AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779787578)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779787578 advisory. - Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control li...

CentOS Linux 6 [TuxCare] Security Update: cups / cups-devel / cups-libs / cups-lpd / cups-php (CENTOS6:CLSA-2026:1778142413)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1778142413 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon...

RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 6.2.5 (RHSA-2026:73981)

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73981 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised ...

Rocky Linux 8 [CIQ] Security Update: device-mapper-multipath / device-mapper-multipath-debuginfo / etc (crlsa-2022_7192)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227192 advisory. device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket CVE-2022-41974 Tenable has extracted the...

Rocky Linux 8 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc Multiple Vulnerabilities (crlsa-2023_3839)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20233839 advisory. libssh: NULL pointer dereference during rekeying with algorithm guessing CVE-2023-1667 libssh: authorization bypass in pkiverifydatasignature CVE-2023-2283...

Rocky Linux 9 [CIQ] Security Update: opentelemetry-collector Multiple Vulnerabilities (crlsa-2026_19353)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619353 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go:...

Rocky Linux 9 [CIQ] Security Update: OpenIPMI / OpenIPMI-debuginfo / OpenIPMI-debugsource / etc (crlsa-2024_8037)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20248037 advisory. openipmi: missing check on the authorization type on incoming LAN messages in IPMI simulator CVE-2024-42934 Tenable has extracted the preceding description block...

grafana: grafana: Authorization bypass via missing destination folder permission check

A flaw was found in Grafana. The application fails to verify creation permissions on destination folders during panel update operations. An authenticated user with edit permissions in one folder can exploit this vulnerability through the library elements API to move a library panel into a folder...

rsync: rsync: Authorization bypass via `auth users` directive parsing

An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain...

CLEANSTART-2026-TD03320 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

Security vulnerability affects the containerd package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...

CVE-2026-101880 OpenClaw Windows Node before 2026.7.1 Authorization Bypass

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing...

CVE-2026-101880

OpenClaw Windows Node versions before 2026.7.1 are vulnerable to an authorization bypass in the system.run exec-approval policy. The root cause is that the ExecShellWrapperParser fails to correctly split commands on pipe operators or extract command substitutions. This allows connected gateways o...

CVE-2026-101880 OpenClaw Windows Node before 2026.7.1 Authorization Bypass

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing...

CVE-2026-101880 OpenClaw Windows Node before 2026.7.1 Authorization Bypass

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing...

CVE-2026-103446

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46...

CVE-2026-103233

A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unknown function of the file /admin/ of the component Admin Area. Such manipulation of the argument ID leads to authorization bypass. The attac...

EUVD-2026-90199

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46...

Security Bulletin: Vulnerabilities in Angular,Netty,snakeYAML,Next.js might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Angular,Netty,snakeYAML,Next.js. Vulnerabilities include high-severity information disclosure vulnerability, allowing attackers to find hash collisions, uncontrolled resource consumption which lead to a Denial...

CVE-2026-53718

A flaw was found in Envoy Gateway. An attacker could exploit a vulnerability in how HTTPRoute handles custom backend references. This allows a route-owning namespace to access and utilize resources in another namespace without proper authorization, bypassing the intended Gateway API cross-namespa...

CVE-2026-103233 AdithyaYelloju Restaurant-Management-System Admin Area admin authorization

A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unknown function of the file /admin/ of the component Admin Area. Such manipulation of the argument ID leads to authorization bypass. The attac...