Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses langchain-text-splitters 0.3.9, flask 3.1.0, coreutils 8.32-39.el9 and libxml2 2.9.13-14.el98.1 which are vulnerable to PSIRT-GHSA-fv5p-p927-qmxr, CVE-2025-47278, CVE-2026-27205, CVE-2025-5278 and CVE-2025-6170. This bulletin contains information regarding the...

CVE-2026-82603

A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=delpl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public a...

CVE-2026-82603 SeaCMS Comment Cache member.php del_pl path traversal

A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=delpl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public a...

CVE-2026-82603 SeaCMS Comment Cache member.php del_pl path traversal

A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=delpl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public a...

EUVD-2026-68312

A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=delpl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public a...

CVE-2026-82603

A path traversal vulnerability in SeaCMS up to 13.6 affects the Comment Cache component via the /member.php?action=del_pl endpoint. Manipulation of the itype/vid argument allows a remote, low-privileged attacker to traverse paths, resulting in low integrity and availability impact (consistent wit...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.15 Extra. Visit this page to learn more about...

PT-2026-83674

A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=del pl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

CVE-2026-82603: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=delpl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public a...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration CVE-2026-74580 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.4 Extra. Visit this page to learn more about...

Important: freerdp

Issue Overview: FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2026-129 (ALASKERNEL-5.4-2026-129)

The version of kernel installed on the remote host is prior to 5.4.302-226.486. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2026-129 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring...

Fedora 43 : bind (2026-875d2a5154)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-875d2a5154 advisory. Fixes multiple CVEs - Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 - Key Record using PRIVATEDNS algorithm may lead to exit...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2026-114)

The version of kernel installed on the remote host is prior to 5.15.215-152.252. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2026-114 advisory. In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust again...

Amazon Linux 2 : kernel, --advisory ALAS2-2026-3881 (ALAS-2026-3881)

The version of kernel installed on the remote host is prior to 4.14.355-284.742. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3881 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring...

Fedora 44 : bind (2026-d87e7f498a)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d87e7f498a advisory. Fixes multiple CVEs - Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 - Key Record using PRIVATEDNS algorithm may lead to exit...

SUSE SLES12 Security Update : kernel (Live Patch 84 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:3808-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3808-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.317 fixes various security issues: The following security issues were fixed: -...

Updated golang packages fix security vulnerabilities

CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary...

MiracleLinux 9 : unbound-1.24.2-3.el9_8.4 (AXSA:2026-1692:11)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1692:11 advisory. unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes CVE-2026-44690 unbound: Unbound: Denial of...