Rocky Linux 9.6 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc (ALMALINUX9.6:CLSA-2026:1769021453)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1769021453 advisory. - MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu...

AlmaLinux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785888218)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785888218 advisory. - In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc (ALMALINUX9.2:CLSA-2025:1745530844)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1745530844 advisory. - GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are...

Rocky Linux 9 [CIQ] Security Update: perl-XML-LibXML / perl-XML-LibXML-debuginfo / etc (crlsa-2026_39553)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639553 advisory. perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names CVE-2026-8177 Tenable has extracted the preceding description block directly...

Rocky Linux 9 [CIQ] Security Update: postgresql-jdbc (crlsa-2023_0318)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20230318 advisory. postgresql: SQL Injection in ResultSet.refreshRow with malicious column names CVE-2022-31197 Tenable has extracted the preceding description block directly from the...

CVE-2026-63374

A flaw was found in AnyIO. A remote attacker in a privileged network position can bypass Transport Layer Security TLS certificate validation when connecting to internationalized domain names. This vulnerability occurs because the framework converts internationalized hostnames using an outdated...

AlmaLinux 9.2 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1780477611)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780477611 advisory. - NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' family of attacks tha...

SUSE CVE-2026-17545

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

NPM: adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

NPM: adm-zip: Duplicate ZIP entry names: getEntry and extractAllTo resolve to different content vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

GHSA-P634-W6R4-RJP2 adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. getEntryname and extractAllTo walk these two different internal structures, so they can each resolve a duplicate name to ...

MAL-2026-17280 Malicious code in @hrmony/pladddform-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 607004ff93f1fcd5fbf7b1cf6b5e104b7f26eb699aee3dd4f8bbb33494f0b096 On module import, index.js executes an unconditional exfiltration payload against the installer/runtime host. It queries the AWS EC2 Instance Metadat...

Malicious code in @hrmony/pladddform-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 607004ff93f1fcd5fbf7b1cf6b5e104b7f26eb699aee3dd4f8bbb33494f0b096 On module import, index.js executes an unconditional exfiltration payload against the installer/runtime host. It queries the AWS EC2 Instance Metadat...

Malicious code in @hrmony/belegerfassung-pladddform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615255a66c44204b03e60a165c1a9b21f95ecd351bf58c355462c159c74d1017 The package's main module index.js executes exfiltration logic at top level on import. It first sends a hello beacon via HTTP POST to the hardcoded...

Improper Handling of Windows Device Names

Overview Affected versions of this package are vulnerable to Improper Handling of Windows Device Names via safejoin on Windows, which fails to block special Windows device names e.g. CON, NUL, AUX when an empty Alternate Data Stream ADS marker : is appended to the name. An attacker can supply a...

CVE-2026-81914 Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

CVE-2026-81914 Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

CVE-2026-81914 Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended...

CVE-2026-98073

A flaw was found in the Linux kernel. A local user can cause a Denial of Service DoS by assigning conflicting alternative interface names to network devices across different network namespaces. When a non-root network namespace is deleted, the unresolved name conflict prevents the device from...

PT-2026-102718

Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action...

Amazon Linux 2 : environment-modules (ALAS-2026-3942)

The version of environment-modules installed on the remote host is prior to 3.2.10-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3942 advisory. modulecomgenwordsandfiles fed untrusted text module names readoff disk, LOADEDMODULES, MODULEPATH straight into compg...