CVE-2026-18252

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude...

RLSA-2026:60004 Low: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 For more details about the securit...

httpd security update

An update is available for httpd. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd packages provide the Apache HTTP Server, a powerful, efficient, and...

httpd security update

An update is available for httpd. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd packages provide the Apache HTTP Server, a powerful, efficient, and...

httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration

A flaw was found in Apache HTTP Server when using the modldap module in a per-directory configuration. This use-after-free vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial of service DoS due to improper memory handling. This could lead to system...

CVE-2026-58094 TOCTOU race in POSIX shared memory large page configuration

The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...

CVE-2026-58094 TOCTOU race in POSIX shared memory large page configuration

The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...

SUSE CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.24), org.apache.tomee:apache-tomee (11.0.0-m1) +10 more potentially affected by CVE-2026-68525 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.24)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =3.0.0, =3.0.0, =11.0.0, =11.1.3 Source cves: CVE-2026-68525 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-20302852...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.24), org.apache.tomee:apache-tomee (11.0.0-m1) +10 more potentially affected by CVE-2026-68525 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.24)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =3.0.0, =3.0.0, =11.0.0, =11.1.3 Source cves: CVE-2026-68525 Source advisory: OSV:GHSA-H3X4-894J-XPX5...

CVE-2026-75363

The Comfast CF-WR630AX v.2.7.0.2 is affected by a vulnerability that allows a remote attacker to achieve arbitrary code execution . The root cause is the Improper Neutralization of Special Elements used in an OS Command involving the /usr/bin/webmgnt and /cgi-bin/mbox-config endpoints, specifical...

PT-2026-82098

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.9 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0 Description An authenticated user with developer-role permissions can execute arbitrary commands within a CI context. This...

RHEL 10 : httpd (RHSA-2026:60004)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:60004 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP Server:...

RockyLinux 9 : httpd (RLSA-2026:59347)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:59347 advisory. httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 Tenable has...

AlmaLinux 9 : httpd (ALSA-2026:59347)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:59347 advisory. httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 Tenable has...

CVE-2026-75363

An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, displayn...

CVE-2026-75338: Improper Access Control

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

PT-2026-82222

Name of the Vulnerable Software and Affected Versions Netmaker affected versions not specified Description Netmaker disables certificate verification when connecting to the configured mail server. In the file pro/email/smtp.go, the sender assigns a TLS configuration where the skip-verify field is...

PT-2026-82302

Name of the Vulnerable Software and Affected Versions Comfast CF-WR630AX version 2.7.0.2 Description A remote attacker can execute arbitrary code through the '/usr/bin/webmgnt' and '/cgi-bin/mbox-config' endpoints by manipulating the timestr and display n parameters. Recommendations At the moment...

PT-2026-82297

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.7 Description The REST API fails to properly enforce the scope of project- and workspace-scoped teams. This allows a user to submit invalid team configurations, enabling them to assign projects to a team via...