CVE-2026-103276

Ghost versions before 6.20.0 are vulnerable to a file extension filtering bypass that allows unauthenticated attackers to read theme templates and metadata . The root cause is an insufficient validation of file extensions, which can be circumvented using URL encoding . This allows unauthorized ac...

CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Wednesday added a critical authentication bypass flaw impacting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities KEV, following reports of active exploitation. The vulnerability, tracked as CVE-2026-76504 CVSS...

BIT-TOMCAT-2026-77756 Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

CVE-2023-32315-EXPLOIT

CVE-2023-32315 - Bypass de Autenticación en Openfire Este repositorio destaca un problema de seguridad grave que afecta a varias versiones de Openfire. Openfire, un servidor de colaboración en tiempo real multiplataforma que utiliza el protocolo XMPP desarrollado por la comunidad Ignite Realtime,...

CLEANSTART-2026-EQ95867 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes...

SUSE CVE-2026-102805

A flaw has been found in Nothings stb up to 1.16. This affects the function stbiwritepngtomem/stbiwritejpgcore/stbiwritetgacore in the library stbimagewrite.h of the component Image Encoding. Executing a manipulation can lead to integer overflow. The attack can be executed remotely. The exploit h...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc (crlsa-2025_1736)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20251736 advisory. postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation CVE-2025-1094 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: containernetworking-plugins / containernetworking-plugins-debuginfo / etc (crlsa-2024_11216)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202411216 advisory. encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion CVE-2024-34156 Tenable...

Rocky Linux 8 [CIQ] Security Update: libvpx-debuginfo / libvpx-debugsource Multiple Vulnerabilities (crlsa-2023_5537)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20235537 advisory. libvpx: Heap buffer overflow in vp8 encoding in libvpx CVE-2023-5217 libvpx: crash related to VP9 encoding in libvpx CVE-2023-44488 Tenable has extracted t...

Rocky Linux 9 [CIQ] Security Update: postgresql / postgresql-contrib / postgresql-contrib-debuginfo / etc (crlsa-2025_1742)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20251742 advisory. postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation CVE-2025-1094 Tenable has extracted the preceding...

CVE-2026-103276: Improper Handling of Alternate Encoding

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files...

PT-2026-103808

Name of the Vulnerable Software and Affected Versions Ghost versions prior to 6.20.0 Description An issue exists where unauthenticated attackers can read theme templates and metadata. This is possible through a file extension filtering bypass, where attackers utilize URL encoding to circumvent...

CentOS Linux 8 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS-STREAM8:CLSA-2026:1770648267)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1770648267 advisory. - In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data. CVE-2026-24515 Note that Ness...

PT-2026-103937

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.30 through 2.4.68 Description An issue exists involving the inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling. This occurs via the mod proxy uwsgi module when processing a...

CentOS Linux 7 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS7:CLSA-2026:1770735514)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1770735514 advisory. - In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data. CVE-2026-24515 Note that Nessus has n...

AlmaLinux 9.2 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.2:CLSA-2026:1770741587)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1770741587 advisory. - In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data. CVE-2026-24515 Note that Nessus h...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc (crlsa-2025_1740)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20251740 advisory. postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation CVE-2025-1094 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc (crlsa-2025_1741)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20251741 advisory. postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation CVE-2025-1094 Tenable has extracted the preceding...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788856994)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788856994 advisory. - A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the...

CentOS Linux 6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc (CENTOS6:CLSA-2026:1780565300)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1780565300 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an...