Rocky Linux 8 [CIQ] Security Update: python3-urllib3 (crlsa-2021_1631)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20211631 advisory. python-urllib3: CRLF injection via HTTP request method CVE-2020-26137 Tenable has extracted the preceding description block directly from the CIQ security advisory...

AlmaLinux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1776763910)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776763910 advisory. - A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF Carriage Return Line Feed Injection, occurs...

AlmaLinux 9.6 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784073521)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784073521 advisory. - Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14,...

ROS-20261001-73-0050

The vulnerability in rclone is related to the failure to take measures to neutralize crlf sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

AlmaLinux 9.2 [TuxCare] Security Update: varnish / varnish-devel / varnish-docs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1763374645)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1763374645 advisory. - Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 and before 6.0.13 LTS, and Varnish Enterprise 6 before 6.0.12r6, allows credits...

Rocky Linux 9 [CIQ] Security Update: apcu-panel / php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2025_4263)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20254263 advisory. php: Leak partial content of the heap through heap buffer over-read in mysqlnd CVE-2024-8929 php: Single byte overread with convert.quoted-printable-decode...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / numpy-debugsource / etc Multiple Vulnerabilities (crlsa-2021_1879)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20211879 advisory. python: CRLF injection via HTTP request method in httplib/http.client CVE-2020-26116 python-lxml: mXSS due to the use of improper parser CVE-2020-27783...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2026_2470)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20262470 advisory. php: Leak partial content of the heap through heap buffer over-read in mysqlnd CVE-2024-8929 php: Single byte overread with convert.quoted-printable-decode...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / babel / numpy-debugsource / etc Multiple Vulnerabilities (crlsa-2021_1761)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20211761 advisory. python: CRLF injection via HTTP request method in httplib/http.client CVE-2020-26116 python-urllib3: CRLF injection via HTTP request method CVE-2020-26137...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2023_1582)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231582 advisory. glob-parent: Regular Expression Denial of Service CVE-2021-35065 c-ares: buffer overflow in configsortlist due to missing string length check CVE-2022-4904...

CVE-2026-102145 Kiteworks Core Server-Side Request Forgery through CRLF Injection

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...

CVE-2026-102145

An authenticated administrator can exploit a Server-Side Request Forgery (SSRF) vulnerability in Kiteworks Core caused by CRLF Injection . This flaw allows the server to issue requests to and interact with internal network services that are intended to be unreachable through the web interface. Wh...

CVE-2026-102145 Kiteworks Core Server-Side Request Forgery through CRLF Injection

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...

CVE-2026-100254

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings...

CVE-2026-100254

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings...

CVE-2026-100254

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings...

EUVD-2026-89998

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings...

CVE-2026-100254

Authenticated users can execute commands on Windows servers in JetBrains TeamCity versions prior to 2026.2 , 2026.1.4 , and 2025.11.8 . The vulnerability is caused by a CRLF injection within the Pipeline Git connection settings . This flaw allows for remote command execution, resulting in high im...

Security update for python-tornado

This update for python-tornado fixes the following issues: CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. CVE-2024-58384: CRLF injection in CurlAsyncHTTPClien...

SUSE-SU-2026:4404-1 Security update for python-tornado

This update for python-tornado fixes the following issues: - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. - CVE-2024-58384: CRLF injection in...