CVE-2026-102580: Use of Externally-Controlled Input to Select Classes or Code

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected...

CVE-2026-102998: Uncontrolled Resource Consumption

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/appearancestream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled,...

CVE-2026-102994: Uncontrolled Resource Consumption

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/reader.py and pypdf/generic/base.py to scan excessive input through...

AlmaLinux 9.2 [TuxCare] Security Update: nautilus / nautilus-devel / nautilus-extensions (ALMALINUX9.2:CLSA-2026:1790071074)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790071074 advisory. - GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive. CVE-2022-37290 Note that...

Rocky Linux 9.6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (ALMALINUX9.6:CLSA-2026:1790263653)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790263653 advisory. - In PHP versions 8.2. before 8.2.32, 8.3. before 8.3.32, 8.4. before 8.4.23, 8.5. before 8.5.8, the AES-WRAP-PAD algorithm implementation ...

AlmaLinux 9.2 [TuxCare] Security Update: qt5-qtbase / qt5-qtbase-common / qt5-qtbase-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1764026530)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764026530 advisory. - In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReade...

AlmaLinux 9.6 [TuxCare] Security Update: tar (ALMALINUX9.6:CLSA-2026:1778828497)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778828497 advisory. - In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. CVE-2023-39804 Note...

Rocky Linux 9.6 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc (ALMALINUX9.6:CLSA-2026:1777056907)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777056907 advisory. - In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an...

AlmaLinux 9.2 [TuxCare] Security Update: ncurses / ncurses-base / ncurses-c++-libs / ncurses-compat-libs / etc (ALMALINUX9.2:CLSA-2025:1739387560)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1739387560 advisory. - ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security- relevant memory corruption via...

CentOS Linux 8.4 [TuxCare] Security Update: tar (CENTOS8.4:CLSA-2025:1762536241)

The CentOS Linux 8.4 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2025:1762536241 advisory. - In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. CVE-2023-39804 Note...

AlmaLinux 9.6 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc (ALMALINUX9.6:CLSA-2026:1777056907)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777056907 advisory. - In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an applicatio...

Rocky Linux 9.6 [TuxCare] Security Update: nautilus / nautilus-devel / nautilus-extensions (ALMALINUX9.6:CLSA-2026:1788694397)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788694397 advisory. - GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive. CVE-2022-37290 Note tha...

AlmaLinux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1776760883)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776760883 advisory. - A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malforme...

Prototype pollution in chart configuration and component i18n

The deep merge helpers in Vaadin Charts and in the i18n support of Vaadin components copy properties without filtering keys that address the prototype chain, so merging data the application does not control can add properties to Object.prototype and make them visible to every object in the runnin...

VulnCheck KEV: CVE-2024-49766

Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...

CentOS Linux 8.5 [TuxCare] Security Update: php-cli / php-common / php-dba / php-fpm / php-mbstring / etc (CENTOS8.5:CLSA-2025:1749743798)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1749743798 advisory. - The zendstringextend function in Zend/zendstring.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negativ...

CentOS Linux 8.4 [TuxCare] Security Update: php / php-dba / php-devel / php-enchant / php-fpm / php-gd / etc (CENTOS8.4:CLSA-2025:1749743304)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2025:1749743304 advisory. - The zendstringextend function in Zend/zendstring.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negativ...

AlmaLinux 9.2 [TuxCare] Security Update: openjpeg2 / openjpeg2-devel / openjpeg2-devel-docs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1779825752)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779825752 advisory. - A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified whi...

CentOS Linux 8.5 [TuxCare] Security Update: tar (CENTOS8.5:CLSA-2025:1762535960)

The CentOS Linux 8.5 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1762535960 advisory. - In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c. CVE-2023-39804 Note...

CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (CENTOS-STREAM8:CLSA-2026:1772813746)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1772813746 advisory. - The izvalptrdtor function in Zend/zendvariables.h in PHP 7.1.5 allows attackers to cause a denial of service memory consumption and...