PT-2026-105115

cleanup xml node in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion...

CVE-2026-104182: Inefficient Algorithmic Complexity

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

Rocky Linux 10.2 [CIQ] Security Update: gdb / gdb-debuginfo / gdb-debugsource / gdb-doc / gdb-gdbserver / etc (crlsa-2026_73427)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202673427 advisory. gdb: Out-of-bounds write in STABS parser readmemberfunctions via crafted ELF CVE-2026-13732 Tenable has extracted the preceding description block directly from...

Rocky Linux 9 [CIQ] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_6300)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20266300 advisory. GStreamer: GStreamer: Arbitrary code execution via ASF file processing CVE-2026-2920 GStreamer: GStreamer: Remote Code Execution via heap-based buffer...

Rocky Linux 9 [CIQ] Security Update: apcu-panel / php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2025_4263)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20254263 advisory. php: Leak partial content of the heap through heap buffer over-read in mysqlnd CVE-2024-8929 php: Single byte overread with convert.quoted-printable-decode...

Rocky Linux 10.2 [CIQ] Security Update: python3.14 / python3.14-debug / python3.14-debuginfo / etc (crlsa-2026_40856)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202640856 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding descriptio...

Rocky Linux 9 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2025_7107)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257107 advisory. python: cpython: URL parser allowed square brackets in domain names CVE-2025-0938 Tenable has extracted the preceding description block directly from the CIQ securi...

PT-2026-105131

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and c...

PT-2026-105141

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and c...

AlmaLinux 9.2 [TuxCare] Security Update: wireshark / wireshark-cli / wireshark-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1775039763)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1775039763 advisory. - NetScreen file parser crash in Wireshark 4.0.0 to 4.0.10 and 3.6.0 to 3.6.18 allows denial of service via crafted capture file...

CentOS Linux 8.4 [TuxCare] Security Update: python2 / python2-debug / python2-devel / python2-libs / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1782983048)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1782983048 advisory. - The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member...

Rocky Linux 9 [CIQ] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (crlsa-2025_19512)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202519512 advisory. rubygem-rack: Rack QueryParser has an unsafe default allowing paramslimit bypass via semicolon- separated parameters CVE-2025-59830 rack: Rack's unbounded...

Rocky Linux 9.6 [TuxCare] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1777970873)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777970873 advisory. - GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

PT-2026-105111

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and c...

Rocky Linux 8 [CIQ] Security Update: gdb / gdb-debuginfo / gdb-debugsource / gdb-doc / gdb-gdbserver / etc (crlsa-2026_73425)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202673425 advisory. gdb: STABS debug format parser out-of-bounds write via crafted ELF binary CVE-2026-13732 Tenable has extracted the preceding description block directly from the CI...

AlmaLinux 8 : gdb (ALSA-2026:73425)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:73425 advisory. gdb: STABS debug format parser out-of-bounds write via crafted ELF binary CVE-2026-13732 Tenable has extracted the preceding description block directly from the...

Rocky Linux 10.0 [CIQ] Security Update: php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2025_7489)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257489 advisory. php: Header parser of http stream wrapper does not handle folded headers CVE-2025-1217 php: Stream HTTP wrapper header check might omit basic auth heade...

AlmaLinux 9.6 [TuxCare] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1777970873)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777970873 advisory. - GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

Rocky Linux 8 [CIQ] Security Update: gimp / gimp-debuginfo / gimp-debugsource / gimp-devel / etc Multiple Vulnerabilities (crlsa-2025_9165)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20259165 advisory. gimp: Multiple use after free in XCF parser CVE-2025-48798 gimp: Multiple heap buffer overflows in TGA parser CVE-2025-48797 gimp: GIMP ICO File Parsing...

Rocky Linux 9 [CIQ] Security Update: php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2025_7431)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257431 advisory. php: Header parser of http stream wrapper does not handle folded headers CVE-2025-1217 php: Stream HTTP wrapper header check might omit basic auth header...