Oracle Linux 8 : pki-deps:10.6 (ELSA-2026-90909)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-90909 advisory. - Fix CVE-2026-68498 - Fix CVE-2026-89425 - Fix CVE-2026-91777 - Disallow EventData deserialization by default CVE-2018-8088 Tenable has extracted the...

RLSA-2026:90909 Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fixes: com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing...

pki-deps:10.6 security update

An update is available for pki-servlet-engine, velocity, jackson-databind, module.apache-commons-net, xmlstreambuffer, stax-ex, module.jackson-annotations, module.xml-commons-apis, module.relaxngDatatype, module.jackson-jaxrs-providers, module.jackson-databind, module.velocity, xerces-j2,...

Important: Red Hat Security Advisory: pki-deps:10.6 security update

An update for the pki-deps:10.6 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

com.github.mcollovati:hilla-shaded-deps (>=24.4.0-beta1, <=24.4.2), com.github.mcollovati:quarkus-hilla (>=24.4.0-beta1, <=24.4.2) +7 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin (>=24.4.0, <=24.4.25)

com.vaadin:vaadin MAVEN version =24.4.0, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0, =24.4.1, =24.4.25 Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755465...

com.github.mcollovati:hilla-shaded-deps (>=24.4.0-beta1, <=24.4.2), com.github.mcollovati:quarkus-hilla (>=24.4.0-beta1, <=24.4.2) +7 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin (>=24.4.0, <=24.4.25)

com.vaadin:vaadin MAVEN version =24.4.0, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0, =24.4.1, =24.4.25 Source cves: CVE-2026-110737 Source advisory: MEND:CVE-2026-110737...

CVE-2026-111497

CVE-2026-111497 — Node2Shell -red?style=for-the-badge -orange?style=for-the-badge&logo=nodedotjs&logoColor=white Comprehensive Security Advisory, Technical Analysis, and Remediation Guide for CVE-2026-111497 --- 📋 Table of Contents Executive Summary Technical Deep Dive Root Cause Analysis Attack...

ALSA-2026:90909 Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing CVE-2026-89425...

Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing CVE-2026-89425...

CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

@eui/deps-base (>=21.0.0-next.10, <=21.0.0-next.51), @eui/deps-base-light (>=21.0.0-next.10, <=21.0.0-next.51) +1 more potentially affected by CVE-2025-66035 +1 more via @angular/common (>=21.0.0, <=21.0.2)

@angular/common NPM version =21.0.0, =21.0.0-next.10, =21.0.0-next.10, =21.0.0-next.51 - zax-dashboard 1.0.14 Source cves: CVE-2025-66035, CVE-2026-111753 Source advisory: OSV:GHSA-JFGX-762W-99VR...

@eui/deps-base (>=21.0.0-next.10, <=21.0.0-next.51), @eui/deps-base-light (>=21.0.0-next.10, <=21.0.0-next.51) +1 more potentially affected by CVE-2025-66035 +1 more via @angular/common (>=21.0.0, <=21.0.2)

@angular/common NPM version =21.0.0, =21.0.0-next.10, =21.0.0-next.10, =21.0.0-next.51 - zax-dashboard 1.0.14 Source cves: CVE-2025-66035, CVE-2026-111753 Source advisory: GHSA-JFGX-762W-99VR...

@eui/deps-base (>=21.0.0-next.10, <=21.0.0-next.51), @eui/deps-base-light (>=21.0.0-next.10, <=21.0.0-next.51) +1 more potentially affected by CVE-2026-111753 via @angular/common (>=21.0.0, <=21.0.2)

@angular/common NPM version =21.0.0, =21.0.0-next.10, =21.0.0-next.10, =21.0.0-next.51 - zax-dashboard 1.0.14 Source cves: CVE-2026-111753 Source advisory: SNYK:JS-ANGULARCOMMON-21369526...

@eui/deps-base (>=21.0.0-next.10, <=21.0.0-next.51), @eui/deps-base-light (>=21.0.0-next.10, <=21.0.0-next.51) +1 more potentially affected by CVE-2025-66035 +1 more via @angular/common (>=21.0.0, <=21.0.2)

@angular/common NPM version =21.0.0, =21.0.0-next.10, =21.0.0-next.10, =21.0.0-next.51 - zax-dashboard 1.0.14 Source cves: CVE-2025-66035, CVE-2026-111753 Source advisory: MEND:CVE-2026-111753...

CVE-2026-103060

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

UBUNTU-CVE-2026-103060

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-103060 Path traversal in rebar3 via unvalidated dependency app names

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-103060

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

EUVD-2026-97510

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-103060 Path traversal in rebar3 via unvalidated dependency app names

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...