PT-2026-103794

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.9 Description The software fails to limit the number of query string fields in the HTTPServerRequest. init function. This allows remote, unauthenticated attackers to send GET requests containing thousands of query...

PT-2026-105534

Summary In the Astro Node adapter, a request whose Host header contains a malformed port for example example.com:65536 or example.com:8080:8080 produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised a...

PT-2026-103543

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An endpoint used during the initial appliance setup lacks authentication and fails to correctly enforce its intended state precondition. This allows an...

ROS-20260930-73-0062

The vulnerability in the kernel-lt is related to the failure to release resources after their useful period has ended. Exploiting this vulnerability allows a remote attacker to cause service interruptions through specially created IPv6 traffic...

PT-2026-103490

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

CVE-2026-102984: Uncaught Exception

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...

PT-2026-103585

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.18.0 Description A flaw in the way the library handles crafted PDF files can lead to uncontrolled resource consumption. Specifically, when a PDF contains indirect-object identifiers or generation-number tokens that...

PT-2026-103484

Name of the Vulnerable Software and Affected Versions @angular/router versions prior to 20.3.32 @angular/router versions prior to 21.2.24 @angular/router versions prior to 22.2.0 Description A denial of service DoS issue exists in @angular/router when Server-Side Rendering SSR is enabled on...

Important: gvfs security update

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol FTP, Secure Shell File Transfer Protocol SFTP, Web Distributed Authoring and Versioning WebDAV, Common Internet File System CIFS, Server Message Block SMB, and...

CentOS Linux 8.5 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS8.5:CLSA-2026:1769510148)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1769510148 advisory. - When building nested elements using xml.dom.minidom methods such as appendChild that have a dependency on clearidcache the algorithm is...

AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1726583188)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1726583188 advisory. - If a server hosts a zone containing a KEY Resource Record, or a resolver DNSSEC-validates a KEY Resource Record from a DNSSEC-sign...

CentOS Linux 7 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (CENTOS7:CLSA-2026:1778163112)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1778163112 advisory. - OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote...

Rocky Linux 9.6 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790782220)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790782220 advisory. - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

Elasticsearch 8.x < 8.19.21 / 9.0.x < 9.4.6 / 9.5.x < 9.5.3 DoS (ESA-2026-170)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.21, or 9.0.x prior to 9.4.6, or 9.5.x prior to 9.5.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-170 advisory. - Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to...

CentOS Linux 8.5 [TuxCare] Security Update: mysql / mysql-common / mysql-devel / mysql-errmsg / mysql-libs / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1768587465)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1768587465 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are...

AlmaLinux 9.2 [TuxCare] Security Update: xorg-x11-server-Xwayland / xorg-x11-server-Xwayland-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1777886414)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777886414 advisory. - A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling,...

CentOS Linux 7 [TuxCare] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1779740981)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1779740981 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported version...

AlmaLinux 9.2 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-static / python3-libxml2 (ALMALINUX9.2:CLSA-2026:1789473529)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789473529 advisory. - Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a...

CentOS Linux 7 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1783416267)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1783416267 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and...

SUSE SLED15 / SLES15 Security Update : jsoup, re2j (SUSE-SU-2026:4393-1)

"The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4393-1 advisory. This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited...