Rocky Linux 8 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3546)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243546 advisory. ruby: RCE vulnerability with .rdocoptions in RDoc CVE-2024-27281 ruby: Buffer overread vulnerability in StringIO CVE-2024-27280 ruby: Arbitrary memory...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc (crlsa-2022_6158)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20226158 advisory. php: uninitialized array in pgqueryparams leading to RCE CVE-2022-31625 Tenable has extracted the preceding description block directly from the CIQ security advisor...

Rocky Linux 9 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2025_23049)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523049 advisory. tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve CVE-2025-31651 tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via...

Rocky Linux 9 [CIQ] Security Update: evince / evince-debuginfo / evince-debugsource / evince-libs / etc (crlsa-2026_27819)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202627819 advisory. atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen CVE-2026-46529 Tenable has extracted the preceding...

CVE-2026-53964: Improper Neutralization of Special Elements Used in a Template Engine

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where i...

PT-2026-105578

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API in github.com/kubeedge/kubeedge...

CVE-2026-96658: Improper Control of Generation of Code

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...

PT-2026-105858

Summary In SSE/HTTP transport mode, mysql mcp server constructs SseServerTransport without passing security settings. As a result, the MCP Python SDK's DNS-rebinding protection Origin/Host header validation is disabled; the Starlette application has no CORS or TrustedHost middleware; and the...

PT-2026-104388

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.97 Description An out of bounds write in WebGL allows a remote attacker to execute arbitrary code outside the sandbox when a user visits a crafted HTML page. An out of bounds write occurs when a progr...

WiresharkZipHelper unzip DoS

The vulnerability of the WiresharkZipHelper::unzip function in the Wireshark network traffic analyzer is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability could allow a attacker to cause service failures or execute arbitrary code...

Rocky Linux 9 [CIQ] Security Update: redis / redis-debuginfo / redis-debugsource / redis-devel / etc Multiple Vulnerabilities (crlsa-2025_0693)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20250693 advisory. redis: heap overflow in the lua cjson and cmsgpack libraries CVE-2022-24834 redis: possible bypass of Unix socket permissions on startup CVE-2023-45145...

Rocky Linux 9 [CIQ] Security Update: git / git-all / git-core / git-core-debuginfo / git-core-doc / etc Multiple Vulnerabilities (crlsa-2024_4083)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20244083 advisory. git: Recursive clones RCE CVE-2024-32002 git: RCE while cloning local repos CVE-2024-32004 git: additional local RCE CVE-2024-32465 git: insecure hardlinks...

Rocky Linux 9 [CIQ] Security Update: ruby / ruby-bundled-gems / ruby-bundled-gems-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_20596)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202620596 advisory. ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection CVE-2026-33210 erb: ERB: Arbitrary code execution via...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.2:CLSA-2025:1745585424)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1745585424 advisory. - Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive fi...

Rocky Linux 9 [CIQ] Security Update: redis / redis-debuginfo / redis-debugsource / redis-devel / etc Multiple Vulnerabilities (crlsa-2025_19237)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202519237 advisory. redis: Lua library commands may lead to integer overflow and potential RCE CVE-2025-46817 Redis: Redis: Authenticated users can execute LUA scripts as a...

Rocky Linux 10.0 [CIQ] Security Update: tomcat9 / tomcat9-admin-webapps / tomcat9-docs-webapp / etc (crlsa-2025_7494)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257494 advisory. tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2025-24813 Tenable has extracted the preceding description...

Rocky Linux 9 [CIQ] Security Update: rubygem-mysql2 / rubygem-mysql2-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3668)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243668 advisory. ruby: Buffer overread vulnerability in StringIO CVE-2024-27280 ruby: RCE vulnerability with .rdocoptions in RDoc CVE-2024-27281 ruby: Arbitrary memory...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc (crlsa-2022_5468)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20225468 advisory. php: password of excessive length triggers buffer overflow leading to RCE CVE-2022-31626 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: redis / redis-debuginfo / redis-debugsource / redis-devel / etc Multiple Vulnerabilities (crlsa-2025_19238)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202519238 advisory. redis: Lua library commands may lead to integer overflow and potential RCE CVE-2025-46817 Redis: Redis: Authenticated users can execute LUA scripts as a...

Rocky Linux 9 [CIQ] Security Update: valkey / valkey-debuginfo / valkey-debugsource / valkey-devel Multiple Vulnerabilities (crlsa-2025_21916)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202521916 advisory. redis: Lua library commands may lead to integer overflow and potential RCE CVE-2025-46817 Redis: Redis: Authenticated users can execute LUA scripts as a...