CVE-2026-85087: Improper Certificate Validation

Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-85483: Use of Uninitialized Resource

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Rocky Linux 9 [CIQ] Security Update: postfix / postfix-cdb / postfix-cdb-debuginfo / postfix-debuginfo / etc (crlsa-2026_26205)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202626205 advisory. postfix: buffer over-read via malformed enhanced status code CVE-2026-43964 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.2 [TuxCare] Security Update: postfix / postfix-cdb / postfix-ldap / postfix-lmdb / postfix-mysql / etc (ALMALINUX9.2:CLSA-2026:1778874422)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778874422 advisory. - Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced stat...

Rocky Linux 8 [CIQ] Security Update: postfix / postfix-cdb / postfix-cdb-debuginfo / postfix-debuginfo / etc (crlsa-2026_25932)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202625932 advisory. postfix: buffer over-read via malformed enhanced status code CVE-2026-43964 Tenable has extracted the preceding description block directly from the CIQ security...

CentOS Linux 8.4 [TuxCare] Security Update: postfix / postfix-cdb / postfix-ldap / postfix-lmdb / postfix-mysql / etc (CENTOS8.4:CLSA-2026:1779095130)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1779095130 advisory. - Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced stat...

CentOS Linux 8 [TuxCare] Security Update: postfix / postfix-cdb / postfix-ldap / postfix-lmdb / postfix-mysql / etc (CENTOS-STREAM8:CLSA-2026:1779096347)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1779096347 advisory. - Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced...

AlmaLinux 9.6 [TuxCare] Security Update: postfix / postfix-cdb / postfix-ldap / postfix-lmdb / postfix-mysql / etc (ALMALINUX9.6:CLSA-2026:1779191237)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779191237 advisory. - Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced stat...

Rocky Linux 9.6 [TuxCare] Security Update: postfix / postfix-cdb / postfix-ldap / postfix-lmdb / postfix-mysql / etc (ALMALINUX9.6:CLSA-2026:1779191237)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779191237 advisory. - Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced...

Rocky Linux 10.2 [CIQ] Security Update: postfix / postfix-cdb / postfix-cdb-debuginfo / postfix-debuginfo / etc (crlsa-2026_25930)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202625930 advisory. postfix: buffer over-read via malformed enhanced status code CVE-2026-43964 Tenable has extracted the preceding description block directly from the CIQ security...

CentOS Linux 6 [TuxCare] Security Update: postfix / postfix-perl-scripts (CENTOS6:CLSA-2026:1779735114)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1779735114 advisory. - Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status...

CentOS Linux 8.5 [TuxCare] Security Update: postfix / postfix-cdb / postfix-ldap / postfix-lmdb / postfix-mysql / etc (CENTOS8.5:CLSA-2026:1779298645)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1779298645 advisory. - Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced stat...

SUSE CVE-2026-67409

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CWE-252. the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response...

AZL-109731 CVE-2026-67409 affecting package rabbitmq-server 3.13.7-9

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CWE-252. the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response...

CVE-2026-67409 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CWE-252. the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response...

PT-2026-98918

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.17 RabbitMQ versions 4.0.0 through 4.0.22 RabbitMQ versions 4.1.0 through 4.1.13 RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2 Description The JWKS key fetching mechanism in...

WsgiDAV MySQL provider has a blind SQL injection

SummaryThe sample MySQLBrowserProvider builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are...

TencentOS Server 2: postfix (TSSA-2026:0939)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0939 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

CVE-2026-55509

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups

Impact The several endpoints could leak object existence information to users who had no access to it by HTTP status code 403 instead of 404. Patches https://github.com/WeblateOrg/weblate/pull/19971 References Thanks to Yaohui Wang for reporting this via GitHub...