Rocky Linux 8 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc (crlsa-2025_17509)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517509 advisory. open-vm-tools: Local privilege escalation in open-vm-tools CVE-2025-41244 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc (crlsa-2025_17428)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517428 advisory. open-vm-tools: Local privilege escalation in open-vm-tools CVE-2025-41244 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.6:CLSA-2026:1784888515)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784888515 advisory. - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the...

Rocky Linux 8.6 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc (ciqsa-2026_0129)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260129 advisory. This advisory aggregates security fixes for the open-vm-tools SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2025-41244. Tenable has extracted the preceding...

Rocky Linux 10.0 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2025_7892)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257892 advisory. grafana: Cross-site Scripting XSS in Grafana via Custom Frontend Plugins and Open Redirect CVE-2025-4123 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc (crlba-2026_0860)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlba-20260860 advisory. The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhan...

CentOS Linux 6 [TuxCare] Security Update: quagga / quagga-contrib / quagga-devel (CENTOS6:CLSA-2026:1778170790)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1778170790 advisory. - The Quagga BGP daemon bgpd prior to version 1.2.3 has a bug in its parsing of Capabilities in BGP OPEN messages, in the...

Rocky Linux 9.2 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_0981)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260981 advisory. This advisory aggregates security fixes for the open-vm-tools SRPM in CIQ LTS 9.2. It addresses 2 CVEs: CVE-2023-34058, CVE-2023-34059. Tenable has...

Rocky Linux 8.6 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_0128)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260128 advisory. This advisory aggregates security fixes for the open-vm-tools SRPM in CIQ LTS 8.6. It addresses 4 CVEs: CVE-2023-34058, CVE-2023-34059, CVE-2023-20867,...

Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2024_10987)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202410987 advisory. sinatra: Open Redirect Vulnerability in Sinatra via X-Forwarded-Host Header CVE-2024-21510 Tenable has extracted the preceding description block directly from the...

Rocky Linux 10.2 [CIQ] Security Update: tomcat9 / tomcat9-admin-webapps / tomcat9-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_25341)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202625341 advisory. tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 tomcat: Client certificate verification...

Rocky Linux 9.2 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc (ciqsa-2026_1181)

The Rocky Linux 9.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261181 advisory. This advisory aggregates security fixes for the open-vm-tools SRPM in CIQ LTS 9.2. It addresses 1 CVE: CVE-2025-41244. Tenable has extracted the preceding...

PT-2026-105865

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...

PT-2026-105872

Summary Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, a...

PT-2026-105869

Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...

PT-2026-105870

Summary Any authenticated user can move one of their own folders under itself, leaving a loop in their folder tree. The re-parent endpoint performed no check that the new parent was not the folder itself or one of its own subfolders, and the folder tree walks did not track which folders they had...

Rocky Linux 9 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc (crlsa-2022_6358)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20226358 advisory. open-vm-tools: local root privilege escalation in the virtual machine CVE-2022-31676 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785497476)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785497476 advisory. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat via invalid chunk...

PT-2026-105866

Summary The OIDC back-channel logout endpoint is unauthenticated by design, because the identity provider calls it without a browser session. Before checking whether the submitted logout token was genuine, the handler fetched the provider's discovery document and its signing keys over the network...

PT-2026-105787

Summary A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSH MSG CHANNEL OPEN CONFIRMATION server→client or SSH MSG CHANNEL OPEN client→server. AsyncSSH stores the peer-supplied value...