PT-2026-110791

🚨 CVE-2026-85959 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse. 🎖@cveNotify...

Rocky Linux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791471297)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791471297 advisory. - NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache...

TencentOS Server 3: postgresql:15 (TSSA-2026:1112)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1112 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 3: freerdp (TSSA-2026:1131)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1131 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 3: nodejs:22 (TSSA-2026:1141)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1141 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 3: gzip (TSSA-2026:1117)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1117 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Rocky Linux 9.6 [TuxCare] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc (ALMALINUX9.6:CLSA-2026:1791796759)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791796759 advisory. - MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated...

TencentOS Server 3: glib2 (TSSA-2026:1126)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1126 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

TencentOS Server 3: qt5-qtbase (TSSA-2026:1125)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1125 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2026-85968: Out-of-bounds Read

Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited information from process memory...

Important: httpd

Issue Overview: Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This...

PT-2026-110809

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions 11.x through 11.3.6 Progress MarkLogic Server versions 12.x through 12.0.x Description Certain password-based authentication configurations fail to sufficiently verify the identity of a Kerberos authenticatio...

CVE-2026-85969: Out-of-bounds Write

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of...

CVE-2026-85972: Incorrect Implementation of Authentication Algorithm

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication...

CVE-2026-9191: Origin Validation Error

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path...

CVE-2026-85955: Improper Privilege Management

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated...

Important: libX11

Issue Overview: A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the keysymmap. CVE-2026-88806 Affected Packages: libX11 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

PT-2026-110726

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...

PT-2026-110423

Name of the Vulnerable Software and Affected Versions Blinko versions prior to 1.8.9 Description An issue exists where the plugin.installPlugin tRPC procedure, accessible to any authenticated user, fails to sanitize the plugin name used to build the installation path in server/routerTrpc/plugin.t...

CVE-2026-85971: Incorrect Permission Assignment for Critical Resource

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply to newly created and rotated logs;...