Rocky Linux 8 [CIQ] Security Update: python3.11 / python3.11-debug / python3.11-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_4473)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20264473 advisory. cpython: wsgiref.headers.Headers allows header newline injection in Python CVE-2026-0865 cpython: IMAP command injection in user-controlled commands...

Rocky Linux 8 [CIQ] Security Update: python3.11 / python3.11-debug / python3.11-debuginfo / etc (crlsa-2026_6281)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20266281 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly from...

Rocky Linux 8 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2026_6283)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20266283 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly from...

Rocky Linux 9 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_4165)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20264165 advisory. cpython: IMAP command injection in user-controlled commands CVE-2025-15366 cpython: POP3 command injection in user-controlled commands CVE-2025-15367...

Rocky Linux 9 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (crlsa-2026_4168)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20264168 advisory. cpython: IMAP command injection in user-controlled commands CVE-2025-15366 cpython: POP3 command injection in user-controlled commands CVE-2025-15367...

Rocky Linux 9 [CIQ] Security Update: python3.11 / python3.11-debug / python3.11-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_4216)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20264216 advisory. cpython: IMAP command injection in user-controlled commands CVE-2025-15366 cpython: POP3 command injection in user-controlled commands CVE-2025-15367...

Rocky Linux 9 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2026_6285)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20266285 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly from...

Rocky Linux 9 [CIQ] Security Update: python3.11 / python3.11-debug / python3.11-debuginfo / etc (crlsa-2026_6286)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20266286 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly from...

Rocky Linux 9 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc (crlsa-2026_6766)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20266766 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly from...

EUVD-2026-89206

russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened...

K000163493: PostGreSQL vulnerability CVE-2026-6464

Security Advisory Description Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input...

K000163492: Vim vulnerabilities CVE-2026-73070, CVE-2026-73076, CVE-2026-73077, and CVE-2026-73078

Security Advisory Description CVE-2026-73070 Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserveraccept, causing descriptors to overflow fdset structures in src/channel.c and...

rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths

A command injection vulnerability in rsync allows remote attackers to execute arbitrary commands by supplying shell metacharacters or newlines in unsanitized inputs, such as hostnames or hostspecs. This impacts multiple vectors—including the RSYNCCONNECTPROG variable, daemon hooks, rsync-ssl, and...

Important: Red Hat Security Advisory: rsync security, bug fix, and enhancement update

An update for rsync is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-51870

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute...

CVE-2026-51858

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shellexec allows prompt-driven shell command execution without an approval boundary...

CVE-2026-102136

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be...

CVE-2026-102133

An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned...

CVE-2026-102114

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Successful exploitation requires an administrative account with elevated privileges...

CVE-2026-102096

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...