Rocky Linux 9.4 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ciqsa-2026_0583)

The Rocky Linux 9.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260583 advisory. This advisory aggregates security fixes for the tomcat SRPM in CIQ LTS 9.4. It addresses 2 CVEs: CVE-2025-24813, CVE-2024-50379. Tenable has extracted th...

AlmaLinux 9 : gvfs (ALSA-2026:74370)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:74370 advisory. gvfs: SFTP: heap-based buffer overflow in readreply CVE-2026-84268 gvfs: gvfs-admin socket ownership race permits local root CVE-2026-88924 Tenable has...

Rocky Linux 10.0 [CIQ] Security Update: ipa-client / ipa-client-common / ipa-client-debuginfo / etc (crlsa-2025_9190)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259190 advisory. freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA CVE-2025-4404 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 10.1 [CIQ] Security Update: ipa-client / ipa-client-common / ipa-client-debuginfo / etc (crlsa-2025_20994)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202520994 advisory. FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA CVE-2025-7493 Tenable has extracted the preceding description block directly from the CI...

CVE-2026-103284: Incorrect Authorization

Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data. Attackers with staff privileges can query the feedback endpoint to retrieve sensitive member information without...

PT-2026-103810

Name of the Vulnerable Software and Affected Versions Ghost versions 5.8.0 through 6.33.x Description An input validation issue exists within the admin iframe. Attackers possessing content publishing privileges can create malicious pages that, when accessed by active staff users, facilitate the...

CVE-2026-55230: Improper Neutralization of Input During Web Page Generation

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content...

CVE-2026-55231: Improper Limitation of a Pathname to a Restricted Directory

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access default role siteadmin or higher read and delete arbitrary files on a...

PT-2026-103975

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access default role site admin or higher read and delete arbitrary files on a...

Rocky Linux 8.8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ciqsa-2026_1110)

The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261110 advisory. This advisory aggregates security fixes for the tomcat SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2024-34750. Tenable has extracted the preceding description...

Rocky Linux 8.8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ciqsa-2026_0333)

The Rocky Linux 8.8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260333 advisory. This advisory aggregates security fixes for the tomcat SRPM in CIQ LTS 8.8. It addresses 3 CVEs: CVE-2024-23672, CVE-2025-24813, CVE-2024-24549. Tenable...

Rocky Linux 8.8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ciqsa-2026_1019)

The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261019 advisory. This advisory aggregates security fixes for the tomcat SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2023-46589. Tenable has extracted the preceding description...

PT-2026-103969

🚨 CVE-2026-104059 Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, ...

PT-2026-103974

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content...

CVE-2026-104059: Cross-Site Request Forgery (CSRF)

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CentOS Linux 7 [TuxCare] Security Update: sos (CENTOS7:CLSA-2026:1779212011)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1779212011 advisory. - It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el86,...

RockyLinux 9 : pki-core (RLSA-2026:73766)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:73766 advisory. pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content ExternalProcessConstraint CVE-2026-76561 pki-core: Dogtag...

ALSA-2026:74370 Important: gvfs security update

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol FTP, Secure Shell File Transfer Protocol SFTP, Web Distributed Authoring and Versioning WebDAV, Common Internet File System CIFS, Server Message Block SMB, and...

Important: gvfs security update

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol FTP, Secure Shell File Transfer Protocol SFTP, Web Distributed Authoring and Versioning WebDAV, Common Internet File System CIFS, Server Message Block SMB, and...

Rocky Linux 9.6 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ciqsa-2026_1496)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261496 advisory. This advisory aggregates security fixes for the tomcat SRPM in CIQ LTS 9.6. It addresses 37 CVEs: CVE-2016-5425, CVE-2024-23672, CVE-2018-1304,...