Rocky Linux 10.2 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-data / vim-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_48650)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202648650 advisory. vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1780946485)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780946485 advisory. - SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time...

Rocky Linux 10.1 [CIQ] Security Update: gnupg2 / gnupg2-debuginfo / gnupg2-debugsource / gnupg2-smime / etc (crlsa-2026_2719)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20262719 advisory. GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution CVE-2026-24882 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: python3.12-wheel / python3.12-wheel-wheel (crlsa-2026_2090)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20262090 advisory. wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking CVE-2026-24049 Tenable has extracted the preceding description blo...

Rocky Linux 10.2 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc Multiple Vulnerabilities (crlsa-2026_37072)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202637072 advisory. golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-39835 golang.org/x/crypto/ssh:...

Rocky Linux 8 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2022_7704)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227704 advisory. webkitgtk: Use-after-free leading to arbitrary code execution CVE-2022-22624 webkitgtk: Use-after-free leading to arbitrary code execution CVE-2022-22628...

PT-2026-104383

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.97 Description A use after free issue exists in MediaStream, which allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Us...

PT-2026-105594

Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability in github.com/projectdiscovery/nuclei...

Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc (crlsa-2026_19372)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619372 advisory. nginx: NGINX: Arbitrary Code Execution Vulnerability CVE-2026-42945 Tenable has extracted the preceding description block directly from the CIQ security advisory...

AlmaLinux 9.2 [TuxCare] Security Update: mpg123 / mpg123-devel / mpg123-libs / mpg123-plugins-pulseaudio (ALMALINUX9.2:CLSA-2026:1779694248)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779694248 advisory. - An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a...

Debian dsa-6535 : chromium - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6535 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6535-1 [email protected] https://www.debian.org/securit...

Rocky Linux 10.2 [CIQ] Security Update: libyang / libyang-debuginfo / libyang-debugsource / libyang-devel / etc (crlsa-2026_24758)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202624758 advisory. libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob CVE-2026-44673 Tenable has extracted the preceding...

Rocky Linux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.6:CLSA-2026:1787333229)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787333229 advisory. - A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs whe...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_54530)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654530 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...

CVE-2026-63292: Stack-based Buffer Overflow

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

PostgresConnector.connect() Code Execution

The vulnerability of the PostgresConnector.connect function on the MCP-server, when used to interact with DBHub databases, is related to the use of an incomplete black list. Exploiting this vulnerability could allow an attacker to gain unauthorized read and write access, or execute arbitrary code...

PT-2026-103917

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Description A command injection flaw exists in the foreman-rake errors:fetch log task. The request id parameter is passed to an underlying system command, typically grep, without adequate shell...

CVE-2026-12540: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...

Rocky Linux 9 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2026_69098)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202669098 advisory. chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page CVE-2026-19154 chromium-browser: skia: Skia: Sandbox escape via out-of-bound...