Rocky Linux 9 [CIQ] Security Update: python3.12-wheel / python3.12-wheel-wheel (crlsa-2026_1939)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20261939 advisory. wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking CVE-2026-24049 Tenable has extracted the preceding description blo...

Rocky Linux 9 [CIQ] Security Update: gegl04 / gegl04-debuginfo / gegl04-debugsource / gegl04-devel / etc (crlsa-2026_38497)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202638497 advisory. gimp: GIMP: Arbitrary code execution via heap-based buffer overflow in HDR file parsing CVE-2026-2050 Tenable has extracted the preceding description block directl...

CentOS Linux 8 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-static / python3-libxml2 (CENTOS-STREAM8:CLSA-2026:1783076182)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1783076182 advisory. - libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell...

Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2023_3923)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20233923 advisory. golang: cmd/go: go command may generate unexpected code at build time when using cgo CVE-2023-29402 golang: cmd/go: go command may execute arbitrary code a...

Rocky Linux 8 [CIQ] Security Update: libevent / libevent-debuginfo / libevent-debugsource / etc Multiple Vulnerabilities (crlsa-2026_67908)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202667908 advisory. libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of...

AlmaLinux 9.6 [TuxCare] Security Update: python3-rrdtool / rrdtool / rrdtool-devel / rrdtool-doc / etc (ALMALINUX9.6:CLSA-2026:1784070663)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784070663 advisory. - A flaw was found in rrdcached, a component of rrdtool. A local attacker with access to a rrdcached socket can exploit a stack-based buffer...

Rocky Linux 8 [CIQ] Security Update: python3.12-wheel / python3.12-wheel-wheel (crlsa-2026_2090)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20262090 advisory. wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking CVE-2026-24049 Tenable has extracted the preceding description blo...

Rocky Linux 10.2 [CIQ] Security Update: perl-IO-Compress (crlsa-2026_30860)

The Rocky Linux 10.2 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202630860 advisory. perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob CVE-2026-48962 Tenable has extracted the preceding description...

Rocky Linux 9.6 [TuxCare] Security Update: libtiff / libtiff-devel / libtiff-static / libtiff-tools (ALMALINUX9.6:CLSA-2026:1778090588)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778090588 advisory. - A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the...

Rocky Linux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1790035964)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790035964 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalat...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc Multiple Vulnerabilities (crlsa-2026_69923)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202669923 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary...

Rocky Linux 8 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_8945)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20268945 advisory. FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data CVE-2026-33984 FreeRDP: FreeRDP: Denial of Service via...

Rocky Linux 9 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_38511)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202638511 advisory. vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vim:...

CentOS Linux 7 [TuxCare] Security Update: freetype / freetype-demos / freetype-devel (CENTOS7:CLSA-2025:1742926404)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1742926404 advisory. - An out of bounds write exists in FreeType versions 2.13.0 and below newer versions of FreeType are not vulnerable when attempting to parse font...

AlmaLinux 9.6 [TuxCare] Security Update: binutils / binutils-devel / binutils-gold / cross-binutils-aarch64 / etc (ALMALINUX9.6:CLSA-2026:1782997495)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782997495 advisory. - A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF Extended Common Object...

Wireshark fragment_reassembly() function Heap Buffer Overflow DoS

The vulnerability of the fragmentreassembly function epan/dissectors/packet-sctp.c in the Wireshark network traffic analyzer is related to the execution of operations outside the buffer. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause service interruption...

lib/resolver-compat.js Code Execution

The vulnerability of the LegacyResolver.customResolve function in the lib/resolver-compat.js file of the NodeVM library’s vm2 module is related to authentication process vulnerabilities. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Rocky Linux 9 [CIQ] Security Update: libyang / libyang-debuginfo / libyang-debugsource / libyang-devel / etc (crlsa-2026_25051)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202625051 advisory. libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob CVE-2026-44673 Tenable has extracted the preceding...

AlmaLinux 9.2 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils (ALMALINUX9.2:CLSA-2025:1746187690)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746187690 advisory. - An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code. CVE-2023-5125...

PT-2026-104043

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.9.4 Description An authenticated attacker can execute arbitrary Python code on the server via a code injection flaw. The issue exists because a public-facing route accepts raw Python source and forwards...