dracut security update

An update is available for dracut. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The dracut packages contain an event-driven initial RAM file system initramfs...

GO-2025-3842 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector...

PT-2026-72065

Name of the Vulnerable Software and Affected Versions CKAN MCP Server versions prior to 0.4.112 Description Error paths reflect raw upstream response bodies and internal exception messages to the caller instead of using sanitized, generic messages. This occurs when the server is directed to a hos...

PT-2026-72081

Name of the Vulnerable Software and Affected Versions Metacat versions 2.0.0 through 3.4.0 Description Unauthenticated SQL injection exists in the /cn/v1/object and /cn/v2/object REST API endpoints. The issue occurs because the software appends user-supplied data to SQL queries without sanitizati...

AlmaLinux 10 : dracut (ALSA-2026:54576)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:54576 advisory. dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die CVE-2026-15816 Tenable has extracted the precedin...

RockyLinux 10 : dracut (RLSA-2026:54576)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:54576 advisory. dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die CVE-2026-15816 Tenable has extracted the precedi...

CVE-2026-73421

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth wrapper can fail open when Auth.js has a server configuration error. In middleware, Route...

CVE-2026-73421 NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth wrapper can fail open when Auth.js has a server configuration error. In middleware, Route...

CVE-2026-73421 NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth wrapper can fail open when Auth.js has a server configuration error. In middleware, Route...

CVE-2026-73421

NextAuth.js vulnerability CVE-2026-73421 affects next-auth v5: when server configuration has an error (e.g., missing issuer/authorization, unset AUTH_SECRET), the auth() wrapper can return a truthy error object in middleware, Route Handlers, React Server Components, etc. As a result, existence-ba...

CVE-2026-18020

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking...

CVE-2026-18020 IBM i is Affected By Multiple Vulnerabilities in NetServer

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking...

CVE-2026-17216

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an integer error when processing DRDA large-object headers...

CVE-2026-72639 Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one...

CVE-2026-72669 Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...

CVE-2026-72669

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...

EUVD-2026-58256

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...

CVE-2026-72679

Elasticsearch is affected by CVE-2026-72679 due to a pattern-compiled intervals query that can recurse unboundedly if a deeply nested pattern is supplied. The root cause is that input length restrictions are not applied to user-supplied patterns, allowing an authenticated, read-only user on a sin...

CVE-2026-72686

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation...

CVE-2026-72683 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate to submit a request that causes a self-referential data structure to be created. Whe...