AlmaLinux 9.2 [TuxCare] Security Update: systemd / systemd-boot-unsigned / systemd-container / systemd-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776099155)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776099155 advisory. - systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made wit...

AlmaLinux 9.2 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1767954480)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1767954480 advisory. - ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources,...

Rocky Linux 8 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel Multiple Vulnerabilities (crlsa-2024_10379)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202410379 advisory. pam: libpam: Libpam vulnerable to read hashed password CVE-2024-10041 pam: Improper Hostname Interpretation in pamaccess Leads to Access Control Bypass...

Rocky Linux 9 [CIQ] Security Update: iscsi-initiator-utils / iscsi-initiator-utils-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_53844)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202653844 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785885924)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785885924 advisory. - Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat...

CVE-2026-51896

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

PT-2026-105107

Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy policies.kyverno.io/v1beta1 evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException whose policyRefs and matchConditions match a resource...

CVE-2026-51893

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via tracemindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

PT-2026-103882

Name of the Vulnerable Software and Affected Versions WP Full Stripe Free versions prior to 8.5.7 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 8.5.6...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

PT-2026-104003

Name of the Vulnerable Software and Affected Versions monta.app affected versions not specified Description Charging station authentication identifiers are publicly accessible through web-based mapping platforms. Recommendations At the moment, there is no information about a newer version that...

PT-2026-104048

Name of the Vulnerable Software and Affected Versions Ragflow versions prior to 0.24.1 Description Improper access control exists in the update metadata setting function located in the api/apps/kb app.py file. This flaw allows an attacker to perform unauthorized cross-session or privilege-crossin...

Dell Rugged Control Center < 5.2.206 Multiple Vulnerabilities (DSA-2026-410)

The version of Dell Rugged Control Center RCC installed on the remote host is prior to 5.2.206. It is, therefore, affected by multiple vulnerabilities: - An improper authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to...

PT-2026-103852

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2025:1764716872)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1764716872 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule...

CVE-2026-51879

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.writebotfile. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tutorbot file route...

PT-2026-103853

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor Free Widgets,...

CVE-2026-51892

The software infiniflow ragflow version 0.24.0 is vulnerable to Incorrect Access Control via the /v1/document/get/ endpoint. This flaw allows for unauthorized access to documents. The vulnerability is associated with CWE-284 (Improper Access Control). While the CVSS v3.1 score indicates a Medium ...

CVE-2026-51897

RAGFlow version 0.24.0 is affected by an improper access control vulnerability in the get_dataset() function located within the api/apps/evaluation_app endpoint. This flaw allows an attacker to trigger attacker-controlled code or command execution , depending on the exposed entry. As a temporary ...

CVE-2026-51894

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via the run_mindmap function. The vulnerability exists because a reachable path accepts a caller-selected object or tenant identifier and proceeds to a data-access operation without verifying a visible owner, tenant, workspace, o...