CVE-2026-49265 vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, datadog-agent, kubeflow-katib, jupyter-base-notebook, kubeflow-pipelines, ggshield, kserve, dask-kubernetes, kubeflow-pipelines-visualization-server, k8s-sidecar, kubeflow-volumes-web-app, az, open-webui...

GHSA-HXM8-2XGR-2P9M vulnerabilities

Vulnerabilities for packages: datadog-agent, ggshield, kserve, py3-cassandra-medusa, semgrep, superset, open-webui...

GHSA-FFC3-869F-JXW9 vulnerabilities

Vulnerabilities for packages: datadog-agent, ggshield, kserve, py3-cassandra-medusa, semgrep, superset, open-webui...

CVE-2026-102268 vulnerabilities

Vulnerabilities for packages: datadog-agent, ggshield, kserve, py3-cassandra-medusa, semgrep, superset, open-webui...

CVE-2026-102269 vulnerabilities

Vulnerabilities for packages: datadog-agent, ggshield, kserve, py3-cassandra-medusa, semgrep, superset, open-webui...

CVE-2026-102272 vulnerabilities

Vulnerabilities for packages: datadog-agent, ggshield, kserve, py3-cassandra-medusa, semgrep, superset, open-webui...

GHSA-R6X4-923Q-G947 vulnerabilities

Vulnerabilities for packages: datadog-agent, ggshield, kserve, py3-cassandra-medusa, semgrep, superset, open-webui...

EUVD-2026-90439

DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repourl parameter. Attackers can supply a non-URL repourl value to bypass path containment checks and read any file accessible to the API process by...

PT-2026-103995

RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromise...

Rocky Linux 9 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc (crlba-2025_20841)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlba-202520841 advisory. For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section. This advisory is provided by Ctrl IQ,...

CentOS Linux 8.5 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.5:CLSA-2026:1784800609)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1784800609 advisory. - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the...

Rocky Linux 10.2 [CIQ] Security Update: tomcat9 / tomcat9-admin-webapps / tomcat9-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_25341)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202625341 advisory. tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 tomcat: Client certificate verification...

Rocky Linux 9.2 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc (ciqsa-2026_1181)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261181 advisory. This advisory aggregates security fixes for the open-vm-tools SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2025-41244. Tenable has extracted the preceding...

CentOS Linux 8.4 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.4:CLSA-2026:1784800112)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1784800112 advisory. - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the...

Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2024_10987)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202410987 advisory. sinatra: Open Redirect Vulnerability in Sinatra via X-Forwarded-Host Header CVE-2024-21510 Tenable has extracted the preceding description block directly from the...

Rocky Linux 9.6 [TuxCare] Security Update: hwloc / hwloc-devel / hwloc-gui / hwloc-libs / hwloc-plugins (ALMALINUX9.6:CLSA-2026:1785770281)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785770281 advisory. - An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpus...

Rocky Linux 9 [CIQ] Security Update: isns-utils / isns-utils-debuginfo / isns-utils-debugsource / etc (crlsa-2026_53847)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202653847 advisory. open-isns: open-iscsi: Denial of Service via double-free in iSNS attribute decoder CVE-2026-55995 Tenable has extracted the preceding description block directly fr...

Rocky Linux 8 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc (crlsa-2023_3949)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20233949 advisory. open-vm-tools: authentication bypass vulnerability in the vgauth module CVE-2023-20867 Tenable has extracted the preceding description block directly from the CIQ...

PT-2026-105878

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

PT-2026-105873

Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callabl...