PT-2026-103940

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.69 Description An authentication bypass exists in the mod auth digest module. A man-in-the-middle MITM attacker can replay captured digest authentication credentials using crafted requests. This occurs...

PT-2026-104044

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.8.5 Description A directory traversal flaw exists where a public-facing HTTP route handler forwards attacker-controlled paths or filenames into host file creation without boundary enforcement. This allo...

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1777946314)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777946314 advisory. - Server-Side Request Forgery SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via...

Rocky Linux 8 [CIQ] Security Update: libecap / libecap-debuginfo / libecap-debugsource / libecap-devel Multiple Vulnerabilities (crlsa-2024_1375)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20241375 advisory. squid: denial of service in HTTP header parser CVE-2024-25617 squid: Denial of Service in HTTP Chunked Decoding CVE-2024-25111 squid: denial of service in...

Rocky Linux 10.2 [CIQ] Security Update: python3.14-urllib3 Multiple Vulnerabilities (crlsa-2026_27929)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202627929 advisory. urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-44432 urllib3: urllib3: Information disclosure via cross-orig...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1776939108)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776939108 advisory. - A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOWUPDATE frames on stream 0 connection-level that cause the flow...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / etc (crlsa-2023_0079)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230079 advisory. dotnet: Parsing an empty HTTP response as a JSON.NET JObject causes a stack overflow and crashes a process CVE-2023-21538 Tenable has extracted the preceding...

AlmaLinux 9.6 [TuxCare] Security Update: mod_http2 Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788178281)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788178281 advisory. - Out-of-bounds Read vulnerability in Apache HTTP Server with modheaders and modmime and multiple response languages. This issue...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1781261042)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1781261042 advisory. - Use After Free vulnerability in Apache HTTP Server with modldap in per-directory configuration This issue affects Apache HTTP...

Rocky Linux 10.1 [CIQ] Security Update: mod_md / mod_md-debuginfo / mod_md-debugsource (crlsa-2025_23738)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523738 advisory. modmd: Apache HTTP Server: modmd ACME, unintended retry intervals CVE-2025-55753 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: perl-App-cpanminus / perl-CPAN-DistnameInfo / perl-CPAN-Meta-Check / etc (crlsa-2024_10219)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202410219 advisory. perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability CVE-2024-45321 Tenable has extracted the preceding description block direct...

Rocky Linux 8 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel Multiple Vulnerabilities (crlsa-2024_9573)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249573 advisory. libsoup: infinite loop while reading websocket data CVE-2024-52532 libsoup: HTTP request smuggling via stripping null bytes from the ends of header names...

Rocky Linux 10.2 [CIQ] Security Update: python3-urllib3 Multiple Vulnerabilities (crlsa-2026_28000)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202628000 advisory. urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-44432 urllib3: urllib3: Information disclosure via cross-orig...

Rocky Linux 8 [CIQ] Security Update: varnish / varnish-devel / varnish-docs / varnish-modules / etc (crlsa-2022_0418)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20220418 advisory. varnish: HTTP/1 request smuggling vulnerability CVE-2022-23959 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc Multiple Vulnerabilities (CENTOS7:CLSA-2024:1725382183)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2024:1725382183 advisory. - Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This...

Rocky Linux 8 [CIQ] Security Update: lynx / lynx-debuginfo / lynx-debugsource (crlsa-2022_2129)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20222129 advisory. lynx: Disclosure of HTTP authentication credentials via SNI data CVE-2021-38165 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (crlsa-2023_0833)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230833 advisory. python: int type in PyLongFromString does not limit amount of digits converting text to int leading to DoS CVE-2020-10735 python: open redirection...

Rocky Linux 8 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource Multiple Vulnerabilities (crlsa-2024_3346)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243346 advisory. golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-45288 golang: net/http/cookiejar: incorrect forwarding of...

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1781352817)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781352817 advisory. - Use After Free vulnerability in Apache HTTP Server with modldap in per-directory configuration This issue affects Apache HTTP...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc (crlsa-2025_10672)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202510672 advisory. net/http: Sensitive headers not cleared on cross-origin redirect in net/http CVE-2025-4673 Tenable has extracted the preceding description block directly from the...