133371 matches found
httpd: incomplete fix for CVE-2023-38709
A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...
Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.21.11 security, enhancement & bug fix update
Red Hat OpenShift Data Foundation 4.21.11 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.21.11 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-9563: Backport to odf-4.21.10 Race condition may allow multiple CephCluster reconciles in parallel...
CLSA-2026-1787141079 TuxCare security update for log4j:log4j (1 CVE)
TuxCare rebuilt log4j:log4j to address 1 CVE. Fixed in 1.2.16-tuxcare.2...
PYSEC-2026-3665 Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
Summary In Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen from interpreting the shell operators &&, | and in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its...
Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
SummaryIn Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen frominterpreting the shell operators &&, | and in AMP command values taken from the configuration file. Thehardening was not applied to the on-alert action command path, which reads its...
PYSEC-2026-3666 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection
Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...
BIT-GOLANG-2026-56859 Add recursion depth guard during decode in encoding/xml
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
RHSA-2026:56574 Red Hat Security Advisory: kernel security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:56573 Red Hat Security Advisory: kernel security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:56219 Red Hat Security Advisory: python3 security update
Bulletin has no description...
RHSA-2026:56130 Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:56039 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
RHSA-2026:56007 Red Hat Security Advisory: mysql8.4 security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:55405 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Bulletin has no description...
RHSA-2026:40573 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
ROOT-APP-GOBINARY-CVE-2026-46600 CVE-2026-46600 in golang.org/x/net - Patched by Root
Root has patched CVE-2026-46600 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: vim: vim-X11-9.2.967-1.hum1 aarch64, x8664 vim-common-9.2.967-1.hum1 aarch64, x8664 vim-data-9.2.967-1.hum1 noarch vim-default-editor-9.2.967-1.hum1 noarch vim-enhanced-9.2.967-1.hum1 aarch64,...
PT-2026-78692
Name of the Vulnerable Software and Affected Versions Termix versions prior to 2.3.2 Description An authenticated low-privileged user can cause the platform to authenticate to an attacker-controlled SSH server, leading to the disclosure of another user's stored SSH password or private-key materia...
