AlmaLinux 9.6 [TuxCare] Security Update: perl-Archive-Tar (ALMALINUX9.6:CLSA-2026:1786097595)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786097595 advisory. - Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. readtar reads ea...

CentOS Linux 6 [TuxCare] Security Update: python / python-devel / python-libs / python-test / python-tools / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1777457441)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1777457441 advisory. - An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-8.0 / aspnetcore-runtime-dbg-8.0 / etc Multiple Vulnerabilities (crlsa-2026_8468)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20268468 advisory. dotnet: .NET: Security Bypass and Denial of Service Vulnerability CVE-2026-26171 dotnet: .NET: Denial of Service via stack overflow CVE-2026-32203 dotnet:...

Rocky Linux 8 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_10950)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202610950 advisory. expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2025-59375...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1774261018)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1774261018 advisory. - The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects...

Rocky Linux 9 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc (crlsa-2024_8446)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20248446 advisory. python: cpython: tarfile: ReDos via excessive backtracking while parsing header values CVE-2024-6232 Tenable has extracted the preceding description block directly...

AlmaLinux 9.6 [TuxCare] Security Update: libevent / libevent-devel / libevent-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790587734)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790587734 advisory. - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c...

Spring Framework < 5.2.26 / 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Response Splitting

The version of Spring Framework installed on the remote host is prior to 5.2.26, 5.3.x prior to 5.3.50, 6.0.x prior to 6.0.31, 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by a vulnerability: - Applications that build a Content-Disposition...

PT-2026-105192

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmq web mqtt/src/rabbit web mqtt handler.erl:104 nor the Web-STOMP handler deps/rabbitmq web stomp/src/rabbit web stomp handler.erl:102 validates the...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging Multiple Vulnerabilities (crlsa-2020_0598)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20200598 advisory. nodejs: HTTP request smuggling using malformed Transfer-Encoding header CVE-2019-15605 nodejs: Remotely trigger an assertion on a TLS server with a malform...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo (crlsa-2022_0001)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20220001 advisory. golang: net/http: limit growth of header canonicalization cache CVE-2021-44716 Tenable has extracted the preceding description block directly from the CIQ security...

PT-2026-105134

phar tar number parses the octal size field of a TAR header into a uint32 t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets...

NPM: fastify vulnerable to header validation bypass via incomplete schema case normalization

NPM: fastify vulnerable to header validation bypass via incomplete schema case normalization vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

GHSA-9Q9J-Q6P8-XQ58 fastify vulnerable to header validation bypass via incomplete schema case normalization

Impact Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7...

EUVD-2026-70998

fastify vulnerable to header validation bypass via incomplete schema case normalization...

fastify vulnerable to header validation bypass via incomplete schema case normalization

Impact Fastify lowercases header-schema property names before compiling the schema, because Node.js stores request header names in lowercase. That normalization was incomplete: it lowercased only top-level properties keys and the root required array, and did not lowercase the JSON Schema Draft 7...

Uncaught Exception

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Uncaught Exception via createRequest and createRequestFromNodeRequest in node.ts when processing a request with a malformed port valu...

Astro: Malformed port in the Host header can crash the Node adapter

Summary In the Astro Node adapter, a request whose Host header contains a malformed port for example example.com:65536 or example.com:8080:8080 produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised a...

GHSA-QH8J-HQJV-7M4X Astro: Malformed port in the Host header can crash the Node adapter

Summary In the Astro Node adapter, a request whose Host header contains a malformed port for example example.com:65536 or example.com:8080:8080 produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised a...

CVE-2026-103592

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to...