PT-2026-105851

Summary MCP Atlassian exposes Jira and Confluence attachment upload tools that accept arbitrary local filesystem paths and upload those file contents to Atlassian. In HTTP or multi-user deployments, an MCP caller who can invoke write tools can cause the server to read any file accessible to the M...

PT-2026-105196

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CWE-200. when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecre...

ROS-20261001-73-0027

The vulnerability in glib2 is related to the issue of writing operations outside of the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

ROS-20261001-73-0024

The vulnerability of the gvstupleisnormal function in the glib/gvariant-serialiser.c library in the Glib library is related to the execution of an operation outside the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to disclose sensitive information that ...

PT-2026-105082

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...

CentOS Linux 7 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1778173472)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1778173472 advisory. - In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JS...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-10.0 / aspnetcore-runtime-dbg-10.0 / etc Multiple Vulnerabilities (crlsa-2026_54542)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654542 advisory. .NET: .NET Core: .NET Security Feature Bypass Vulnerability CVE-2026-62899 .NET: .NET Information Disclosure Vulnerability CVE-2026-62900 .NET: .NET Denia...

AlmaLinux 9.2 [TuxCare] Security Update: git-lfs (ALMALINUX9.2:CLSA-2025:1762867600)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762867600 advisory. - Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of...

AlmaLinux 9.6 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql (ALMALINUX9.6:CLSA-2026:1790870694)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790870694 advisory. - Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data fro...

Rocky Linux 10.2 [CIQ] Security Update: ipa-client / ipa-client-common / ipa-client-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_72279)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202672279 advisory. ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in...

Rocky Linux 10.2 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2026_73130)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202673130 advisory. firefox: thunderbird: Privilege escalation in the DOM: Workers component CVE-2026-16365 firefox: thunderbird: Sandbox escape in the Remote Settings...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc Multiple Vulnerabilities (crlsa-2023_7581)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237581 advisory. postgresql: Buffer overrun from integer overflow in array modification CVE-2023-5869 postgresql: Memory disclosure in aggregate function calls CVE-2023-586...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2026_2470)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20262470 advisory. php: Leak partial content of the heap through heap buffer over-read in mysqlnd CVE-2024-8929 php: Single byte overread with convert.quoted-printable-decode...

AlmaLinux 9.2 [TuxCare] Security Update: microcode_ctl (ALMALINUX9.2:CLSA-2023:1701971779)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2023:1701971779 advisory. - Sequence of processor instructions leads to unexpected behavior for some IntelR Processors may allow an authenticated user to potentially...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / babel / numpy-debugsource / etc (crlsa-2023_7042)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20237042 advisory. python-requests: Unintended leak of Proxy-Authorization header CVE-2023-32681 Tenable has extracted the preceding description block directly from the CIQ security...

CentOS Linux 7 [TuxCare] Security Update: freerdp / freerdp-devel / freerdp-libs / libwinpr / libwinpr-devel (CENTOS7:CLSA-2026:1789779158)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1789779158 advisory. - FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary...

Rocky Linux 10.2 [CIQ] Security Update: postgis / postgis-client / postgis-client-debuginfo / etc (crlsa-2026_65899)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202665899 advisory. postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer CVE-2026-73515 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: libecap / libecap-debuginfo / libecap-debugsource / libecap-devel / etc (crlsa-2025_19107)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202519107 advisory. squid-cache: Squid vulnerable to information disclosure via authentication credential leakage in error handling CVE-2025-62168 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: assertj-core (crlsa-2026_60215)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202660215 advisory. assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: bsdtar / bsdtar-debuginfo / libarchive / libarchive-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_8510)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20268510 advisory. libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing CVE-2026-4424 libarchive: libarchive: Arbitrary code...