CVE-2026-103432: Stack-based Buffer Overflow

apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar in src/cgi/upsfetch.c used by upsstats.cgi, multimon.cgi, and upsfstats.cgi, a related issue to CVE-2026-15544...

CVE-2026-92870: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination...

CVE-2026-100508: Allocation of Resources Without Limits or Throttling

Unauthenticated Denial of Service Attack in Two Factor = 0.16.0 versions...

CVE-2026-76992: Allocation of Resources Without Limits or Throttling

The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote attacker controlling a malicious gateway can exploit this behavior to trigger excessive memory consumption, resulting in a...

PT-2026-103484

Name of the Vulnerable Software and Affected Versions @angular/router versions prior to 20.3.32 @angular/router versions prior to 21.2.24 @angular/router versions prior to 22.2.0 Description A denial of service DoS issue exists in @angular/router when Server-Side Rendering SSR is enabled on...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1712570434)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1712570434 advisory. - A use-after-free flaw was found in the Linux kernel's SGI GRU driver in the way the first grufileunlockedioctl function is called ...

CVE-2026-102123: Improper Limitation of a Pathname to a Restricted Directory

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering i...

AlmaLinux 9.6 [TuxCare] Security Update: polkit / polkit-devel / polkit-docs / polkit-libs (ALMALINUX9.6:CLSA-2026:1779368297)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779368297 advisory. - A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the...

CentOS Linux 8.5 [TuxCare] Security Update: kernel-cross-headers / kernel-debug-modules-extra / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2025:1747688831)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2025:1747688831 advisory. - An out-of-bounds OOB memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. This flaw allows...

Important: gvfs security update

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol FTP, Secure Shell File Transfer Protocol SFTP, Web Distributed Authoring and Versioning WebDAV, Common Internet File System CIFS, Server Message Block SMB, and...

AlmaLinux 9.6 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789738618)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789738618 advisory. - Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no...

AlmaLinux 9.2 [TuxCare] Security Update: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / ant-apache-oro / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1782225575)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782225575 advisory. - When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally lead...

CentOS Linux 8 [TuxCare] Security Update: gd / gd-devel / gd-progs (CENTOS-STREAM8:CLSA-2026:1777541021)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1777541021 advisory. - gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position is The GD2...

CentOS Linux 7 [TuxCare] Security Update: openldap / openldap-clients / openldap-devel / openldap-servers / etc Multiple Vulnerabilities (CENTOS7:CLSA-2023:1695834945)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2023:1695834945 advisory. - In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783353048)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783353048 advisory. - A flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt is a multiple of 2GiB. This...

ROS-20260930-73-0045

The vulnerability of the nfs4ffallocdeviceidnode function in the fs/nfs/flexfilelayout/flexfilelayoutdev.c module, which is part of the NFS client support in Linux operating systems, is related to improper memory release. Exploiting this vulnerability could allow a remote attacker to cause servic...

PT-2026-103794

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.9 Description The software fails to limit the number of query string fields in the HTTPServerRequest. init function. This allows remote, unauthenticated attackers to send GET requests containing thousands of query...

PT-2026-103521

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fiel...

PT-2026-103135

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

PT-2026-105534

Summary In the Astro Node adapter, a request whose Host header contains a malformed port for example example.com:65536 or example.com:8080:8080 produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised a...