PT-2026-105181

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's is authorized/2 delegates to rabbit mgmt util:is authorized monitor/2, which accepts the monitoring tag. But allowed methods includes DELETE, and delete...

AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1751889956)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751889956 advisory. - Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a...

Rocky Linux 9 [CIQ] Security Update: grafana-pcp / grafana-pcp-debuginfo Multiple Vulnerabilities (crlsa-2022_8250)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228250 advisory. golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705 golang: io/fs: stack exhaustion in Glob CVE-2022-30630 golang:...

Rocky Linux 8 [CIQ] Security Update: Judy / Judy-debuginfo / Judy-debugsource / Judy-devel / asio-devel / etc (crlsa-2026_0698)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260698 advisory. mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation CVE-2025-13699 Tenable has extracted the preceding descripti...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2022_5775)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225775 advisory. golang: compress/gzip: stack exhaustion in Reader.Read CVE-2022-30631 golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705...

AlmaLinux 9.2 [TuxCare] Security Update: systemd / systemd-boot-unsigned / systemd-container / systemd-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776099155)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776099155 advisory. - systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made wit...

Rocky Linux 9 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_68660)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202668660 advisory. Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication...

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1769099972)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1769099972 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables se...

PT-2026-103675

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page titles leads to improper...

CVE-2026-102671: Improper Certificate Validation

The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-15911: Improper Certificate Validation

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation...

CVE-2026-93495: Improper Initialization

Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Refer to the ' Security Update for Multiple ASUS Motherboards ' section on the ASUS Security Advisory for more information...

CVE-2026-102668: Improper Certificate Validation

The Joyland AI app accepts any TLS certificates from any server without validation...

CVE-2026-27872: Improper Privilege Management

Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows Brute Force. This issue affects Easy IO FG: before 2.0b52...

CVE-2026-51897: Improper Access Control

RAGFlow 0.24.0 contains improper access control in getdataset api/apps/evaluationapp. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-34494: On-Chip Debug and Test Interface With Improper Access Control

On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue affects Neo Series MVP2: before 3.3b63...

CVE-2026-34493: On-Chip Debug and Test Interface With Improper Access Control

On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affects EasyIO FS32: before 3.3b63...

CVE-2026-102370: On-Chip Debug and Test Interface With Improper Access Control

Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader. Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot...

CVE-2025-31980: Improper Input Validation

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application, enabling potential injection attacks or errors in downstream processing systems...