CentOS Linux 6 [TuxCare] Security Update: rpm / rpm-apidocs / rpm-build / rpm-cron / rpm-devel / rpm-libs / etc (CENTOS6:CLSA-2026:1793110602)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793110602 advisory. - A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to...

PT-2026-134135

Name of the Vulnerable Software and Affected Versions Thales Sentinel Keys Server versions prior to 1.3.8.0 Description A stack-based buffer overflow and missing authorization issue exists in the HTTP handler of the software on Windows. The server fails to validate the length of the first field i...

PT-2026-133640

Name of the Vulnerable Software and Affected Versions InternLM LMDeploy versions 0.9.0 through 0.18.0 Description An unauthenticated remote attacker can execute arbitrary operating system commands with the privileges of the api server process. This occurs when the server receives specially crafte...

httpd:2.4 security, bug fix, and enhancement update

httpd 2.4.37-65.0.1.8 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-65.8 - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 - Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointe...

CentOS Linux 6 [TuxCare] Security Update: c-ares / c-ares-devel Multiple Vulnerabilities (CENTOS6:CLSA-2026:1793082403)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1793082403 advisory. - Heap-based buffer overflow in the arescreatequery function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-115943

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a conditi...

Linux Distros Unpatched Vulnerability : CVE-2026-119528

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP. The PSD plug-in's image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed...

Linux Distros Unpatched Vulnerability : CVE-2026-110133

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypa...

RHEL 9 : aspell (RHSA-2026:92458)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92458 advisory. GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker. Security...

AlmaLinux 9 : aspell (ALSA-2026:92458)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:92458 advisory. aspell: aspell: Arbitrary code execution via crafted dictionary file CVE-2026-103658 Tenable has extracted the preceding description block directly from the...

RHEL 8 : aspell (RHSA-2026:92615)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92615 advisory. GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker. Security...

CVE-2026-119333: jgraph drawio-desktop: draw.io Desktop is the official Electron build of draw.io

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the...

CVE-2026-61725: hasenbanck sevenz-rust2: sevenz-rust2 is a Rust-native 7z compressor and `decompress`or

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

CVE-2026-63393: opensearch-project sql: OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted cursor parameter to the plugins/sql endpoi...

PT-2026-134243

Name of the Vulnerable Software and Affected Versions OpenSearch versions 2.8.0.0 through 2.19.6.0 OpenSearch versions prior to 3.7.0.0 Description A remote authenticated user with basic read/search permissions can trigger unsafe deserialization of untrusted data by providing a crafted cursor...

CVE-2026-63346: christianhelle refitter: Refitter is a tool for generating a C# REST API client using the Refit library

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.2, the header parameter name in parameters.name with in: header is emitted verbatim into a Refit Header" " attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can...

PT-2026-134170

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the...

CVE-2026-93327: Google Cloud Application Integration: A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration…

A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was...

PT-2026-133619

Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting...

CVE-2026-37468: n/a: Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary…

Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionality, chat messaging component...