AlmaLinux 9.6 [TuxCare] Security Update: gawk / gawk-all-langpacks / gawk-devel / gawk-doc (ALMALINUX9.6:CLSA-2026:1784623908)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784623908 advisory. - Integer overflow vulnerability has been found in builtin.c program file of gawk. This issue may lead to memory exhaustion on the hosting...

CVE-2026-55177: Server-Side Request Forgery (SSRF)

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-90953: Exposure of Sensitive Information to an Unauthorized Actor

The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators...

Rocky Linux 9.6 [TuxCare] Security Update: gawk / gawk-all-langpacks / gawk-devel / gawk-doc (ALMALINUX9.6:CLSA-2026:1784623908)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784623908 advisory. - Integer overflow vulnerability has been found in builtin.c program file of gawk. This issue may lead to memory exhaustion on the hosting...

Telerik UI for ASP.NET AJAX 2010.1.309 < 2026.2.708 Multiple RadAsyncUpload Vulnerabilities

The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is 2010.1.309 or later and prior to 2026.2.708. It is, therefore, affected by multiple vulnerabilities: - In Progress Telerik UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can...

CentOS Linux 7 [TuxCare] Security Update: gawk (CENTOS7:CLSA-2026:1784131550)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1784131550 advisory. - Integer overflow vulnerability has been found in builtin.c program file of gawk. This issue may lead to memory exhaustion on the hosting...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libheif vulnerabilities (USN-8846-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8846-1 advisory. Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain compressed metadata. A remote...

AlmaLinux 9.2 [TuxCare] Security Update: LibRaw / LibRaw-devel / LibRaw-samples / LibRaw-static Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1785408515)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785408515 advisory. - In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser. CVE-2025-43961 - In LibRaw...

PT-2026-103533

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0 Description An issue exists where the system performs server-side fetches of URLs found within processed message content without sufficient destination restrictions. This allows a...

PT-2026-103073

An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...

CVE-2026-13720: Improper Authorization

An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...

CVE-2026-102095: Server-Side Request Forgery (SSRF)

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote,...

AlmaLinux 9.6 [TuxCare] Security Update: libpng15 (ALMALINUX9.6:CLSA-2026:1779127797)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779127797 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files...

CVE-2026-62146: Trust Boundary Violation

A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside...

DEBIAN-CVE-2026-102938

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

AZL-105672 CVE-2026-102938 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

CVE-2026-102938

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

CVE-2026-102938

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

UBUNTU-CVE-2026-102938

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

CVE-2026-84409

The Lantronix G520 Series Cellular Gateway is vulnerable to a Cross-site Scripting (XSS) flaw in its update mechanism. The device retrieves update metadata over an unencrypted HTTP connection and stores it; a management interface then returns this data in a JSON response, which the web interface ...