Rocky Linux 9 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-64k / kernel-64k-core / etc Multiple Vulnerabilities (crlsa-2024_3619)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243619 advisory. kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref CVE-2024-26735 kernel: fs: sysfs: Fix reference leak in sysfsbreakactiveprotection...

Rocky Linux 9 [CIQ] Security Update: libxml2 / libxml2-debuginfo / libxml2-debugsource / libxml2-devel / etc Multiple Vulnerabilities (crlsa-2023_0338)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230338 advisory. libxml2: integer overflows with XMLPARSEHUGE CVE-2022-40303 libxml2: dict corruption caused by entity reference cycles CVE-2022-40304 Tenable has extracted...

AlmaLinux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1775817651)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775817651 advisory. - Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomicint for reference counting. Because std::atomicint is only 32...

Rocky Linux 9 [CIQ] Security Update: python3-jinja2 (crlsa-2025_0667)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20250667 advisory. jinja2: Jinja has a sandbox breakout through indirect reference to format method CVE-2024-56326 Tenable has extracted the preceding description block directly from...

PT-2026-103665

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments versions prior to 1.6.12.32 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level access or higher can exploit...

PT-2026-103719

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.4.9 Description An Insecure Direct Object Reference exists via the CourseMaterialTemplate::render material items callback exposed on the public...

CVE-2026-88789: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

Rocky Linux 8 [CIQ] Security Update: libxml2 / libxml2-debuginfo / libxml2-debugsource / libxml2-devel / etc Multiple Vulnerabilities (crlsa-2023_0173)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230173 advisory. libxml2: integer overflows with XMLPARSEHUGE CVE-2022-40303 libxml2: dict corruption caused by entity reference cycles CVE-2022-40304 Tenable has extracted...

Rocky Linux 8 [CIQ] Security Update: libwayland-client / libwayland-client-debuginfo / libwayland-cursor / etc (crlsa-2023_2786)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20232786 advisory. wayland: libwayland-server wlshm reference-count overflow CVE-2021-3782 Tenable has extracted the preceding description block directly from the CIQ security advisor...

Rocky Linux 8 [CIQ] Security Update: python3-jinja2 (crlsa-2025_0711)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20250711 advisory. jinja2: Jinja has a sandbox breakout through indirect reference to format method CVE-2024-56326 Tenable has extracted the preceding description block directly from...

AlmaLinux 9.2 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.2:CLSA-2025:1765377802)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1765377802 advisory. - Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomicint for reference counting. Because std::atomicint is only 32...

Rocky Linux 9 [CIQ] Security Update: dbus-broker / dbus-broker-debuginfo / dbus-broker-debugsource Multiple Vulnerabilities (crlsa-2022_6608)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226608 advisory. dbus-broker: a stack buffer over-read if a malicious Exec line is supplied CVE-2022-31212 dbus-broker: null pointer reference when supplying a malformed XM...

Rocky Linux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1775817651)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775817651 advisory. - Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomicint for reference counting. Because std::atomicint is only 3...

CVE-2026-102127 Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service...

CVE-2026-102127

The Kiteworks Email Protection Gateway is vulnerable to an XML External Entity (XXE) injection due to an XML parser that does not restrict external entity references. If an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could submit a crafted mess...

CVE-2026-93126

A flaw was found in the Linux kernel's remoteproc subsystem, specifically within the qcomq6v5adsp driver. When the adspmapcarveout function is called, it fails to properly release a device node reference. This oversight can lead to a reference leak, potentially causing resource exhaustion over ti...

CLSA-2026-1790786185 libxml2: Fix of CVE-2026-74860

CVE-2026-74860: drop the extra PyDECREF on each enumeration value string in pythonAttributeDecl, since PyListSetItem already steals that reference...

GHSA-CXP5-3PX4-PW24 jackson-databind quadratic forward-reference completion

Summary When an @JsonIdentityInfo collection or map first creates N unresolved object-ID references and later resolves the same IDs in reverse order, jackson-databind scans the remaining pending-reference accumulator for each resolution. A shallow JSON document whose size grows linearly can...

dbnd-datastage-monitor (>=1.0.4.1, <=1.0.4.3), dkcloudcommand (>=1.0.132rc1, <=1.1.270rc1) +5 more potentially affected by CVE-2026-102270 via pyjwt (1.6.1)

pyjwt PYPI version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - dbnd-datastage-monitor =1.0.4.1, =1.0.132rc1, =0.2.1, =0.1.1rc0, =0.5.3, =1.2.0rc1, =0.0.3a0, =0.1.10 Source cves: CVE-2026-102270 Source advisory:...

CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...