CVE-2026-86095

A flaw was found in netcdf-c. An attacker can craft a malicious HDF5 Hierarchical Data Format 5 file with an oversized attribute name. When an application processes this file and attempts to enumerate attribute names, the oversized name can cause an out-of-bounds write, leading to memory corrupti...

CVE-2026-96256

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping ...

CVE-2026-96256

The Gutenberg Essential Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 6.4.5 . The flaw resides in the Google Map block's 'marker' attribute due to inadequate input sanitization and output escaping of marker title and content values....

CVE-2026-96256 Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping ...

CLEANSTART-2026-HK83739 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Security vulnerability affects the cri-tools package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

Rocky Linux 8 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource (crlsa-2026_17481)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202617481 advisory. rsync: Rsync: Use-after-free vulnerability in extended attribute handling CVE-2026-41035 Tenable has extracted the preceding description block directly from the CI...

AlmaLinux 9.2 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.2:CLSA-2026:1779122132)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779122132 advisory. - In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized...

Rocky Linux 9 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc Multiple Vulnerabilities (crlsa-2026_19189)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619189 advisory. tornado-python: Tornado: Denial of Service via large multipart bodies CVE-2026-31958 tornado: Tornado: Cookie attribute injection due to improper handling...

Rocky Linux 9 [CIQ] Security Update: glib2 / glib2-debuginfo / glib2-debugsource / glib2-devel / etc Multiple Vulnerabilities (crlsa-2026_15971)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202615971 advisory. glib: GLib: Buffer underflow in GVariant parser leads to heap corruption CVE-2025-14087 glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap...

Rocky Linux 8 [CIQ] Security Update: fence-agents-aliyun / fence-agents-aliyun-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_2968)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242968 advisory. urllib3: Request body not stripped after redirect from 303 status changes request method to GET CVE-2023-45803 pycryptodome: side-channel leakage for OAEP...

Rocky Linux 10.2 [CIQ] Security Update: p11-kit / p11-kit-client / p11-kit-client-debuginfo / etc (crlsa-2026_49668)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202649668 advisory. p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing CVE-2026-13757 Tenable has extracted the preceding description block directly from th...

AlmaLinux 9.2 [TuxCare] Security Update: perl-DBI Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786120315)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786120315 advisory. - DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a...

Rocky Linux 8 [CIQ] Security Update: python3-jinja2 (crlsa-2024_4231)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20244231 advisory. jinja2: accepts keys containing non-attribute characters CVE-2024-34064 Tenable has extracted the preceding description block directly from the CIQ security advisor...

Rocky Linux 8 [CIQ] Security Update: python3-jinja2 (crlsa-2024_3102)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20243102 advisory. jinja2: HTML attribute injection when passing user input as keys to xmlattr filter CVE-2024-22195 Tenable has extracted the preceding description block directly fro...

Rocky Linux 9 [CIQ] Security Update: python3-jinja2 (crlsa-2024_9150)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20249150 advisory. jinja2: accepts keys containing non-attribute characters CVE-2024-34064 Tenable has extracted the preceding description block directly from the CIQ security advisor...

Rocky Linux 9 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc (crlsa-2024_3820)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243820 advisory. jinja2: accepts keys containing non-attribute characters CVE-2024-34064 This advisory is provided by Ctrl IQ, Inc for Rocky Linux systems. For more information abou...

Rocky Linux 9 [CIQ] Security Update: perl-DBI / perl-DBI-debuginfo / perl-DBI-debugsource (crlsa-2026_66179)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202666179 advisory. DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-19546 Tenable has extracted the preceding...

CentOS Linux 8.5 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.5:CLSA-2026:1779184141)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1779184141 advisory. - In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized...

CentOS Linux 8.4 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.4:CLSA-2026:1779183767)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1779183767 advisory. - In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized...

Rocky Linux 9 [CIQ] Security Update: perl-DBI / perl-DBI-debuginfo / perl-DBI-debugsource Multiple Vulnerabilities (crlsa-2026_49612)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202649612 advisory. DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-14380 DBI: DBI: Heap overflow when preparsing SQL statements with...