Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2020_1624)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20201624 advisory. php: Invalid memory access in function xmlrpcdecode CVE-2019-9020 php: File rename across filesystems may allow unwanted access during processing...

CVE-2026-86610: Improper Neutralization of Input During Web Page Generation

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

PT-2026-105143

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-71426: Improper Limitation of a Pathname to a Restricted Directory

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is...

CentOS Linux 6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2025:1756483990)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2025:1756483990 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

CentOS Linux 7 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc (CENTOS7:CLSA-2024:1733246329)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1733246329 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900...

AlmaLinux 9.2 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (ALMALINUX9.2:CLSA-2026:1778240943)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778240943 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

AlmaLinux 9.2 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1753981912)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753981912 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

Rocky Linux 9 [CIQ] Security Update: php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2025_7431)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257431 advisory. php: Header parser of http stream wrapper does not handle folded headers CVE-2025-1217 php: Stream HTTP wrapper header check might omit basic auth header...

PT-2026-103988

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

PT-2026-105133

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

PT-2026-105113

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

PT-2026-105150

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

PT-2026-105120

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

Rocky Linux 8.6 [CIQ] Security Update: php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (ciqsa-2026_0138)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260138 advisory. This advisory aggregates security fixes for the php SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2020-36193, CVE-2020-28949. Tenable has extracted the...

Rocky Linux 8.6 [CIQ] Security Update: apcu-panel / php-pecl-apcu / php-pecl-apcu-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0003)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260003 advisory. This advisory aggregates security fixes for the php-pecl-apcu SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2020-28949, CVE-2020-36193. Tenable has...

Rocky Linux 8.6 [CIQ] Security Update: php-pear Multiple Vulnerabilities (ciqsa-2026_0139)

The Rocky Linux 8.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260139 advisory. This advisory aggregates security fixes for the php-pear SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2020-28949, CVE-2020-36193. Tenable has extracted...

Rocky Linux 8.6 [CIQ] Security Update: php-pecl-rrd / php-pecl-rrd-debuginfo / php-pecl-rrd-debugsource Multiple Vulnerabilities (ciqsa-2026_0140)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260140 advisory. This advisory aggregates security fixes for the php-pecl-rrd SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2020-28949, CVE-2020-36193. Tenable has...

Rocky Linux 8.6 [CIQ] Security Update: php-pecl-xdebug / php-pecl-xdebug-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0141)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260141 advisory. This advisory aggregates security fixes for the php-pecl-xdebug SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2020-28949, CVE-2020-36193. Tenable has...

Rocky Linux 8.6 [CIQ] Security Update: php-pecl-zip / php-pecl-zip-debuginfo / php-pecl-zip-debugsource Multiple Vulnerabilities (ciqsa-2026_0142)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260142 advisory. This advisory aggregates security fixes for the php-pecl-zip SRPM in CIQ LTS 8.6. It addresses 2 CVEs: CVE-2020-28949, CVE-2020-36193. Tenable has...