Rocky Linux 9 [CIQ] Security Update: perl-XML-Parser / perl-XML-Parser-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_7679)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20267679 advisory. perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files CVE-2006-10003 perl-xml-parser: XML::Parser for Perl: Heap corruption and denia...

Rocky Linux 9 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2026_19167)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619167 advisory. lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-4800 Tenable has extracted the preceding description block directly from...

CentOS Linux 7 [TuxCare] Security Update: squid / squid-migration-script / squid-sysvinit Multiple Vulnerabilities (CENTOS7:CLSA-2026:1774874764)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1774874764 advisory. - Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap...

PT-2026-103851

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet Metform metform allows Stored XSS.This issue affects Metform: from n/a through 4.3.0...

ASB-A-515158597

In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-103731

Name of the Vulnerable Software and Affected Versions Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More versions prior to 5.5.1.4 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected...

PT-2026-103821

Name of the Vulnerable Software and Affected Versions Ghost versions 5.9.0 through 6.44.0 Description An input validation issue exists in the comments feature. This flaw allows authenticated members to access comments they are not authorized to view, leading to the disclosure of restricted commen...

PT-2026-103909

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application, enabling potential injection attacks or errors in downstream processing systems...

CVE-2025-31980: Improper Input Validation

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application, enabling potential injection attacks or errors in downstream processing systems...

PT-2026-103738

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-103289: Improper Neutralization of Special Elements in Data Query Logic

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

PT-2026-103691

Name of the Vulnerable Software and Affected Versions Extendify versions prior to 3.1.7 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts are permanently stored on a targe...

PT-2026-103742

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

AlmaLinux 9.2 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.2:CLSA-2026:1779122132)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779122132 advisory. - In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized...

Rocky Linux 10.2 [CIQ] Security Update: polkit / polkit-debuginfo / polkit-debugsource / polkit-devel / etc (crlsa-2026_59997)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202659997 advisory. polkit: Polkit: Denial of Service via unbounded input processing through standard input CVE-2026-4897 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: microcode_ctl Multiple Vulnerabilities (crlea-2025_3114)

The Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlea-20253114 advisory. The microcodectl packages provide microcode updates for Intel and AMD processors. Bug Fixes and Enhancements: Rocky Linux 8 Update Intel CPU microcode to t...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1774442729)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774442729 advisory. - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native and Tomcat's...

Rocky Linux 8 [CIQ] Security Update: brotli / brotli-debuginfo / brotli-debugsource / brotli-devel / etc (crlsa-2021_1702)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20211702 advisory. brotli: buffer overflow when input chunk is larger than 2GiB CVE-2020-8927 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: python3.11-PyMySQL (crlsa-2024_4244)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20244244 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: perl-Module-ScanDeps (crlsa-2025_7350)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20257350 advisory. module-scandeps: local privilege escalation via unsanitized input CVE-2024-10224 Tenable has extracted the preceding description block directly from the CIQ securit...