Rocky Linux 10.2 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_22120)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202622120 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass...

PT-2026-105857

Impact When reading a suitably crafted PRX or STX file, MPXJ can be made to write files to arbitrary locations in the file system. Patches This issue is addressed in MPXJ version 16.5.0. Workarounds Do not read PRX or STX files from untrusted sources...

Rocky Linux 10.1 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_5941)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20265941 advisory. cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61731 net/url: Incorrect parsing of IPv6 host literals in net/url...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2026_22112)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202622112 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass du...

AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788888956)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788888956 advisory. - rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter...

Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789462227)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789462227 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended modul...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging Multiple Vulnerabilities (crlsa-2020_0579)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20200579 advisory. nodejs: HTTP request smuggling using malformed Transfer-Encoding header CVE-2019-15605 nodejs: Remotely trigger an assertion on a TLS server with a malform...

AlmaLinux 9.2 [TuxCare] Security Update: squashfs-tools (ALMALINUX9.2:CLSA-2025:1750782908)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1750782908 advisory. - squashfsopendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / etc Multiple Vulnerabilities (crlsa-2023_7258)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237258 advisory. dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand CVE-2023-36049 dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor...

Rocky Linux 8 [CIQ] Security Update: sudo / sudo-debuginfo / sudo-debugsource (crlsa-2023_0284)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230284 advisory. sudo: arbitrary file write with privileges of the RunAs user CVE-2023-22809 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: sudo / sudo-debuginfo / sudo-debugsource / sudo-python-plugin / etc (crlsa-2023_0282)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230282 advisory. sudo: arbitrary file write with privileges of the RunAs user CVE-2023-22809 Tenable has extracted the preceding description block directly from the CIQ security...

Fortinet FortiMail Path Traversal Vulnerability

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests...

PT-2026-104044

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.8.5 Description A directory traversal flaw exists where a public-facing HTTP route handler forwards attacker-controlled paths or filenames into host file creation without boundary enforcement. This allo...

Rocky Linux 10.2 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc Multiple Vulnerabilities (crlsa-2026_70201)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202670201 advisory. podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 podman: Go net/http: Unencrypted HTTP/...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc Multiple Vulnerabilities (crlsa-2026_69961)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202669961 advisory. podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 podman: golang net/url: Denial of Service from quadratic...

rsync: rsync: Directory escape via TOCTOU race condition in rrsync

A time-of-check to time-of-use TOCTOU race condition flaw in the rrsync restricted shell wrapper allows authenticated remote attackers to escape directory restrictions. By replacing a validated path component with a symbolic link prior to file transfer execution, an attacker can bypass intended...

rsync: rsync: Arbitrary file write via path traversal in --relative mode

A path traversal vulnerability in rsync's --relative mode allows a malicious sender to craft symlink paths, enabling arbitrary file writes outside the destination directory...

rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options

A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the --temp-dir or --link-dest options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree,...

Important: Red Hat Security Advisory: rsync security, bug fix, and enhancement update

An update for rsync is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-102146

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could ...