Rocky Linux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779886202)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779886202 advisory. - When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Pat...

RHEL 8 : rhc (RHSA-2026:73915)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:73915 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fixes:...

SUSE CVE-2026-85644

XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. The wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV rather than SvROK. SvRV reads a union slot...

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

Summary new Address6 and Address6.isValid place no bound on the length of the string they parse. When the string contains a character that cannot appear in an IPv6 address, the parser builds a diagnostic that wraps every such character in a 34-byte , so the work and the memory scale with the inpu...

GHSA-H3MG-XC3C-68PW ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

Summary new Address6 and Address6.isValid place no bound on the length of the string they parse. When the string contains a character that cannot appear in an IPv6 address, the parser builds a diagnostic that wraps every such character in a 34-byte , so the work and the memory scale with the inpu...

SUSE CVE-2026-101910

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for ...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the BatchActivator.quote method in src/virtualenv/activation/batch/init.py, which previously returned its input string unchanged. When a virtualenv is created in a path containing cmd.exe operator characters such a...

GHSA-Q4XH-88C3-WMH7 vulnerabilities

Vulnerabilities for packages: traccar, logstash, conductor, conductor-fips, flyway-fips, flink-kubernetes-operator-fips, wso2is, apache-tika, infinispan, druid, kafka-fips, neo4j, ranger, datahub-gms, camunda, drain-cleaner-fips, pinot, ruby3.4-jrjackson, s3proxy-fips, apache-camel-karavan-devmod...

GHSA-GX83-3VF8-GH7J vulnerabilities

Vulnerabilities for packages: traccar, logstash, conductor, conductor-fips, flyway-fips, flink-kubernetes-operator-fips, wso2is, apache-tika, infinispan, druid, kafka-fips, neo4j, ranger, datahub-gms, camunda, drain-cleaner-fips, pinot, ruby3.4-jrjackson, s3proxy-fips, apache-camel-karavan-devmod...

CVE-2026-68497 vulnerabilities

Vulnerabilities for packages: traccar, logstash, conductor, conductor-fips, flyway-fips, flink-kubernetes-operator-fips, wso2is, apache-tika, infinispan, druid, kafka-fips, neo4j, ranger, datahub-gms, camunda, drain-cleaner-fips, pinot, ruby3.4-jrjackson, s3proxy-fips, apache-camel-karavan-devmod...

GHSA-WJGM-6HV5-3CVF vulnerabilities

Vulnerabilities for packages: traccar, logstash, conductor, conductor-fips, flyway-fips, flink-kubernetes-operator-fips, wso2is, apache-tika, infinispan, druid, kafka-fips, neo4j, ranger, datahub-gms, camunda, drain-cleaner-fips, pinot, ruby3.4-jrjackson, s3proxy-fips, apache-camel-karavan-devmod...

CVE-2026-19032 vulnerabilities

Vulnerabilities for packages: traccar, logstash, conductor, conductor-fips, flyway-fips, flink-kubernetes-operator-fips, wso2is, apache-tika, infinispan, druid, kafka-fips, neo4j, ranger, datahub-gms, camunda, drain-cleaner-fips, pinot, ruby3.4-jrjackson, s3proxy-fips, apache-camel-karavan-devmod...

GO-2026-6508 vulnerabilities

Vulnerabilities for packages: zot, frankenphp-8.3, terraform-fips, opentofu-fips, grafana-mimir, envoy-ai-gateway, grafana-geomys-fips, grafana-mimir-fips, envoy-ai-gateway-fips, distribution, aws-otel-collector, grafana-pyroscope, tempo-fips, harbor-registry-fips, datadog-agent-fips, loki-fips,...

GO-2026-6508 vulnerabilities

Vulnerabilities for packages: distribution, pulumi-kubernetes-operator, grafana-pyroscope, amazon-cloudwatch-agent, kots, zot, grafana, tempo, mcp-grafana, loki, harbor-registry, caddy, falcosidekick, datadog-agent, opentofu, grafana-mimir, aws-otel-collector, fluent-bit-plugin-loki, grafana-allo...

CVE-2026-49265

A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The "codechallengemethodplain" function uses Python's standard "==" operator for string comparison instead of a constant-time comparison function, potentially allowing timing-based...

Security Bulletin: IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029

Summary IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029 because of CR author can redirect arcgis-admin RoleBinding to own ServiceAccount, CR author can override...

MyModel

xss-specialist A Kev-style XSS decision model + an ex...

Malicious code in @hrmony/kit-4 (npm)

Source: amazon-inspector cb6ac778d35433101385eb57755b6079e76c7bb3dc40306218cf5b1295d5a853 The package runs credential-harvesting code both at install time and at import time. The declared preinstall hook scripts/check-setup.mjs queries the AWS EC2 instance metadata service IMDSv2 at 169.254.169.2...

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the codechallengemethods256 and codechallengemethodplain functions in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py, which compare PKCE code verifiers and challenges using the non-constant-time == operator. A...