Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_54243)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654243 advisory. grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana: Denial of Service due to excessive memory allocation via...

Rocky Linux 9.4 [CIQ] Security Update: rubygem-json / rubygem-json-debuginfo (ciqsa-2026_1290)

The Rocky Linux 9.4 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261290 advisory. This advisory aggregates security fixes for the ruby SRPM in CIQ LTS 9.4. It addresses 1 CVE: CVE-2024-49761. Tenable has extracted the preceding description bloc...

CVE-2026-103292: Improper Neutralization of Input During Web Page Generation

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

CVE-2026-104182: Inefficient Algorithmic Complexity

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

PT-2026-103824

Name of the Vulnerable Software and Affected Versions Ghost versions 0.5.3 through 6.49.9 Description Insufficient sanitization of data within the JSON-LD HTML tag emitted by the ghost head helper allows an authenticated user with limited privileges to inject unescaped content. This content is...

PT-2026-104011

Name of the Vulnerable Software and Affected Versions stream-json versions prior to 3.6.0 Description The Assembler component materializes object properties using plain assignment. When an input key is named proto , it invokes the inherited setter, leading to the replacement of the parsed object...

PT-2026-105861

Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output...

CVE-2026-104183: Improperly Controlled Modification of Object Prototype Attributes

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the inherited setter and causes parsed object prototype replacemen...

PT-2026-103666

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments versions prior to 1.6.12.33 Description An issue exists that allows unauthenticated attackers to extract customer personally identifiable information PII, such as names, email addresses, phone numbers, and custom...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1783354657)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783354657 advisory. - The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger...

Rocky Linux 10.2 [CIQ] Security Update: jq / jq-debuginfo / jq-debugsource / jq-devel Multiple Vulnerabilities (crlsa-2026_19151)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619151 advisory. jq: out-of-bounds read in jvparsesized on error formatting for non-NUL-terminated buffers CVE-2026-39979 jq: jq: Denial of Service via crafted JSON...

Rocky Linux 9 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc (crlsa-2026_26206)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202626206 advisory. python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens CVE-2026-48526 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: python3.12-PyMySQL / python3.12-PyMySQL+rsa (crlsa-2024_9193)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20249193 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2026_54184)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202654184 advisory. grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads CVE-2026-42127 Tenable has extracted the preceding description block...

AlmaLinux 9.2 [TuxCare] Security Update: haproxy (ALMALINUX9.2:CLSA-2025:1764324159)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764324159 advisory. - Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON...

Rocky Linux 9 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource (crlsa-2025_0161)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20250161 advisory. iperf: Denial of Service in iperf Due to Improper JSON Handling CVE-2024-53580 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: iperf3 / iperf3-debuginfo / iperf3-debugsource (crlsa-2025_0168)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20250168 advisory. iperf: Denial of Service in iperf Due to Improper JSON Handling CVE-2024-53580 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: perl-JSON-XS / perl-JSON-XS-debuginfo / perl-JSON-XS-debugsource (crlsa-2025_17162)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517162 advisory. JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON CVE-2025-40928 Tenable has extracted the preceding description block directly from th...

AlmaLinux 9.6 [TuxCare] Security Update: iperf3 / iperf3-devel (ALMALINUX9.6:CLSA-2026:1788821988)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788821988 advisory. - A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized numeri...

Rocky Linux 8 [CIQ] Security Update: python3.12-PyMySQL (crlsa-2024_4245)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20244245 advisory. python-pymysql: SQL injection if used with untrusted JSON input CVE-2024-36039 Tenable has extracted the preceding description block directly from the CIQ security...