Rocky Linux 8 [CIQ] Security Update: clang / clang-analyzer / clang-debuginfo / clang-debugsource / etc (crlsa-2021_4743)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214743 advisory. Developer environment: Unicode's bidirectional BiDi override characters can cause trojan source attacks CVE-2021-42574 The following changes were introduced in clan...

tidy-html5:tidy_general_fuzzer: Crash in tidy_general_fuzzer

Project: https://github.com/htacg/tidy-html5.git Detailed Report: https://oss-fuzz.com/testcase?key=5244629235335168 Project: tidy-html5 Fuzzing Engine: libFuzzer Fuzz Target: tidygeneralfuzzer Job Type: libfuzzerubsantidy-html5 Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address:...

CVE-2026-13051 Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to adderror as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes...

CVE-2026-13051

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to adderror as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes...

CVE-2026-13051

The Form::Processor::Field::HtmlArea component for Perl (versions 0.06 through 1.162360) is vulnerable to attacker-selected method dispatch and resource exhaustion. The root cause lies in the validate() function, which processes submitted markup via HTML::Tidy and passes resulting diagnostics to ...

CVE-2026-13051: Improper Neutralization of Special Elements Used in a Template Engine

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to adderror as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passes...

PT-2026-71695

Name of the Vulnerable Software and Affected Versions Form::Processor::Field::HtmlArea versions 0.06 through 1.162360 Description An issue exists where the validate function processes submitted markup using HTML::Tidy and passes the resulting messages to the add error function. These messages are...

ansible-doctor (>=8.3.1, <=8.3.3), ansys-pre-commit-hooks (0.8.0) +50 more potentially affected by CVE-2026-67324 via gitpython (3.1.50)

gitpython PYPI version 3.1.50 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - ansible-doctor =8.3.1, =1.1.0, =0.5.0, =0.1.0, =0.3.0, =2.0.0b2, =1.2.1, =6.62.4, =5.1.7, =5.1.9 and more Source cves: CVE-2026-67324 Source...

ansible-doctor (>=8.3.1, <=8.3.3), ansys-pre-commit-hooks (0.8.0) +50 more potentially affected by CVE-2026-67324 via gitpython (3.1.50)

gitpython PYPI version 3.1.50 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - ansible-doctor =8.3.1, =1.1.0, =0.5.0, =0.1.0, =0.3.0, =2.0.0b2, =1.2.1, =6.62.4, =5.1.7, =5.1.9 and more Source cves: CVE-2026-67324 Source...

ansible-doctor (>=8.3.1, <=8.3.3), ansys-pre-commit-hooks (0.8.0) +50 more potentially affected by CVE-2026-67324 via gitpython (3.1.50)

gitpython PYPI version 3.1.50 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - ansible-doctor =8.3.1, =1.1.0, =0.5.0, =0.1.0, =0.3.0, =2.0.0b2, =1.2.1, =6.62.4, =5.1.7, =5.1.9 and more Source cves: CVE-2026-67324 Source...

tidy-html5:tidy_config_fuzzer: Null-dereference READ in ubsan_GetStackTrace

Detailed Report: https://oss-fuzz.com/testcase?key=5259059310428160 Project: tidy-html5 Fuzzing Engine: libFuzzer Fuzz Target: tidyconfigfuzzer Job Type: libfuzzerubsantidy-html5 Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: ubsanGetStackTrace...

chaste-codegen (>=0.4.0, <=0.10.2), docker-tidy (>=0.1.0, <=0.1.4) +6 more potentially affected by CVE-2024-5569 via zipp (1.2.0)

zipp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on zipp and may be impacted: - chaste-codegen =0.4.0, =0.1.0, =0.7.10, =1.18.3, =26.0.0, =1.0.4, =1.0.6 - mapyllary 0.0.6 Source cves: CVE-2024-5569 Source advisory: OSV:PYSEC-2026-20...

tidy-html5:tidy_general_fuzzer: Crash in tidy_general_fuzzer

Project: https://github.com/htacg/tidy-html5.git Detailed Report: https://oss-fuzz.com/testcase?key=6410685517725696 Project: tidy-html5 Fuzzing Engine: libFuzzer Fuzz Target: tidygeneralfuzzer Job Type: libfuzzerubsantidy-html5 Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address:...

BIT-GOLANG-2026-42501 Malicious module proxy can bypass checksum database in cmd/go

A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy GOMODPROXY or checksum database GOSUMDB. A malicious module proxy can serve altered versions o...

SUSE CVE-2026-42501

A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy GOMODPROXY or checksum database GOSUMDB. A malicious module proxy can serve altered versions o...

CodeChecker security vulnerabilities

CodeChecker is an open-source analysis tool developed by Ericsson, which includes Clang Static Analyzer and Clang Tidy. It also provides a database of defects and extensions for viewers. Versions of CodeChecker prior to 6.27.3 contained security vulnerabilities. These vulnerabilities stemmed from...

PT-2026-34878

Name of the Vulnerable Software and Affected Versions CodeChecker versions prior to 6.27.4 Description An authentication bypass exists in CodeChecker, an analyzer tooling, defect database, and viewer extension for the Clang Static Analyzer and Clang Tidy. The issue occurs when the URL ends with...

tidy-html5:tidy_general_fuzzer: Heap-use-after-free in CleanTree

Detailed Report: https://oss-fuzz.com/testcase?key=6411373809827840 Project: tidy-html5 Fuzzing Engine: libFuzzer Fuzz Target: tidygeneralfuzzer Job Type: libfuzzerasantidy-html5 Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x7572498e1020 Crash State: CleanTree CleanTr...

tidy-html5:tidy_general_fuzzer: Heap-use-after-free in prvTidyCleanGoogleDocument

Detailed Report: https://oss-fuzz.com/testcase?key=4761751731372032 Project: tidy-html5 Fuzzing Engine: libFuzzer Fuzz Target: tidygeneralfuzzer Job Type: libfuzzerasantidy-html5 Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x76e7f3ae03e8 Crash State:...

tidy-html5:tidy_general_fuzzer: Heap-use-after-free in prvTidyPPrintXMLTree

Detailed Report: https://oss-fuzz.com/testcase?key=6129312603635712 Project: tidy-html5 Fuzzing Engine: libFuzzer Fuzz Target: tidygeneralfuzzer Job Type: libfuzzerasantidy-html5 Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x7c6ec08e0aa8 Crash State:...