CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1791459292)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791459292 advisory. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP...

EulerOS 2.0 SP15 : mod_http2 (EulerOS-SA-2026-3926)

According to the versions of the modhttp2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

Important: bind9.16 security, bug fix, and enhancement update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

Important: mod_auth_openidc security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsi...

Zabbix Server 7.0.x < 7.0.29 / 7.4.x < 7.4.13 Authentication Bypass (ZBX-28196)

The version of Zabbix Server installed on the remote host is 7.0.x prior to 7.0.29, or 7.4.x prior to 7.4.13. It is, therefore, affected by an authentication bypass vulnerability: - Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate...

ALSA-2026:79113 Important: bind9.16 security, bug fix, and enhancement update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

UBUNTU-CVE-2026-106574

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server...

[slackware-security] xorg-server

New xorg-server packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/xorg-server-1.20.14-i586-22slack15.0.txz: Rebuilt. This update fixes security issues: XKB SetGeometry TextDoodad Double Free...

Security Bulletin: Vault PKI ACME Issues Certificate With Unvalidated SANs

Summary Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabli...

CVE-2026-105818

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

CVE-2026-105818 Vault PKI ACME Issues Certificate With Unvalidated SANs

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

CVE-2026-105818 Vault PKI ACME Issues Certificate With Unvalidated SANs

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

Vault PKI ACME Default Directory Policy May Issue Certificates With Unverified Identities

Summary Vault’s PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabli...

CVE-2026-76286

In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface API tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it t...

GHSA-G2V6-RQMX-R4W6 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips, commercial-gitlab-rails-ee, nextcloud-server, langfuse, langfuse-fips...

GHSA-PQG4-J6R4-53MV vulnerabilities

Vulnerabilities for packages: code-server, renovate...

CVE-2026-102422 vulnerabilities

Vulnerabilities for packages: code-server, renovate...

GHSA-VC2V-76PW-4V95 vulnerabilities

Vulnerabilities for packages: thingsboard, code-server, vitess, serve, jupyter-base-notebook...

CVE-2026-87776 vulnerabilities

Vulnerabilities for packages: thingsboard, code-server, vitess, serve, jupyter-base-notebook...

EUVD-2026-94587

In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface API tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it t...