CentOS Linux 8 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1779461988)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1779461988 advisory. - RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response...

CVE-2026-97991

A flaw was found in the Linux kernel's vDPA vHost Data Path Acceleration block simulator driver. Due to improper input validation, the driver logs out-of-range starting sector requests but fails to reject them, causing an arithmetic underflow and an invalid buffer offset. An attacker with access ...

RLSA-2026:72468 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fbcon: Set fbdisplayi-mode to NULL when the mode is released CVE-2025-40323 kernel: ext4: fix e4b bitmap inconsistency reports CVE-2026-45942 kernel: drm/amdgpu/vcn3: Prevent OOB reads wh...

CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2025:1740649075)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1740649075 advisory. - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock source...

RockyLinux 8 : kernel (RLSA-2026:72468)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:72468 advisory. kernel: fbcon: Set fbdisplayi-mode to NULL when the mode is released CVE-2025-40323 kernel: ext4: fix e4b bitmap inconsistency reports CVE-2026-45942...

CentOS Linux 8.4 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1787647818)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1787647818 advisory. - When using the configparser module to write configuration files containing multi-line text values with carriage return characters ...

RockyLinux 8 : kernel-rt (RLSA-2026:72467)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:72467 advisory. kernel: fbcon: Set fbdisplayi-mode to NULL when the mode is released CVE-2025-40323 kernel: ext4: fix e4b bitmap inconsistency reports CVE-2026-45942...

AlmaLinux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1788769322)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788769322 advisory. - tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a...

NPM: Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

NPM: Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled vulnerability discovered by ? in WordPress Npm electron versions 41.10.6...

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

Impact Responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI: true but without corsEnabled: true could be read cross-origin by web content. This completes the fix for CVE-2026-70604. Apps are only affected if th...

CVE-2026-102675 Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI...

CVE-2026-102675

The Electron framework (versions prior to 41.10.6 , 42.9.2 , 43.4.1 , and 44.0.0-beta.5 ) contains a vulnerability where responses served via protocol.registerFileProtocol or protocol.registerHttpProtocol remain script-readable across origins. This occurs when a custom scheme is registered with s...

CVE-2026-102675 Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI...

CVE-2026-102675 Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI...

CVE-2026-84782

A flaw was found in OpenSSL. The Datagram Transport Layer Security DTLS retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to...

openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission

A flaw was found in OpenSSL. The Datagram Transport Layer Security DTLS retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to...

CVE-2026-102806: Incorrect Authorization

OpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesystem isolation between sandboxed sessions. Sandboxed sessions or untrusted content can cause the Gateway to read files from sibling session sandboxes or shared...

AlmaLinux 9 : kernel (ALSA-2026:71700)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:71700 advisory. kernel: fbcon: Set fbdisplayi-mode to NULL when the mode is released CVE-2025-40323 kernel: smb: smbdirect: introduce...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

EUVD-2026-87656

Budibase @budibase/server before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string backtick-quoted for MySQL, a single-quoted sprename literal for MSSQL without applying the project's...