Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2025_3893)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20253893 advisory. kernel: xen: Xen hypercall page unsafe against speculative attacks Xen Security Advisory 466 CVE-2024-53241 kernel: ALSA: usb-audio: Fix out of bounds read...

Linux Distros Unpatched Vulnerability : CVE-2026-100805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. CVE-2026-100805 Note that Nessus...

Rocky Linux 10.0 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_17776)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202517776 advisory. kernel: HID: core: Harden s32ton against conversion to 0 bits CVE-2025-38556 kernel: wifi: ath12k: Decrement TID on RX peer frag setup error handling...

Rocky Linux 8 [CIQ] Security Update: exempi / exempi-debuginfo / exempi-debugsource / exempi-devel Multiple Vulnerabilities (crlsa-2024_3066)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243066 advisory. exempi: denial of service via opening of crafted audio file with ID3V2 frame CVE-2020-18651 exempi: denial of service via opening of crafted webp file...

Rocky Linux 8 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_54485)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654485 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message...

CentOS Linux 7 [TuxCare] Security Update: bluez / bluez-cups / bluez-hid2hci / bluez-libs / bluez-libs-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1777541445)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1777541445 advisory. - A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially...

Rocky Linux 10.2 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2026_21380)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202621380 advisory. firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component CVE-2026-8388 firefox: Other issue in the JavaScript Engine component...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_17760)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202517760 advisory. kernel: HID: core: Harden s32ton against conversion to 0 bits CVE-2025-38556 kernel: eventpoll: Fix semi-unbounded recursion CVE-2025-38614 kernel: ALSA:...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2026_20586)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202620586 advisory. firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 CVE-2026-7323 firefox: thunderbird: Information disclosure due ...

FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files

A flaw was found in FFmpeg. A remote attacker could exploit an out-of-bounds memory access vulnerability in the ADX audio decoder by supplying a specially crafted ADX or AAX audio file. This could lead to the attacker triggering both out-of-bounds reads and writes, potentially resulting in...

USN-8855-1: GStreamer Bad Plugins vulnerability

It was discovered that GStreamer Bad Plugins incorrectly validated the size of multi-channel audio blocks. An attacker could possibly use this issue with a specially crafted WAV file to cause the program to crash, resulting in a denial of service, or possibly execute arbitrary code...

USN-8855-1 gst-plugins-bad1.0 vulnerability

It was discovered that GStreamer Bad Plugins incorrectly validated the size of multi-channel audio blocks. An attacker could possibly use this issue with a specially crafted WAV file to cause the program to crash, resulting in a denial of service, or possibly execute arbitrary code...

firefox: Use-after-free in the Audio/Video component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video component...

firefox: Use-after-free in the Audio/Video component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video component...

firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video: Web Codecs component...

CVE-2026-85415

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

EUVD-2026-89632

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

WordPress Audio Player Block plugin 1.1.0-1.6.2 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin Audio Player Block – audio player gutenberg block plugin versions 1.1.0-1.6.2...

CVE-2026-85415 Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

CVE-2026-85415

The Audio Player Block WordPress plugin, in versions prior to 1.6.3 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to validate the scheme of a user-supplied URL before using it as a link target. This allows users with the Contributor role or higher to store mal...