CVE-2025-41753: Improper Limitation of a Pathname to a Restricted Directory

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the...

Rocky Linux 9.6 [TuxCare] Security Update: gzip Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783934943)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783934943 advisory. - GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is n...

Rocky Linux 9 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc (crlsa-2026_22717)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202622717 advisory. vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass CVE-2026-35177 Tenable has extracted the preceding description block directly...

CentOS Linux 7 [TuxCare] Security Update: dmidecode (CENTOS7:CLSA-2026:1777996588)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777996588 advisory. - Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via...

Rocky Linux 8 [CIQ] Security Update: tar / tar-debuginfo / tar-debugsource Multiple Vulnerabilities (crlsa-2026_70390)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202670390 advisory. tar: Tar path traversal CVE-2025-45582 tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rena...

AlmaLinux 9.2 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1777943581)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777943581 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's zip.vim plugin allows...

AlmaLinux 9.2 [TuxCare] Security Update: gzip (ALMALINUX9.2:CLSA-2026:1783514299)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783514299 advisory. - GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not availabl...

Rocky Linux 9 [CIQ] Security Update: gzip / gzip-debuginfo / gzip-debugsource Multiple Vulnerabilities (crlsa-2026_61623)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661623 advisory. gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility CVE-2026-41991 gzip: gzip: Information disclosure via global...

Rocky Linux 10.2 [CIQ] Security Update: tar / tar-debuginfo / tar-debugsource Multiple Vulnerabilities (crlsa-2026_61586)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661586 advisory. tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path esca...

Rocky Linux 10.2 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-data / vim-debuginfo / etc (crlsa-2026_22711)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202622711 advisory. vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass CVE-2026-35177 Tenable has extracted the preceding description block direct...

Rocky Linux 10.2 [CIQ] Security Update: gzip / gzip-debuginfo / gzip-debugsource Multiple Vulnerabilities (crlsa-2026_61625)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661625 advisory. gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility CVE-2026-41991 gzip: gzip: Information disclosure via global...

Rocky Linux 9.6 [TuxCare] Security Update: tar (ALMALINUX9.6:CLSA-2026:1769513855)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1769513855 advisory. - GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the...

AlmaLinux 9.6 [TuxCare] Security Update: gzip Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783934943)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783934943 advisory. - GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not...

Rocky Linux 8 [CIQ] Security Update: container-selinux / crit / criu / criu-debuginfo / criu-debugsource / etc (crlsa-2020_1926)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20201926 advisory. buildah: Crafted input tar file may lead to local file overwrite during image build process CVE-2020-10696 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc (crlsa-2020_1932)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20201932 advisory. buildah: Crafted input tar file may lead to local file overwrite during image build process CVE-2020-10696 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: tar / tar-debuginfo / tar-debugsource Multiple Vulnerabilities (crlsa-2026_61581)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661581 advisory. tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape...

Rocky Linux 8 [CIQ] Security Update: gzip / gzip-debuginfo / gzip-debugsource Multiple Vulnerabilities (crlsa-2026_65998)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202665998 advisory. gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility CVE-2026-41991 gzip: gzip: Information disclosure via global...

Rocky Linux 8 [CIQ] Security Update: cockpit-podman / container-selinux / containernetworking-plugins / etc (crlsa-2020_1931)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20201931 advisory. buildah: Crafted input tar file may lead to local file overwrite during image build process CVE-2020-10696 Tenable has extracted the preceding description block...

AlmaLinux 9.6 [TuxCare] Security Update: tar (ALMALINUX9.6:CLSA-2026:1769513855)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1769513855 advisory. - GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2021_3666)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20213666 advisory. nodejs: Use-after-free on close http2 on stream canceling CVE-2021-22930 nodejs: Use-after-free on close http2 on stream canceling CVE-2021-22940 c-ares:...