CentOS Linux 8 [TuxCare] Security Update: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1783944511)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1783944511 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster...

AlmaLinux 9.2 [TuxCare] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1771321434)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1771321434 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component...

Linux Distros Unpatched Vulnerability : CVE-2026-47594

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by issuing a sequence o...

Rocky Linux 9.6 [TuxCare] Security Update: podman / podman-docker / podman-plugins / podman-remote / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784155512)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784155512 advisory. - The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large...

CentOS Linux 7 [TuxCare] Security Update: bpftool / kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2025:1759431860)

"The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1759431860 advisory. - In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix possible use-after-free by calling deltimersync Thi...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc (ALMALINUX9.2:CLSA-2025:1766568231)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1766568231 advisory. - The issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and...

Kibana 8.x < 8.19.22 / 9.0.x < 9.4.7 / 9.5.x < 9.5.3 Missing Authorization (ESA-2026-139)

The version of Kibana installed on the remote host is 8.x prior to 8.19.22, or 9.0.x prior to 9.4.7, or 9.5.x prior to 9.5.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-139 advisory. - Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of da...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1777944610)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777944610 advisory. - When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. ...

RHEL 8 : ruby:2.5 (RHSA-2026:73519)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73519 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...

CentOS Linux 7 [TuxCare] Security Update: rpm / rpm-apidocs / rpm-build / rpm-build-libs / rpm-cron / etc (CENTOS7:CLSA-2026:1777545003)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777545003 advisory. - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a binding signature. RPM does not check...

AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.2:CLSA-2025:1764858279)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764858279 advisory. - jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data Processor. In versions...

AlmaLinux 9.2 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786466122)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786466122 advisory. - A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove...

CentOS Linux 6 [TuxCare] Security Update: java-1.7.0-openjdk / java-1.7.0-openjdk-demo / etc (CENTOS6:CLSA-2026:1790152236)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1790152236 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: ImageIO...

Helol Tunnel: Covert Channel Exploitation of TLS Extensibility and Privacy Features

Covert channels exploiting network protocols for data exfiltration and command-and-control C2 are integral parts of modern cyberattacks. In search of a significant covert channel within the fabric of the Internet, we targeted the combinatorial properties of the Client Hello CHLO packets in the...

PT-2026-103026

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

CVE-2026-102091: Server-Side Request Forgery (SSRF)

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

CVE-2026-47494: Use of Externally-Controlled Format String

NVIDIA GPU Display Driver for Linux contains a vulnerability where a user might be able to cause a format string issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure...

CVE-2026-47554: Improper Verification of Cryptographic Signature

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where improper verification of cryptographic signatures may cause signature verification to be bypassed under memory pressure. A successful exploit of this vulnerability might lead to denial of service and data...

CVE-2026-47562: Improper Encoding or Escaping of Output

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vulnerability might lead to denial of service and data...

CVE-2026-47587: Use After Free

NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering...