CentOS Linux 8.5 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS8.5:CLSA-2025:1742380145)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1742380145 advisory. - A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a...

AlmaLinux 9.2 [TuxCare] Security Update: redis / redis-devel / redis-doc (ALMALINUX9.2:CLSA-2025:1750785864)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1750785864 advisory. - Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated clien...

PT-2026-103102

Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data...

CVE-2026-85576: Missing Authorization

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

CVE-2026-96825: Authentication Bypass by Spoofing

Subscriber Bypass Vulnerability in All In One WP Security & Firewall = 5.4.8 versions...

CVE-2026-85573: Improper Neutralization of Input During Web Page Generation

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

CVE-2026-97196: Improper Validation of Unsafe Equivalence in Input

Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass. This issue affects GiveWP: from n/a through 4.16.9...

CVE-2026-10764: Use of Hard-coded Cryptographic Key

Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data...

CentOS Linux 8 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc (CENTOS-STREAM8:CLSA-2025:1742661734)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1742661734 advisory. - A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a...

CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc (CENTOS-STREAM8:CLSA-2026:1778839666)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1778839666 advisory. - In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing...

AlmaLinux 9.6 [TuxCare] Security Update: mutt (ALMALINUX9.6:CLSA-2026:1783436433)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783436433 advisory. - In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an...

CentOS Linux 7 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-devel / etc (CENTOS7:CLSA-2024:1712837808)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1712837808 advisory. - When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle...

Rocky Linux 9.6 [TuxCare] Security Update: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / ant-apache-oro / etc (ALMALINUX9.6:CLSA-2026:1789746085)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789746085 advisory. - The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it ...

PT-2026-103030

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

PT-2026-103031

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

CentOS Linux 8.4 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.4:CLSA-2026:1782979343)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1782979343 advisory. - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker...

PT-2026-103210

Subscriber Bypass Vulnerability in All In One WP Security & Firewall = 5.4.8 versions...

CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CVE-2026-95340

An incorrect authorization flaw was found in the PictureInPicture component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553268567...

CVE-2026-95358

Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. Chromium security severity: Medium...