Rocky Linux 8 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource (crlsa-2022_6180)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20226180 advisory. rsync: remote arbitrary files write inside the directories of connecting peers CVE-2022-29154 Tenable has extracted the preceding description block directly from th...

Rocky Linux 9 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc (crlsa-2026_28209)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202628209 advisory. vim: Vim: Command injection allows arbitrary code execution via malicious tag files CVE-2026-41411 Tenable has extracted the preceding description block directly...

Rocky Linux 8 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc (crlsa-2026_28553)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202628553 advisory. vim: Vim: Command injection allows arbitrary code execution via malicious tag files CVE-2026-41411 Tenable has extracted the preceding description block directly...

CVE-2026-103290: Path Traversal: '.../...//'

Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests (ALMALINUX9.2:CLSA-2025:1765293700)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1765293700 advisory. - tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted...

AlmaLinux 9.2 [TuxCare] Security Update: yelp / yelp-devel / yelp-libs (ALMALINUX9.2:CLSA-2026:1783700414)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783700414 advisory. - A flaw was found in Yelp due to an overly permissive Content Security Policy CSP implementation provided by yelp-xsl. A malicious Flatpak...

AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.2:CLSA-2025:1758825546)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1758825546 advisory. - A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an...

CentOS Linux 8.4 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1776170814)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1776170814 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.2:CLSA-2025:1740471603)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1740471603 advisory. - Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote...

PT-2026-103822

Name of the Vulnerable Software and Affected Versions Ghost versions 6.14.0 through 6.26.x Description The ImageSize service contains a path traversal issue where insufficient input validation of user-supplied file paths allows authenticated staff users to access local files located outside the...

Rocky Linux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2025:1764868919)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1764868919 advisory. - Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc...

Rocky Linux 8 [CIQ] Security Update: git-lfs / git-lfs-debuginfo / git-lfs-debugsource (crlsa-2025_23745)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523745 advisory. git-lfs: Git LFS may write to arbitrary files via crafted symlinks CVE-2025-26625 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: pmix / pmix-debuginfo / pmix-debugsource / pmix-devel (crlsa-2024_3008)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243008 advisory. pmix: race condition allows attackers to obtain ownership of arbitrary files CVE-2023-41915 Tenable has extracted the preceding description block directly from the...

Rocky Linux 9 [CIQ] Security Update: pmix / pmix-debuginfo / pmix-debugsource / pmix-devel / pmix-pmi / etc (crlsa-2024_2199)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20242199 advisory. pmix: race condition allows attackers to obtain ownership of arbitrary files CVE-2023-41915 Tenable has extracted the preceding description block directly from the...

CVE-2026-51882

The OpenAI-compatible file upload endpoint /v1/files in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the openaifiles directory by crafting malicious filenames...

AlmaLinux 9.6 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc (ALMALINUX9.6:CLSA-2026:1786548808)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786548808 advisory. - MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to...

AlmaLinux 9.2 [TuxCare] Security Update: freetype / freetype-demos / freetype-devel (ALMALINUX9.2:CLSA-2025:1745956171)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1745956171 advisory. - An out of bounds write exists in FreeType versions 2.13.0 and below newer versions of FreeType are not vulnerable when attempting to parse...

Rocky Linux 8 [CIQ] Security Update: dhcp-client / dhcp-client-debuginfo / dhcp-common / dhcp-debuginfo / etc (crlsa-2021_2359)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20212359 advisory. dhcp: stack-based buffer overflow when parsing statements with colon-separated hex digits in config or lease files in dhcpd and dhclient CVE-2021-25217 Tenable has...

Rocky Linux 8 [CIQ] Security Update: poppler / poppler-cpp / poppler-cpp-debuginfo / poppler-cpp-devel / etc (crlsa-2023_2810)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20232810 advisory. poppler: integer overflow in JBIG2 decoder using malformed files CVE-2022-38784 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (crlsa-2026_19666)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619666 advisory. kernel: Fragnesia is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation LPE vulnerability in the Linux kernel...