PT-2026-105905

Impact RestrictedPython could allow a sandbox escape when a policy exposes the standard library string module, or otherwise exposes string.Formatter, to restricted code. string.Formatter field resolution methods such as get field can perform attribute and item traversal internally and return live...

PT-2026-103914

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

PT-2026-105795

Impact The djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling import module path, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before an...

PT-2026-105859

Impact What kind of vulnerability is it? Who is impacted? It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's help text, which is rendered with Django's |safe filter render field.html, bypassing auto-escaping. In both...

PT-2026-105917

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load custom generate. The function fetches and caches a remote module file before performing the required trust...

Rocky Linux 9 [CIQ] Security Update: perl-Module-ScanDeps (crlsa-2025_7350)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20257350 advisory. module-scandeps: local privilege escalation via unsanitized input CVE-2024-10224 Tenable has extracted the preceding description block directly from the CIQ securit...

Rocky Linux 8 [CIQ] Security Update: platform-python-setuptools / python3-setuptools / etc (crlsa-2024_5530)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20245530 advisory. pypa/setuptools: Remote code execution via download functions in the packageindex module in pypa/setuptools CVE-2024-6345 Tenable has extracted the preceding...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / numpy-debugsource / etc Multiple Vulnerabilities (crlsa-2023_7034)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237034 advisory. python: tarfile module directory traversal CVE-2007-4559 python-requests: Unintended leak of Proxy-Authorization header CVE-2023-32681 Tenable has extracte...

CentOS Linux 8 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS-STREAM8:CLSA-2026:1789719542)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1789719542 advisory. - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1769775296)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1769775296 advisory. - A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm...

Rocky Linux 9.6 [TuxCare] Security Update: pipewire / pipewire-alsa / pipewire-devel / pipewire-doc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788871614)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788871614 advisory. - RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return. CVE-2026-14324 - Multiple unbounde...

CentOS Linux 8.4 [TuxCare] Security Update: python2 / python2-debug / python2-devel / python2-libs / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1782983048)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1782983048 advisory. - The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member...

Rocky Linux 9.6 [TuxCare] Security Update: opensc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778674879)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778674879 advisory. - A vulnerability was found in OpenSC, OpenSC tools, PKCS11 module, minidriver, and CTK. An attacker could use a crafted USB Devic...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2025:1751144408)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751144408 advisory. - A defect was discovered in the Python ssl module where there is a memory race condition with the ssl.SSLContext methods certstorestats and...

CentOS Linux 8.4 [TuxCare] Security Update: python2 / python2-debug / python2-devel / python2-libs / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1789992787)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1789992787 advisory. - When using the tarfile module with a file opened in streaming mode mode=r| the tarfile module did not properly handle EOF, making...

CentOS Linux 7 [TuxCare] Security Update: python3 / python3-debug / python3-devel / python3-idle / etc (CENTOS7:CLSA-2026:1778880543)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1778880543 advisory. - The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as globally reachable or...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2024:1711648611)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1711648611 advisory. - The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an...

CVE-2026-103588 QloApps through 1.7.0 Reflected XSS via exceptions field

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

rsync: rsync: Unauthorized File Access via Symlink Module Root

A flaw was found in rsync. This path traversal vulnerability allows remote clients to access files outside the intended module root. This occurs when the use chroot option is disabled and the module root path, or a component of it, is a symbolic link. The rsync daemon fails to resolve symlinks...

CLEANSTART-2026-MP78954 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

CVE-2026-56865 affects multiple packages. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. See references for individual vulnerabilit...