Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc (crlsa-2026_3638)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20263638 advisory. nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections CVE-2026-1642 Tenable has extracted the preceding description block directly fr...

Rocky Linux 9.6 [TuxCare] Security Update: coreutils / coreutils-common / coreutils-single (ALMALINUX9.6:CLSA-2026:1783532249)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783532249 advisory. - A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access...

AlmaLinux 9.6 [TuxCare] Security Update: coreutils / coreutils-common / coreutils-single (ALMALINUX9.6:CLSA-2026:1783532249)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783532249 advisory. - A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access...

AlmaLinux 9.2 [TuxCare] Security Update: coreutils / coreutils-common / coreutils-single (ALMALINUX9.2:CLSA-2026:1783530353)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783530353 advisory. - A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access...

PT-2026-103829

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.3.0 through 3.6.x Description An issue exists where a request's authorization scope could persist into subsequent requests on the same route when using a supported authz-keycloak configuration. This leads to unintended...

hip-data-ml-utils (>=1.0.1, <=1.0.2), pytoil (0.35.0) potentially affected by CVE-2026-102930 via virtualenv (20.16.3)

virtualenv PYPI version 20.16.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hip-data-ml-utils =1.0.1, =1.0.2 - pytoil 0.35.0 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

aptos-verify (1.0.4), halludetector (0.0.2) +3 more potentially affected by CVE-2026-102930 via virtualenv (20.24.6)

virtualenv PYPI version 20.24.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aptos-verify 1.0.4 - halludetector 0.0.2 - kit-big-data-to-do-list =1.1.0, =1.2.3, =2.2.1 - pytoil 0.40.0 Source cves: CVE-2026-102930...

EUVD-2026-70984

fastify vulnerable to request body replacement via an async validation result collision...

grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards

A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw to retrieve...

CVE-2026-51867

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...

CVE-2026-102140

An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the...

CVE-2026-102125

The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could...

CVE-2026-102109

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitatio...

CVE-2026-102098

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service...

CVE-2026-102091

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

CVE-2026-102997

A flaw was found in pypdf. A remote attacker can exploit this vulnerability by providing a crafted PDF document containing a partially malformed FlateDecode data compression stream. When processing the malformed stream, the application triggers an inefficient recovery routine that consumes...

CVE-2026-102109 Kiteworks Secure Data Forms SQL injection

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitatio...

CVE-2026-102109 Kiteworks Secure Data Forms SQL injection

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitatio...

EUVD-2026-90310

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitatio...

CVE-2026-102109

A SQL injection vulnerability exists in Kiteworks Secure Data Forms . The root cause is the improper sanitization of a value derived from an authenticated user's stored account data when incorporated into a database query. Exploitation requires an authenticated session and is only applicable to d...