CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1793362651)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1793362651 advisory. - In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2qddealloc gfs2qddealloc,...

OpenWRT uhttpd input validation error vulnerability

OpenWRT uhttpd contains an input validation error vulnerability. This vulnerability arises because the uhubusdatasend function in ubus.c fails to synchronize the HTTP request boundaries when multiple TCP segments of the JSON request body arrive for POST /ubus. As a result, the remaining...

RHEL 9 : kernel-rt (RHSA-2026:93047)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93047 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

SUSE SLES16 Security Update : kernel (SUSE-SU-2026:24437-1)

The remote SUSE Linux SLES16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24437-1 advisory. The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-31731:...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793333110)

"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793333110 advisory. - In the Linux kernel, the following vulnerability has been resolved: dma-debug: don't call dmaentryalloccheckleak under...

PT-2026-134410

Summary AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask and the masked value in every token. This allows any observer who sees a single CSRF token via network sniffing, log files, Referrer header, or XSS to instantly recove...

PT-2026-133690

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, wi...

Blender buffer error vulnerability

Versions prior to Blender 4.5.15 and versions prior to 5.2.3 contain a buffer error vulnerability. This vulnerability arises because the readfiledna function fails to validate the declared length of GLOB block fields when reading them; as a result, attackers can trigger heap-based out-of-bounds...

AdminNeo: version-cache array injection causes persistent denial of service

AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version parameter which PHP converts to an...

CVE-2026-111500: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function…

Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Server-side request forgery...

Google Chrome Microsoft Edge Navigation XSS

The vulnerability in the Navigation function of Google Chrome and Microsoft Edge is related to authorization errors. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information and trigger a denial-of-service condition via a specially crafted HTML page...

Tesseract-OCR Tesseract buffer error vulnerability

A security vulnerability exists in Tesseract OCR versions 5.4.0 through 5.5.4. This vulnerability stems from the AppendLinePolygon function in src/api/pagerenderer.cpp, which accepts and destroys a left-to-right Pta accumulator owned by the caller via a parameter. As a result, linetoprtlpts and...

Medium: libreswan

Issue Overview: In Libreswan before 5.3.2, when the operating system and Libreswan are running in FIPS mode and at least one CA certificate is loaded, a malformed X.509 certificate payload can cause the pluto daemon to abort on an assertion. In FIPS mode, adddecodedcert calls CERTExtractPublicKey...

PT-2026-134184

Name of the Vulnerable Software and Affected Versions Tesseract versions 5.4.0 through 5.5.3 Description The AppendLinePolygon function in src/api/pagerenderer.cpp destroys a caller-owned right-to-left Pta accumulator when it is received by value. This results in line top rtl pts and line bottom...

Beatriceodera cak-filemanagement-system arbitrary file upload vulnerability

The Beatriceodera cak-filemanagement-system versions 5e6433246475e66462e1fea980688de96a049297 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the File parameter in the moveuploadedfile function within the admin/addlogs.php file, potentially allowin...

i18next input validation error vulnerability

Versions of i18next prior to 26.3.4 contain a security vulnerability. This vulnerability arises because the deepExtend function in src/utils.js utilizes the in operator to check for the existence of properties, and recursively accesses built-in objects inherited through Object.prototype. When an...

PT-2026-133640

Name of the Vulnerable Software and Affected Versions InternLM LMDeploy versions 0.9.0 through 0.18.0 Description An unauthenticated remote attacker can execute arbitrary operating system commands with the privileges of the api server process. This occurs when the server receives specially crafte...

PT-2026-134179

Name of the Vulnerable Software and Affected Versions deadtrickster ssl verify fun versions 1.0.1 through 1.1.7 Description Improper validation of certificates with host mismatches allows an adversary in the middle to impersonate a TLS peer using a certificate with a partial-label wildcard. The t...

PT-2026-134232

Name of the Vulnerable Software and Affected Versions LubeLogger versions prior to 1.6.8 Description An authenticated user can cause cross-user disclosure of vehicle maintenance records. The PrintRecordStickers function in /Controllers/VehicleController.cs verifies if the caller can view the...

Red Hat Enterprise Linux race condition vulnerability

A race condition vulnerability exists in Red Hat Enterprise Linux kernel versions 9.6 through 9.10. This vulnerability stems from an imbalance in localbh within the seg6inputcore function; when returning from a discard path, the lower half remains disabled, potentially leading to softirq starvati...