PT-2026-105200

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter values into non-garbage-collected Erlang atoms before bounding them or checking a fixed allowlist. Exploitation requires network access to th...

Rocky Linux 9 [CIQ] Security Update: python3.14-urllib3 Multiple Vulnerabilities (crlsa-2026_28157)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202628157 advisory. urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-44432 urllib3: urllib3: Information disclosure via cross-origin...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / python-cffi-debugsource / etc Multiple Vulnerabilities (crlsa-2023_2763)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20232763 advisory. python: int type in PyLongFromString does not limit amount of digits converting text to int leading to DoS CVE-2020-10735 python: open redirection...

PT-2026-114461

Уязвимость функции mod vhost alias веб-сервера Apache HTTP Server связана с выходом операции за границы буфера в памяти. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании или выполнить произвольный код путем отправки специально сформированного...

PT-2026-105906

Description Sanic's HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating 0r chunk. Because of that, attacker-controlled bytes left in the connection buffer after the first chunked request can be interpreted as the start of a new HTTP request on the same...

Rocky Linux 9 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2025_2471)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20252471 advisory. python-tornado: Tornado has HTTP cookie parsing DoS vulnerability CVE-2024-52804 Tenable has extracted the preceding description block directly from the CIQ securit...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging Multiple Vulnerabilities (crlsa-2020_4272)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20204272 advisory. nodejs-dot-prop: prototype pollution CVE-2020-8116 nodejs: HTTP request smuggling due to CR-to-Hyphen conversion CVE-2020-8201 npm: Sensitive information...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2021_5160)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20215160 advisory. golang: net/http: limit growth of header canonicalization cache CVE-2021-44716 golang: syscall: don't close fd 0 on ForkExec error CVE-2021-44717 Tenable h...

Rocky Linux 8 [CIQ] Security Update: ruby / ruby-debuginfo / ruby-debugsource / ruby-default-gems / etc Multiple Vulnerabilities (crlsa-2021_2584)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20212584 advisory. ruby: Potential HTTP request smuggling in WEBrick CVE-2020-25613 ruby: XML round-trip vulnerability in REXML CVE-2021-28965 Tenable has extracted the...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo (crlsa-2022_0001)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20220001 advisory. golang: net/http: limit growth of header canonicalization cache CVE-2021-44716 Tenable has extracted the preceding description block directly from the CIQ security...

PT-2026-104037

Name of the Vulnerable Software and Affected Versions deeptutor version 1.4.0 Description An authorization bypass exists due to a user-controlled object identifier in the write bot file function of TutorBotManager. A remote attacker can enumerate bot IDs and overwrite whitelisted control files of...

CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...

PT-2026-104043

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.9.4 Description An authenticated attacker can execute arbitrary Python code on the server via a code injection flaw. The issue exists because a public-facing route accepts raw Python source and forwards...

PT-2026-103867

iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers...

PT-2026-105839

Summary The UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation. Affected Package - Ecosystem: PyPI - Package: mcp-atlassian - Affected versions: all versions before...

Rocky Linux 8 [CIQ] Security Update: libecap / libecap-debuginfo / libecap-debugsource / libecap-devel / etc Multiple Vulnerabilities (crlsa-2023_7668)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237668 advisory. squid: DoS against HTTP and HTTPS CVE-2023-5824 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc (crlsa-2023_5050)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235050 advisory. httpd: modproxyuwsgi HTTP response splitting CVE-2023-27522 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Rocky Linux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.6:CLSA-2026:1782209860)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782209860 advisory. - Out-of-bounds Read vulnerability in Apache HTTP Server with modheaders and modmime and multiple response languages. This issue affects...

CVE-2026-51886

The langflow-ai langflow application (up to v1.9.3 ) is vulnerable to Authenticated Remote Code Execution (RCE) via a code injection flaw in the validate_code function. The /api/v1/validate/code endpoint uses Python's exec() function to compile and execute user-supplied code for validation. While...

AlmaLinux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.6:CLSA-2026:1779788314)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779788314 advisory. - CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 Note that Nessus has not tested for this issue but...