AlmaLinux 9.6 [TuxCare] Security Update: runc (ALMALINUX9.6:CLSA-2026:1783518302)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783518302 advisory. - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1,...

CentOS Linux 7 [TuxCare] Security Update: freetype / freetype-demos / freetype-devel (CENTOS7:CLSA-2025:1742926404)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1742926404 advisory. - An out of bounds write exists in FreeType versions 2.13.0 and below newer versions of FreeType are not vulnerable when attempting to parse font...

AlmaLinux 9.6 [TuxCare] Security Update: assertj-core / assertj-core-javadoc (ALMALINUX9.6:CLSA-2026:1788370561)

"The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788370561 advisory. - AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine JVM. Starting in version 1.4.0 and prior to version 3.27....

Rocky Linux 9 [CIQ] Security Update: fontforge / fontforge-debuginfo / fontforge-debugsource Multiple Vulnerabilities (crlsa-2024_9439)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249439 advisory. fontforge: command injection via crafted archives or compressed files CVE-2024-25082 fontforge: command injection via crafted filenames CVE-2024-25081...

Rocky Linux 8 [CIQ] Security Update: spamassassin / spamassassin-debuginfo / spamassassin-debugsource (crlsa-2021_4315)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214315 advisory. spamassassin: Malicious rule configuration files can be configured to run system commands CVE-2020-1946 Tenable has extracted the preceding description block direct...

Rocky Linux 8 [CIQ] Security Update: perl-CPAN (crlsa-2025_8432)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20258432 advisory. perl-CPAN: Bypass of verification of signatures in CHECKSUMS files CVE-2020-16156 Tenable has extracted the preceding description block directly from the CIQ securi...

Rocky Linux 8 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource (crlsa-2022_6180)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20226180 advisory. rsync: remote arbitrary files write inside the directories of connecting peers CVE-2022-29154 Tenable has extracted the preceding description block directly from th...

AlmaLinux 9.2 [TuxCare] Security Update: yelp / yelp-devel / yelp-libs (ALMALINUX9.2:CLSA-2026:1783700414)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783700414 advisory. - A flaw was found in Yelp due to an overly permissive Content Security Policy CSP implementation provided by yelp-xsl. A malicious Flatpak...

Rocky Linux 8 [CIQ] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (crlsa-2026_19666)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619666 advisory. kernel: Fragnesia is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation LPE vulnerability in the Linux kernel...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2025_15900)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202515900 advisory. podman: Podman kube play command may overwrite host files CVE-2025-9566 Tenable has extracted the preceding description block directly from the CIQ security...

CentOS Linux 8.4 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1776170814)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1776170814 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and...

CentOS Linux 8.5 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1776171379)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1776171379 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and...

PT-2026-103719

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.4.9 Description An Insecure Direct Object Reference exists via the CourseMaterialTemplate::render material items callback exposed on the public...

CVE-2026-51883

The knowledge base creation and document upload interfaces in Langchain-Chatchat versions 0.3.0 and 0.3.1 are vulnerable to a path traversal vulnerability (CWE-22 ). An attacker can inject path traversal sequences, such as ..\, into the knowledge_base_name parameter. This allows the attacker to b...

CVE-2026-88789: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2024-58388: Improper Limitation of a Pathname to a Restricted Directory

Sharp and Toshiba Tec rebranded multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installedemanualdown.html endpoint. Attackers can supply directory traversal sequence...

CVE-2026-51879

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.writebotfile. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tutorbot file route...

CVE-2026-51882: Improper Limitation of a Pathname to a Restricted Directory

The OpenAI-compatible file upload endpoint /v1/files in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the openaifiles directory by crafting malicious filenames...

Rocky Linux 9.6 [TuxCare] Security Update: gstreamer1-plugins-base / gstreamer1-plugins-base-devel / etc (ALMALINUX9.6:CLSA-2026:1776334207)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776334207 advisory. - GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute...

AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.2:CLSA-2025:1758825546)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1758825546 advisory. - A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an...