CLSA-2026-1790854765 TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 10.7.0-tuxcare.1...

CVE-2026-103280

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it...

CVE-2026-103280 Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it...

CVE-2026-103280

The Ghost content management system, versions 0.8.0 before 6.23.0 , is susceptible to an information disclosure vulnerability. The setup endpoint fails to perform proper authentication and responds to unauthenticated requests by revealing the site owner's email address . This allows any remote vi...

BIT-PHP-MIN-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

BIT-PHP-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

BIT-LIBPHP-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

CLEANSTART-2023-KF11060 invalid memory address dereference was discovered in the hf_assembly function of libfaad/sbr_hfadj

Security vulnerability affects the faad2 package. An invalid memory address dereference was discovered in the hfassembly function of libfaad/sbrhfadj...

CLEANSTART-2023-YY56914 invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbr_dec

Security vulnerability affects the faad2 package. An invalid memory address dereference was discovered in the sbrDecodeSingleFramePS function of libfaad/sbrdec...

CLEANSTART-2023-LS66031 invalid memory address dereference was discovered in the lt_prediction function of libfaad/lt_predict

Security vulnerability affects the faad2 package. An invalid memory address dereference was discovered in the ltprediction function of libfaad/ltpredict...

CLEANSTART-2023-VH05257 invalid memory address dereference was discovered in the sbr_process_channel function of libfaad/sbr_dec

Security vulnerability affects the faad2 package. An invalid memory address dereference was discovered in the sbrprocesschannel function of libfaad/sbrdec...

CLEANSTART-2023-XG43309 invalid memory address dereference was discovered in the huffcode function (libfaac/huff2

Security vulnerability affects the faac package. An invalid memory address dereference was discovered in the huffcode function libfaac/huff2...

CLEANSTART-2026-MQ17226 certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain

Security vulnerability affects the cri-tools package. A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain...

Malicious code in @bluewin/utils (npm)

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...

CLEANSTART-2026-QF93365 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

CVE-2026-42499 affects multiple packages. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. See references for individual vulnerability details...

CLEANSTART-2026-ID88447 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

Security vulnerability affects the kube-state-metrics-fips package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...

CLEANSTART-2026-KJ60632 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Security vulnerability affects the kube-state-metrics-fips package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595...

AlmaLinux 9.2 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (ALMALINUX9.2:CLSA-2025:1753374470)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753374470 advisory. - Having a large number of address headers From, To, Cc, Bcc, etc. becomes excessively CPU intensive. With 100k header lines CPU usage is...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2022_6164)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226164 advisory. Mozilla: Address bar spoofing via XSLT error handling CVE-2022-38472 Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions...

Rocky Linux 8 [CIQ] Security Update: compat-openssl10 / compat-openssl10-debuginfo / etc (crlsa-2025_7895)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257895 advisory. openssl: X.400 address type confusion in X.509 GeneralName CVE-2023-0286 Tenable has extracted the preceding description block directly from the CIQ security...