Rocky Linux 10.0 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2025_10549)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202510549 advisory. podman: podman missing TLS verification CVE-2025-6032 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...

undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation

A flaw was found in undici. When the cache or deduplicate interceptor is directly composed onto a Client or Pool, the destination origin is omitted from cache and request-deduplication keys. This allows a remote attacker to perform cross-origin cache poisoning, leading to information disclosure a...

CVE-2026-102110

A Kiteworks appliance is vulnerable to a missing authentication flaw in a setup function used during initial activation . An unauthenticated network attacker can repeatedly re-trigger the privileged activation process during this specific window because the endpoint fails to enforce intended stat...

CVE-2026-101879

OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot,...

CVE-2026-102124 Kiteworks Core Missing Authentication for Critical Function

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured...

CVE-2026-102124 Kiteworks Core Missing Authentication for Critical Function

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured...

CVE-2026-102124

The Kiteworks appliance setup interface fails to enforce authentication after the initial configuration is complete. An unauthenticated attacker with network access can read and modify a limited set of setup records, specifically contact names and email addresses captured during the initial setup...

CVE-2026-102150 Kiteworks Secure Data Forms Missing Authentication for Critical Function

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...

CVE-2026-102150

A vulnerability exists in the Kiteworks Advanced Forms component where a specific function is reachable without authentication. An unauthenticated attacker could potentially perform a limited set of internal service operations on the Kiteworks platform. However, the vulnerability does not allow a...

CVE-2026-102150 Kiteworks Secure Data Forms Missing Authentication for Critical Function

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...

Important: Red Hat Security Advisory: python3.12-lxml security update

An update for python3.12-lxml is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

CVE-2026-101879 OpenClaw Windows Node before 2026.7.1-3 Missing Authorization

OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot,...

CVE-2026-101879 OpenClaw Windows Node before 2026.7.1-3 Missing Authorization

OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot,...

CVE-2026-101879 OpenClaw Windows Node before 2026.7.1-3 Missing Authorization

OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot,...

CVE-2026-101879

OpenClaw Windows Node versions prior to 2026.7.1-3 are vulnerable to a missing authorization flaw within the NodeService capture handlers. This security weakness allows connected gateways or agents to bypass consent prompts and perform unauthorized actions by invoking screen.snapshot , camera.sna...

EUVD-2026-90252

OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot,...

CVE-2026-19553

A flaw was found in Python. When establishing secure connections using the SSLContext.wrapbio function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rathe...

CVE-2026-75969

Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified...

CVE-2026-75969 PTZOptics Missing Authentication in Firmware Upload

Missing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A missing authentication vulnerability in the firmware update mechanism of affected PTZOptics cameras allows an unauthenticated user to install modified...