Rocky Linux 9 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_4493)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20254493 advisory. net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion CVE-2025-25186 CGI: Denial of Service in CGI::Cookie.parse CVE-2025-27219 uri: userinfo...

Rocky Linux 10.0 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_8131)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20258131 advisory. net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion CVE-2025-25186 CGI: Denial of Service in CGI::Cookie.parse CVE-2025-27219 uri:...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc Multiple Vulnerabilities (crlsa-2025_23732)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523732 advisory. httpd: Apache HTTP Server: CGI environment variable override CVE-2025-65082 modmd: Apache HTTP Server: modmd ACME, unintended retry intervals CVE-2025-557...

Rocky Linux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1769099972)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1769099972 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_4063)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20254063 advisory. rexml: DoS vulnerability in REXML CVE-2024-39908 rexml: rubygem-rexml: DoS when parsing an XML having many specific characters such as whitespace character...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-debuginfo / ruby-debugsource / ruby-devel / ruby-doc / etc Multiple Vulnerabilities (crlsa-2022_5779)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225779 advisory. ruby: Regular expression denial of service vulnerability of Date parsing methods CVE-2021-41817 ruby: Cookie prefix spoofing in CGI::Cookie.parse...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_1431)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20241431 advisory. ruby/cgi-gem: HTTP response splitting in CGI CVE-2021-33621 ruby: ReDoS vulnerability in URI CVE-2023-28755 ruby: ReDoS vulnerability - upstream's incomple...

Rocky Linux 9 [CIQ] Security Update: ruby / ruby-debuginfo / ruby-debugsource / ruby-default-gems / etc Multiple Vulnerabilities (crlsa-2025_4487)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20254487 advisory. CGI: ReDoS in CGI::UtilescapeElement CVE-2025-27220 CGI: Denial of Service in CGI::Cookie.parse CVE-2025-27219 Tenable has extracted the preceding...

CVE-2026-42356: Deployment of Wrong Handler

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-103436

apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar in src/cgi/upsfetch.c used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf"%s %s %s", answer performs no...

CVE-2026-103436

The apcupsd software, versions through 3.14.14 , contains a vulnerability in the getupsvar() function located in src/cgi/upsfetch.c . This component is utilized by upsstats.cgi , multimon.cgi , and upsfstats.cgi . The root cause is an improper use of sscanf ; when a matched STATUS line contains f...

CVE-2026-103436: Use of Uninitialized Variable

apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar in src/cgi/upsfetch.c used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf"%s %s %s", answer performs no...

CentOS Linux 7 [TuxCare] Security Update: ruby / ruby-devel / ruby-doc / ruby-irb / ruby-libs / etc Multiple Vulnerabilities (CENTOS7:CLSA-2025:1745585192)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1745585192 advisory. - REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits...

CentOS Linux 7 [TuxCare] Security Update: ruby / ruby-devel / ruby-doc / ruby-irb / ruby-libs / ruby-tcltk / etc Multiple Vulnerabilities (CENTOS7:CLSA-2024:1727115733)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2024:1727115733 advisory. - In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1769013944)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1769013944 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables se...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1768213076)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1768213076 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables se...

CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1769014292)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1769014292 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables...

PT-2026-103332

Name of the Vulnerable Software and Affected Versions apcupsd versions prior to 3.14.15 Description A stack-based buffer overflow occurs in the getupsvar function within the src/cgi/upsfetch.c file. This issue is triggered by the sscanf function and affects the upsstats.cgi, multimon.cgi, and...

CVE-2026-102240

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/networktools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has be...

EUVD-2026-88606

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/networktools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has be...