CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1782980275)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1782980275 advisory. - Out-of-bounds Read vulnerability in Apache HTTP Server with modheaders and modmime and multiple response languages. This issue...

CVE-2026-51888

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

PT-2026-104037

Name of the Vulnerable Software and Affected Versions deeptutor version 1.4.0 Description An authorization bypass exists due to a user-controlled object identifier in the write bot file function of TutorBotManager. A remote attacker can enumerate bot IDs and overwrite whitelisted control files of...

CVE-2026-51879

The deeptutor 1.4.0 software contains an authorization bypass vulnerability within the TutorBotManager.write_bot_file function. This flaw allows a remote caller to manipulate a user-controlled object identifier to enumerate bot IDs and overwrite whitelisted control files belonging to other bots v...

PT-2026-105617

fzf vulnerable to denial of service through quadratic HTTP request-body accumulation in github.com/junegunn/fzf...

CVE-2026-13313: Active Debug Code

An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected...

CVE-2026-67105: Cleartext Transmission of Sensitive Information

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle MitM attacks...

CVE-2026-102670: Cleartext Transmission of Sensitive Information

Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it...

CVE-2026-51879

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.writebotfile. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tutorbot file route...

PT-2026-105166

RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, accept content/2 at line 56 calls rabbit stream manager:create super stream/... directly after is authorized which only checks the management tag + vhost access via is authorized vhost. The...

CVE-2026-63686: NULL Pointer Dereference

A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to...

PT-2026-103928

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.68 Description A Use After Free issue exists in the mod rewrite module when utilizing the lookahead feature %LA-U:HTTP:.... Use After Free is a memory corruption flaw that occurs when an applicatio...

CVE-2026-56154: Use After Free

Use After Free vulnerability in Apache HTTP Server's modrewrite when using lookahead %LA-U:HTTP:... This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

PT-2026-105112

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

CVE-2026-59797: Improper Privilege Management

Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

PT-2026-105839

Summary The UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation. Affected Package - Ecosystem: PyPI - Package: mcp-atlassian - Affected versions: all versions before...

CVE-2026-57941: Use After Free

Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

CVE-2026-57941: Use After Free

Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

PT-2026-104043

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.9.4 Description An authenticated attacker can execute arbitrary Python code on the server via a code injection flaw. The issue exists because a public-facing route accepts raw Python source and forwards...

PT-2026-105208

Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.0 through 10.1.59, from 9.0.39...