RLSA-2026:60004 Low: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 For more details about the securit...

httpd security update

An update is available for httpd. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd packages provide the Apache HTTP Server, a powerful, efficient, and...

httpd security update

An update is available for httpd. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd packages provide the Apache HTTP Server, a powerful, efficient, and...

httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration

A flaw was found in Apache HTTP Server when using the modldap module in a per-directory configuration. This use-after-free vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial of service DoS due to improper memory handling. This could lead to system...

CVE-2026-58094 TOCTOU race in POSIX shared memory large page configuration

The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...

CVE-2026-58094 TOCTOU race in POSIX shared memory large page configuration

The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding t...

SUSE CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

AlmaLinux 9 : httpd (ALSA-2026:59347)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:59347 advisory. httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 Tenable has...

PT-2026-82098

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.9 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0 Description An authenticated user with developer-role permissions can execute arbitrary commands within a CI context. This...

CVE-2026-75338

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

CVE-2026-75363

The Comfast CF-WR630AX v.2.7.0.2 contains a vulnerability that allows a remote attacker to achieve arbitrary code execution . The flaw is accessible via the /usr/bin/webmgnt and /cgi-bin/mbox-config endpoints, specifically through the timestr and display_n parameters. Proof-of-concept (PoC) explo...

EUVD-2026-66743

An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, displayn...

PT-2026-82302

An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, display n...

PT-2026-82297

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.7 Description The REST API fails to properly enforce the scope of project- and workspace-scoped teams. This allows a user to submit invalid team configurations, enabling them to assign projects to a team via...

PT-2026-82231

Name of the Vulnerable Software and Affected Versions Spring Cloud Config versions 5.0.0 through 5.0.4 Spring Cloud Config versions 4.3.0 through 4.3.4 Spring Cloud Config versions 4.0.0 through 4.2.8 Spring Cloud Config versions 3.1.14 and earlier Description The base directory used by the Sprin...

RHEL 10 : httpd (RHSA-2026:60004)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:60004 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP Server:...

RockyLinux 9 : httpd (RLSA-2026:59347)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:59347 advisory. httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 Tenable has...

CVE-2026-75363

An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, displayn...

CVE-2026-75363

An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, displayn...

PT-2026-82232

Name of the Vulnerable Software and Affected Versions Spring Spring Cloud Config versions 3.x through 3.1.14 Spring Spring Cloud Config versions 4.0.0 through 4.2.8 Spring Spring Cloud Config versions 4.3.0 through 4.3.4 Spring Spring Cloud Config versions 5.0.0 through 5.0.4 Description Missing...