preceding description block directly from the C...

CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2025:1762454401)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2025:1762454401 advisory. - Linux PV device frontends vulnerable to attacks by backends This CNA information record relates to multiple CVEs; the text explains...

Rocky Linux 9 [CIQ] Security Update: ghostscript / ghostscript-debuginfo / ghostscript-debugsource / etc (crlsa-2025_7586)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257586 advisory. Ghostscript: NPDL device: Compression buffer overflow CVE-2025-27832 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Rocky Linux 9 [CIQ] Security Update: device-mapper-multipath / device-mapper-multipath-debuginfo / etc (crlsa-2022_8453)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20228453 advisory. device-mapper-multipath: Regression of CVE-2022-41974 fix in Rocky Linux CVE-2022-3787 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: device-mapper-multipath / device-mapper-multipath-debuginfo / etc (crlsa-2022_7192)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227192 advisory. device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket CVE-2022-41974 Tenable has extracted the...

Rocky Linux 10.2 [CIQ] Security Update: gpsd / gpsd-clients / gpsd-clients-debuginfo / gpsd-debuginfo / etc (crlsa-2026_51075)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202651075 advisory. gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution CVE-2026-58459 Tenable has extracted the preceding description block direct...

AlmaLinux 9.2 [TuxCare] Security Update: keylime / keylime-base / keylime-registrar / keylime-selinux / etc (ALMALINUX9.2:CLSA-2025:1766502382)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1766502382 advisory. - A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted...

Rocky Linux 8.6 [CIQ] Security Update: device-mapper-multipath / device-mapper-multipath-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0031)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260031 advisory. This advisory aggregates security fixes for the device-mapper-multipath SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2022-41973, CVE-2009-0115. Tenable...

Rocky Linux 8 [CIQ] Security Update: hivex / hivex-debuginfo / hivex-debugsource / hivex-devel / etc (crlsa-2021_0711)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20210711 advisory. QEMU: virtiofsd: potential privileged host device access from guest CVE-2020-35517 Tenable has extracted the preceding description block directly from the CIQ...

AlmaLinux 9.2 [TuxCare] Security Update: libinput / libinput-devel / libinput-test / libinput-utils (ALMALINUX9.2:CLSA-2026:1784017931)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784017931 advisory. - In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to...

Rocky Linux 10.0 [CIQ] Security Update: ghostscript / ghostscript-debuginfo / ghostscript-debugsource / etc (crlsa-2025_7593)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257593 advisory. Ghostscript: NPDL device: Compression buffer overflow CVE-2025-27832 Tenable has extracted the preceding description block directly from the CIQ security advisor...

AlmaLinux 9.2 [TuxCare] Security Update: colord / colord-devel / colord-devel-docs / colord-extra-profiles / etc (ALMALINUX9.2:CLSA-2026:1776761965)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776761965 advisory. - There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c...