Rocky Linux 9.6 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.6:CLSA-2026:1770394049)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1770394049 advisory. - In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data. CVE-2026-24515 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2026-103387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto...

Linux Distros Unpatched Vulnerability : CVE-2026-103118

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the...

AlmaLinux 9.2 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (ALMALINUX9.2:CLSA-2026:1773830791)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1773830791 advisory. - A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftpextensionsgetname/sftpextensionsgetdata of...

AlmaLinux 9.2 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1760019942)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760019942 advisory. - A vulnerability was found in JasPer up to 4.2.5. Affected by this vulnerability is the function jasimagechclrspc of the file...

CentOS Linux 8.4 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.4:CLSA-2026:1789142708)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1789142708 advisory. - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after- free can occur. NOTE: this is...

CentOS Linux 8 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS-STREAM8:CLSA-2026:1770648267)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1770648267 advisory. - In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data. CVE-2026-24515 Note that Ness...

CentOS Linux 8 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc (CENTOS-STREAM8:CLSA-2026:1777641731)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1777641731 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40...

InsydeH2O IHISI SMM is vulnerable to unsafe memory write operations

Overview An Out-of-bounds Write vulnerability in the InsydeH2O IHISI software used by HP PC BIOS can allow a local attacker with OS kernel privileges to perform arbitrary physical memory writes, including writes to System Management RAM SMRAM. Because the vulnerable code executes in System...

GHSA-P68Q-WCHP-6FH7 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

Impact Fastify routes a malformed URL under one plugin prefix to the custom not-found handler of a different sibling plugin, invoking the handler registered last and skipping the preHandler declared in its setNotFoundHandler. When the request method has no route in the main router, a malformed...

EUVD-2026-70989

fastify vulnerable to request validation bypass via skipped boolean false schemas...

russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

Summary CVE-2026-68930 was fixed by adding Session::isestablishedchannel in russh/src/server/encrypted.rs, which gates every channel-scoped SERVER-side message CHANNELREQUEST, CHANNELDATA, CHANNELEOF, CHANNELCLOSE, CHANNELWINDOWADJUST, CHANNELEXTENDEDDATA on enc.channels.get&channel.issomeand|c|...

GHSA-47HW-GVQ5-R2GM russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

Summary CVE-2026-68930 was fixed by adding Session::isestablishedchannel in russh/src/server/encrypted.rs, which gates every channel-scoped SERVER-side message CHANNELREQUEST, CHANNELDATA, CHANNELEOF, CHANNELCLOSE, CHANNELWINDOWADJUST, CHANNELEXTENDEDDATA on enc.channels.get&channel.issomeand|c|...

CVE-2026-102143

An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate...

DEBIAN-CVE-2026-103387

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

AZL-105351 CVE-2026-103387 affecting package js-jquery 3.5.0-4

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

CVE-2026-103387

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

CVE-2026-103387

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

UBUNTU-CVE-2026-103387

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

EUVD-2026-90270

An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate...