Rocky Linux 9 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc (crlba-2025_20841)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlba-202520841 advisory. For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section. This advisory is provided by Ctrl IQ,...

Rocky Linux 9 [CIQ] Security Update: isns-utils / isns-utils-debuginfo / isns-utils-debugsource / etc (crlsa-2026_53847)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202653847 advisory. open-isns: open-iscsi: Denial of Service via double-free in iSNS attribute decoder CVE-2026-55995 Tenable has extracted the preceding description block directly fr...

PT-2026-105873

Summary When more than one external tool server is reachable in the same request, a tool call to a server configured for bearer authentication can arrive carrying the calling user's Open WebUI session cookies alongside that server's own key. The cookie jar is built per connection, but the callabl...

Rocky Linux 9.6 [TuxCare] Security Update: hwloc / hwloc-devel / hwloc-gui / hwloc-libs / hwloc-plugins (ALMALINUX9.6:CLSA-2026:1785770281)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785770281 advisory. - An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpus...

Rocky Linux 9.4 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc (ciqsa-2026_0556)

The Rocky Linux 9.4 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260556 advisory. This advisory aggregates security fixes for the open-vm-tools SRPM in CIQ LTS 9.4. It addresses 1 CVE: CVE-2025-41244. Tenable has extracted the preceding...

PT-2026-104018

Name of the Vulnerable Software and Affected Versions Powertools for AWS Lambda Python versions prior to 3.35.0 Description A fail-open error handling issue exists within the data masking utility. This flaw may allow actors to read sensitive field values that the application intended to mask...

ROS-20261001-73-0041

The vulnerability in rclone relates to the transmission of data in an open manner. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2026-82357: NULL Pointer Dereference

RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromise...

CVE-2026-104002: Detection of Error Condition Without Action

A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda Python might allow actors to read sensitive field values that the application intended to mask. To remediate this issue, users should upgrade to version 3.35.0...

Rocky Linux 10.2 [CIQ] Security Update: iscsi-initiator-utils / iscsi-initiator-utils-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_53845)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202653845 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

Rocky Linux 8 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc (crlsa-2022_6357)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20226357 advisory. open-vm-tools: local root privilege escalation in the virtual machine CVE-2022-31676 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2025_7893)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257893 advisory. grafana: Cross-site Scripting XSS in Grafana via Custom Frontend Plugins and Open Redirect CVE-2025-4123 grafana: Cross-site Scripting XSS in Grafana via Custom...

Rocky Linux 8 [CIQ] Security Update: isns-utils / isns-utils-debuginfo / isns-utils-debugsource / etc (crlsa-2026_53848)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202653848 advisory. open-isns: open-iscsi: Denial of Service via double-free in iSNS attribute decoder CVE-2026-55995 Tenable has extracted the preceding description block directly fr...

PT-2026-105868

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without applying the email domain allowlist that the normal OAuth login callback enforces. An account whose email domain the login callback would refuse could still obtain a working session through thi...

Rocky Linux 9 [CIQ] Security Update: image-builder / image-builder-debuginfo / image-builder-debugsource Multiple Vulnerabilities (crlsa-2026_67138)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202667138 advisory. golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27136 golang.org/x/net/html:...

CVE-2026-83589: URL Redirection to Untrusted Site

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter rd during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an...

CVE-2026-82358: Incorrect Authorization

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO Service Data Object server implementation 'src/cosdoserver.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload fo...

VulnCheck KEV: CVE-2021-36580

Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 13.0.1.2 via the referer parameter...

PT-2026-105876

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

Rocky Linux 8 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc Multiple Vulnerabilities (crlsa-2023_7265)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237265 advisory. open-vm-tools: SAML token signature bypass CVE-2023-34058 open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper CVE-2023-3405...