Rocky Linux 9.6 [TuxCare] Security Update: polkit / polkit-devel / polkit-docs / polkit-libs (ALMALINUX9.6:CLSA-2026:1779368297)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779368297 advisory. - A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the...

CentOS Linux 6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS6:CLSA-2026:1782897117)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1782897117 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0662, the dumpprefixes function in src/spell.c walks a spell-file prefix trie...

AlmaLinux 9.2 [TuxCare] Security Update: containernetworking-plugins Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1772575666)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1772575666 advisory. - Non-random values for ticketageadd in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1777394614)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777394614 advisory. - Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Rang...

CentOS Linux 8.5 [TuxCare] Security Update: mysql / mysql-common / mysql-devel / mysql-errmsg / mysql-libs / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1768587465)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1768587465 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are...

SUSE SLES16 Security Update : expat (SUSE-SU-2026:23912-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23912-1 advisory. - CVE-2026-41080: crafted XML document can cause a denial of service bsc1262263. - CVE-2026-45186: In libexpat before 2.8.1, the...

CentOS Linux 8.5 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.5:CLSA-2025:1746188001)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1746188001 advisory. - A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When...

AlmaLinux 9.2 [TuxCare] Security Update: mysql / mysql-common / mysql-devel / mysql-errmsg / mysql-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1739820848)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1739820848 advisory. - A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to...

AlmaLinux 9.6 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1780398100)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780398100 advisory. - In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls gssacceptseccontext on a...

CentOS Linux 8 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1776847322)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1776847322 advisory. - libcurl provides the CURLOPTCERTINFO option to allow applications torequest details to be returned about a server's certificate...

SUSE SLED15: glib2-devel / glib2-lang / glib2-tools / libgio-2_0-0 / etc (SUSE-SU-2026:4367-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4367-1 advisory. This update for glib2 fixes the following issue: - CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SAS...

AlmaLinux 9.2 [TuxCare] Security Update: avahi / avahi-autoipd / avahi-compat-howl / avahi-compat-howl-devel / etc (ALMALINUX9.2:CLSA-2026:1778112033)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778112033 advisory. - Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below,...

ROS-20260930-73-0045

The vulnerability of the nfs4ffallocdeviceidnode function in the fs/nfs/flexfilelayout/flexfilelayoutdev.c module, which is part of the NFS client support in Linux operating systems, is related to improper memory release. Exploiting this vulnerability could allow a remote attacker to cause servic...

PT-2026-103794

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.9 Description The software fails to limit the number of query string fields in the HTTPServerRequest. init function. This allows remote, unauthenticated attackers to send GET requests containing thousands of query...

PT-2026-103521

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fiel...

PT-2026-103135

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

PT-2026-105534

Summary In the Astro Node adapter, a request whose Host header contains a malformed port for example example.com:65536 or example.com:8080:8080 produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised a...

PT-2026-103496

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate...

The vulnerability of the cfsrvl PhyidMatch() function in the net/caif/cfsrvl.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the cfsrvl PhyidMatch function in the net/caif/cfsrvl.c module of the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

PT-2026-103543

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An endpoint used during the initial appliance setup lacks authentication and fails to correctly enforce its intended state precondition. This allows an...