Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_7343)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20267343 advisory. nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files CVE-2026-32647 NGINX: NGINX: Denial of Service or file modification via...

AlmaLinux 9.6 [TuxCare] Security Update: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785331296)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785331296 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image...

Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_6923)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20266923 advisory. nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files CVE-2026-32647 NGINX: NGINX: Denial of Service or file modification via...

AlmaLinux 9.2 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.2:CLSA-2026:1776766448)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776766448 advisory. - NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpdavmodule module that might allow an attacker to trigger a buffer...

CVE-2026-103255: External Control of File Name or Path

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

AlmaLinux 9.6 [TuxCare] Security Update: java-17-openjdk / java-17-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785494509)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785494509 advisory. - Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the...

CentOS Linux 8 [TuxCare] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1785151654)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1785151654 advisory. - Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the...

EUVD-2026-90293

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured...

CVE-2026-102124 Kiteworks Core Missing Authentication for Critical Function

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured...

CVE-2026-102125 Kiteworks Core Sandbox Escape

The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could...

CVE-2026-102125 Kiteworks Core Sandbox Escape

The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing within that sandbox could potentially escape its confinement and act with the privileges of the service account that runs the application, which could...

CVE-2026-102125

A sandbox escape vulnerability exists in the Kiteworks appliance , specifically within the component responsible for isolating document conversion . The underlying cause is that the sandbox fails to fully confine the code running inside it. An attacker who can execute code within this sandbox may...

CLEANSTART-2024-MV49832 incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to t...

Security vulnerability affects the buildah package. An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary...

CVE-2026-47518

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission assignment for a critical resource allows an attacker with privileged local access to modify protected memory that should be restricted. A successful exploit ...

CVE-2026-47518

The NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability within a secure microcontroller component . The root cause is an incorrect permission assignment for a critical resource, which allows an attacker with privileged local access to modify protected memory that should be re...

CVE-2026-47518

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission assignment for a critical resource allows an attacker with privileged local access to modify protected memory that should be restricted. A successful exploit ...

kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite

A flaw was found in the Linux kernel's netfilter bridge ebtables SNAT Source Network Address Translation module. This vulnerability allows a local attacker on a system configured with specific bridge netfilter rules to improperly modify underlying memory pages during an ARP Address Resolution...

CVE-2026-103044

A flaw was found in the MediaWiki EasyTimeline extension. An Extensible Markup Language XML injection vulnerability exists due to improperly serving image map files as XML data. A remote attacker could exploit this flaw by convincing a user to interact with specially crafted content, potentially...

CVE-2026-92953

A flaw was found in vm2. The sandbox fails to properly isolate host object structures from untrusted code running inside the virtual machine. An attacker can exploit this issue by manipulating object prototype chains to modify shared host prototypes, resulting in prototype pollution the...

CVE-2026-102584

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessme...