AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792762308)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792762308 advisory. - In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous access b/w reset and tm thread for...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792762308)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792762308 advisory. - In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Synchronous access b/w reset and tm thread for...

PT-2026-122415

Summary /api/filetree/authFilePublishAccess is registered with CheckAuth only and is reachable anonymously. It never sets a failure code, so its outcome is signalled entirely by the response message and by whether a Set-Cookie header is present. Those two signals differ across access tiers, which...

PT-2026-122418

On Windows the soft locks SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each acquire attempt that finds a marker opens it with...

PT-2026-122420

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file like their pages where the same, but non-existent indirect object is referenced multiple times. Patches This has been fixed in pypdf==6.21.2. Workarounds If...

PT-2026-122155

Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll tick including .tick.await and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The ra...

PT-2026-122207

Name of the Vulnerable Software and Affected Versions virtualenv versions 21.14.9 through 21.14.12 Description The bash bin/activate script fails to properly escape dollar signs and backticks when copying the --prompt value into the PS1 environment variable, provided that promptvars and POSIX mod...

PT-2026-122218

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description An issue exists in the twisted.mail.imap4.IMAP4Server where the twisted.mail.imap4.parseNestedParens function can be reached with a negative literal size during an authenticated SEARCH command...

PT-2026-122219

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description The twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. Because the parser retain...

PT-2026-122220

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description An unbounded-buffer issue exists in the Twisted words IRC server where the dataReceived function in twisted.words.protocols.irc.IRC appends all received bytes to a per-connection buffer without...

PT-2026-122221

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description An unauthenticated remote peer can cause memory exhaustion leading to a denial of service. The issue occurs in the twisted.conch.telnet.Telnet.dataReceived function, which appends bytes received...

PT-2026-122224

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 26.10.0rc1 Description An incomplete header-value validation in the Twisted HTTP server allows a bare carriage return CR or line feed LF in a header value to hide a subsequent header from the parser. The function...

PT-2026-122239

Name of the Vulnerable Software and Affected Versions happy-dom versions 17.0.0 through 21.0.3 Description The ESM compiler in packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts fails to validate named ESM import aliases before inserting them into generated destructuring bindings. When...

PT-2026-122240

Name of the Vulnerable Software and Affected Versions serialize-javascript versions prior to 7.1.3 Description The software fails to properly neutralize a bare closing-script prefix when the source text of a function ends exactly with that prefix. Because function bodies are escaped independently...

PT-2026-122410

Impact A single request can crash any application using body-parser with default options. When a request carries a Content-Encoding for example gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one val...

PT-2026-122419

Summary On the multi-threaded runtime, there is a race condition between Interval::poll tick and the runtime's time driver. This affects Interval only. Sleep and Timeout are not affected. Details In Tokio v1.54.0, a race condition between tokio::time::Interval::poll tick including .tick.await and...

PT-2026-122447

Impact Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth code flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the auth code to to...

PT-2026-122458

On Windows the soft locks SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each acquire attempt that finds a marker opens it with...

CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1792759740)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1792759740 advisory. - In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent UAF when applicant...

Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x / 12.2.x Multiple Vulnerabilities

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x, 12.1.x, or 12.2.x. It is, therefore, affected by multiple vulnerabilities. Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619...