Rocky Linux 10.2 [CIQ] Security Update: ansible-core / ansible-test (crlsa-2026_57148)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202657148 advisory. ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution CVE-2026-11332 Tenable has extracted the preceding description...

Rocky Linux 10.2 [CIQ] Security Update: wget / wget-debuginfo / wget-debugsource Multiple Vulnerabilities (crlsa-2026_62142)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202662142 advisory. wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471 wget: GNU Wget: Arbitrary code execution or...

Rocky Linux 8 [CIQ] Security Update: libtiff / libtiff-debuginfo / libtiff-debugsource / libtiff-devel / etc (crlsa-2026_69095)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202669095 advisory. libtiff: libtiff: Arbitrary code execution via processcommandopts function CVE-2026-52490 Tenable has extracted the preceding description block directly from the C...

Rocky Linux 10.2 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-data / vim-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_48650)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202648650 advisory. vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious...

Rocky Linux 9 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_47982)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202647982 advisory. vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious docstrings...

Rocky Linux 9 [CIQ] Security Update: galera / galera-debuginfo / galera-debugsource / mariadb / etc Multiple Vulnerabilities (crlsa-2026_33482)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202633482 advisory. mariadb: MariaDB Server: Arbitrary code execution via wsrepnotifycmd CVE-2026-49261 Bug Fixes and Enhancements: Rocky Linux9tracker Rebase Galera to 26.4....

Rocky Linux 9 [CIQ] Security Update: galera / galera-debuginfo / galera-debugsource / mariadb / etc Multiple Vulnerabilities (crlsa-2026_33481)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202633481 advisory. mariadb: MariaDB Server: Arbitrary code execution via wsrepnotifycmd CVE-2026-49261 Bug Fixes and Enhancements: Rocky Linux9 tracker Rebase Galera to...

AlmaLinux 9.2 [TuxCare] Security Update: plexus-utils / plexus-utils-javadoc (ALMALINUX9.2:CLSA-2026:1777038119)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777038119 advisory. - Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus- utils before...

AlmaLinux 9.6 [TuxCare] Security Update: plexus-utils / plexus-utils-javadoc (ALMALINUX9.6:CLSA-2026:1777454474)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777454474 advisory. - Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus- utils before...

Rocky Linux 9.6 [TuxCare] Security Update: plexus-utils / plexus-utils-javadoc (ALMALINUX9.6:CLSA-2026:1777454474)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777454474 advisory. - Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus- utils before...

Rocky Linux 10.2 [CIQ] Security Update: python3.14 / python3.14-debug / python3.14-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_19019)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619019 advisory. cpython: wsgiref.headers.Headers allows header newline injection in Python CVE-2026-0865 cpython: CPython: Logging Bypass in Legacy .pyc File Handling...

AlmaLinux 9.2 [TuxCare] Security Update: git / git-all / git-core / git-core-doc / git-credential-libsecret / etc (ALMALINUX9.2:CLSA-2025:1737155612)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1737155612 advisory. - Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a...

GHSA-239G-WHFQ-7XJ9 GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

Summary Repo.init decides which directory is the git directory by testing candidate paths in an order that considers the real .git last. Two earlier tests can be satisfied by ordinary tracked files. Git reserves only the literal name .git, so HEAD, objects/, refs/, config, gitdir, commondir and...

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

Summary Repo.init decides which directory is the git directory by testing candidate paths in an order that considers the real .git last. Two earlier tests can be satisfied by ordinary tracked files. Git reserves only the literal name .git, so HEAD, objects/, refs/, config, gitdir, commondir and...

rsync: rsync: Heap Out-of-Bounds Write via crafted argument list

A flaw was found in rsync. A remote attacker could exploit an out-of-bounds write vulnerability in the readargs function by sending a specially crafted argument list. This could lead to corruption of adjacent memory, potentially causing a denial of service or, in some cases, arbitrary code...

CVE-2026-51871

Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content...

CVE-2026-102141

Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend root access on a cluster node and a...

CVE-2026-102130

Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the application loaded it. An authenticated administrator could potentially use this to execute arbitrary code on the gateway as the underlying service...

CVE-2026-102119

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system...

CVE-2026-102108

An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account...