PT-2026-103896

Name of the Vulnerable Software and Affected Versions Next.js versions 16.3.0 through 16.3.7 Description When Cache Components are enabled via cacheComponents: true, use cache handlers using next/root-params may leak return values to pages with different root parameters. This occurs when a use...

CVE-2026-103004: Use of Cache Containing Sensitive Information

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

CVE-2026-104056: Undefined Security Weakness

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-3.1 / aspnetcore-targeting-pack-3.1 / etc (crlsa-2022_6912)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20226912 advisory. dotnet: Nuget cache poisoning on Linux via world-writable cache directory CVE-2022-41032 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: python3-unbound / python3-unbound-debuginfo / unbound / etc (crlsa-2026_69120)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202669120 advisory. unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 Tenable has extracted the preceding description block directly from the CIQ...

Spring Security 6.5.x < 6.5.12 / 7.0.x < 7.0.6.1 / 7.1.x < 7.1.0.1 DPoP Proof Replay

The version of Spring Security installed on the remote host is 6.5.x prior to 6.5.12, 7.0.x prior to 7.0.6.1, or 7.1.x prior to 7.1.0.1. It is, therefore, affected by a vulnerability: - Spring Security's DPoPProofJwtDecoderFactory uses an internal cache to store the processed jti JWT ID claims,...

Linux Distros Unpatched Vulnerability : CVE-2026-32148

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient Verification of Data Authenticity vulnerability in hexpm hex Hex.RemoteConverger module allows dependency integrity bypass via unverified lockfile...

CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1774438942)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1774438942 advisory. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a client-side heap buffer overflow occurs in the...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc (crxsa-2026_50978)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crxsa-202650978 advisory. kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation CVE-2025-54518 Bug Fixes and Enhancements: Kernel crash in...

AlmaLinux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785490706)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785490706 advisory. - DISPUTE NOTE: this issue does not pose a security risk as it according to analysis by the original software developer, NLnet Labs...

Rocky Linux 8 [CIQ] Security Update: microcode_ctl Multiple Vulnerabilities (crlsa-2021_3027)

The Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20213027 advisory. hw: Special Register Buffer Data Sampling SRBDS CVE-2020-0543 hw: Vector Register Data Sampling CVE-2020-0548 hw: L1D Cache Eviction Sampling CVE-2020-0549...

CentOS Linux 8 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs (CENTOS-STREAM8:CLSA-2026:1780319730)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1780319730 advisory. - NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks that cou...

Rocky Linux 9 [CIQ] Security Update: python3-unbound / python3-unbound-debuginfo / unbound / etc (crlsa-2025_11849)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202511849 advisory. unbound: Unbound Cache poisoning CVE-2025-5994 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus has...

Rocky Linux 8 [CIQ] Security Update: libecap / libecap-debuginfo / libecap-debugsource / libecap-devel / etc (crlsa-2025_19107)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202519107 advisory. squid-cache: Squid vulnerable to information disclosure via authentication credential leakage in error handling CVE-2025-62168 Tenable has extracted the preceding...

Rocky Linux 9.6 [TuxCare] Security Update: squid Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784801979)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784801979 advisory. - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP...

Rocky Linux 9 [CIQ] Security Update: python3-unbound / python3-unbound-debuginfo / unbound / etc (crlsa-2026_68292)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202668292 advisory. unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-50252 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: squid / squid-debuginfo / squid-debugsource Multiple Vulnerabilities (crlsa-2024_4861)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20244861 advisory. squid: vulnerable to a Denial of Service attack against Cache Manager error responses CVE-2024-23638 squid: Out-of-bounds write error may lead to Denial of...

AlmaLinux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc (ALMALINUX9.6:CLSA-2026:1768555539)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1768555539 advisory. - A flaw in libsoup's HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side...

AlmaLinux 9.6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790328589)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790328589 advisory. - On a resolver configured to use dns64, if an applicable answer from the authoritative server is malformed in a specific way, the...

CentOS Linux 6 [TuxCare] Security Update: squid Multiple Vulnerabilities (CENTOS6:CLSA-2026:1777446517)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1777446517 advisory. - An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains ...