CVE-2026-104002: Detection of Error Condition Without Action

A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda Python might allow actors to read sensitive field values that the application intended to mask. To remediate this issue, users should upgrade to version 3.35.0...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2026_7011)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20267011 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_29981)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202629981 advisory. net/textproto: golang: Golang net/textproto: Misleading error messages via input injection CVE-2026-42507 Bug Fixes and Enhancements: Update Go to version...

CVE-2026-66248: Generation of Error Message Containing Sensitive Information

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...

ROS-20261001-73-0034

The vulnerability in Xen is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-67172: Exposure of Sensitive Information to an Unauthorized Actor

HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...

PT-2026-105846

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

PT-2026-103866

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...

PT-2026-103921

The revoked-key error path builds a human-readable failure reason using sprintf into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf writes the full message, it can write past the end of the heap allocation...

PT-2026-103939

HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...

AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.2:CLSA-2025:1758825546)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1758825546 advisory. - A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an...

Rocky Linux 9.6 [TuxCare] Security Update: libreswan (ALMALINUX9.6:CLSA-2026:1784075638)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784075638 advisory. - An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial...

ROS-20261001-73-0017

The vulnerability in perl-YAML-Syck is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker to cause a service failure...

AlmaLinux 9.2 [TuxCare] Security Update: libreswan (ALMALINUX9.2:CLSA-2026:1784019530)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784019530 advisory. - An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial o...

CentOS Linux 7 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS7:CLSA-2025:1742926277)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1742926277 advisory. - A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a maliciou...

CVE-2026-96561: Improper Neutralization of Input During Web Page Generation

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

ASB-A-514747079

In MapAllImages of imagemanager.cpp, there is a possible persistent denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-515034370

In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

AlmaLinux 9.2 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (ALMALINUX9.2:CLSA-2024:1718787931)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1718787931 advisory. - A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in thepkiverifydatasignature...

ROS-20261001-73-0043

The vulnerability in rclone is related to deficiencies in the error reporting mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...