Rocky Linux 9 [CIQ] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc (crlsa-2025_22660)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202522660 advisory. systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump CVE-2025-4598 Tenable has...

Rocky Linux 10.1 [CIQ] Security Update: mariadb / mariadb-backup / mariadb-backup-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_0136)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20260136 advisory. mysql: High Privilege Denial of Service Vulnerability in MySQL Server CVE-2025-21490 mariadb: MariaDB Server Crash Due to Empty Backtrace Log...

Rocky Linux 9 [CIQ] Security Update: mariadb / mariadb-backup / mariadb-backup-debuginfo / etc (crlsa-2026_0137)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260137 advisory. mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation CVE-2025-13699 Tenable has extracted the preceding descripti...

CentOS Linux 8.5 [TuxCare] Security Update: dmidecode (CENTOS8.5:CLSA-2025:1755008582)

The CentOS Linux 8.5 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1755008582 advisory. - Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode v...

CentOS Linux 8 [TuxCare] Security Update: dmidecode (CENTOS-STREAM8:CLSA-2026:1777040413)

The CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1777040413 advisory. - Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmideco...

NPM: undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

NPM: undici vulnerable to response truncation via oversized chunked responses in the dump interceptor vulnerability discovered by ? in WordPress Npm undici versions = 7.1.0, 7.29.1...

EUVD-2026-71517

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor...

CVE-2026-67406

A flaw was found in rabbitmq-server. When the Shovel plugin worker process crashes due to network or connection failures, it fails to sanitize its internal state before logging error reports. As a result, sensitive connection details and unencrypted credentials, including plaintext passwords, are...

CVE-2026-97901

A flaw was found in the Linux kernel's Generic Netlink genetlink component. This flaw allows a local user to cause a Denial of Service DoS through a system crash. The vulnerability occurs because the kernel fails to maintain a reference to the target module during a policy dump that spans multipl...

CLEANSTART-2026-WI13010 undici's dump interceptor reads and discards a response body up to a configurable maximum size

Security vulnerability affects the langfuse package. undici's dump interceptor reads and discards a response body up to a configurable maximum size...

SUSE CVE-2026-67406

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2...

CVE-2026-19708

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and...

CVE-2026-19708

The File Manager WordPress plugin (versions 7.2.2-8.0.4 ) contains a vulnerability where unauthenticated users can download database backup archives. This occurs because the plugin fails to prevent unauthorized access and, in some instances, uses a fixed filename for these backups. On servers tha...

EUVD-2026-87530

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and...

CVE-2026-67406

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2...

DEBIAN-CVE-2026-67406

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2...

CVE-2026-67406 RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2...

CVE-2026-67406

The messaging and streaming broker RabbitMQ is vulnerable in versions prior to 4.3.3, 4.2.9, 4.1.14, and 4.0.23 . The root cause is that Shovel worker genserver processes fail to implement the formatstatus/2 callback. Consequently, when these processes crash—often due to network partitions or con...

CVE-2026-67406

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2...

EUVD-2026-87240

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2...