Rocky Linux 9 [CIQ] Security Update: fontforge / fontforge-debuginfo / fontforge-debugsource Multiple Vulnerabilities (crlsa-2024_9439)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249439 advisory. fontforge: command injection via crafted archives or compressed files CVE-2024-25082 fontforge: command injection via crafted filenames CVE-2024-25081...

AlmaLinux 9.6 [TuxCare] Security Update: assertj-core / assertj-core-javadoc (ALMALINUX9.6:CLSA-2026:1788370561)

"The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788370561 advisory. - AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine JVM. Starting in version 1.4.0 and prior to version 3.27....

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2025:1766137892)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1766137892 advisory. - tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted...

CentOS Linux 7 [TuxCare] Security Update: freetype / freetype-demos / freetype-devel (CENTOS7:CLSA-2025:1742926404)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1742926404 advisory. - An out of bounds write exists in FreeType versions 2.13.0 and below newer versions of FreeType are not vulnerable when attempting to parse font...

Rocky Linux 8 [CIQ] Security Update: spamassassin / spamassassin-debuginfo / spamassassin-debugsource (crlsa-2021_4315)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214315 advisory. spamassassin: Malicious rule configuration files can be configured to run system commands CVE-2020-1946 Tenable has extracted the preceding description block direct...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2026_18722)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202618722 advisory. podman: Podman kube play command may overwrite host files CVE-2025-9566 Tenable has extracted the preceding description block directly from the CIQ security...

CentOS Linux 6 [TuxCare] Security Update: spamassassin Multiple Vulnerabilities (CENTOS6:CLSA-2025:1758796775)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2025:1758796775 advisory. - A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration .cf files ca...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2025_15900)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202515900 advisory. podman: Podman kube play command may overwrite host files CVE-2025-9566 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.6 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc (ALMALINUX9.6:CLSA-2026:1786548808)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786548808 advisory. - MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to...

AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788520884)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788520884 advisory. - rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete...

CentOS Linux 7 [TuxCare] Security Update: emacs / emacs-common / emacs-el / emacs-filesystem / emacs-nox / etc (CENTOS7:CLSA-2026:1787211247)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1787211247 advisory. - In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. CVE-2024-30205 Note that...

AlmaLinux 9.6 [TuxCare] Security Update: runc (ALMALINUX9.6:CLSA-2026:1783518302)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783518302 advisory. - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1,...

Rocky Linux 8 [CIQ] Security Update: perl-CPAN (crlsa-2025_8432)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20258432 advisory. perl-CPAN: Bypass of verification of signatures in CHECKSUMS files CVE-2020-16156 Tenable has extracted the preceding description block directly from the CIQ securi...

Rocky Linux 9.6 [TuxCare] Security Update: ctdb / ldb-tools / libldb / libldb-devel / libnetapi / etc (ALMALINUX9.6:CLSA-2026:1780403538)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780403538 advisory. - A flaw was found in Samba's vfsworm module. The module is intended to provide write-once, read-many WORM protections by preventing...

CentOS Linux 7 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-demos / etc (CENTOS7:CLSA-2025:1763139862)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1763139862 advisory. - Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because...

Rocky Linux 8 [CIQ] Security Update: freetype / freetype-debuginfo / freetype-debugsource / etc (crlsa-2025_3421)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20253421 advisory. freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and variable font files CVE-2025-27363 Tenable has extracted the...

CVE-2026-51883

The knowledge base creation and document upload interfaces in Langchain-Chatchat versions 0.3.0 and 0.3.1 are vulnerable to a path traversal vulnerability (CWE-22 ). An attacker can inject path traversal sequences, such as ..\, into the knowledge_base_name parameter. This allows the attacker to b...

CVE-2026-104059: Cross-Site Request Forgery (CSRF)

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-51879: Undefined Security Weakness

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.writebotfile. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tutorbot file route...

CentOS Linux 8.4 [TuxCare] Security Update: git / git-all / git-core / git-core-doc / git-credential-libsecret / etc (CENTOS8.4:CLSA-2026:1768392809)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1768392809 advisory. - Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source...