dogtag-pki security update

An update is available for dogtag-pki. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list IdM PKI is an enterprise software system designed to manage enterprise...

RLSA-2026:73766 Important: pki-core security update

The Public Key Infrastructure PKI Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fixes: pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content ExternalProcessConstraint CVE-2026-76561 pki-cor...

pki-core security update

An update is available for pki-core. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Public Key Infrastructure PKI Core contains fundamental packages require...

CVE-2026-92537 Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route /tnp/l/ is registered with permissioncallback = 'returntrue' and, upon receiving...

CVE-2026-92537 Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route /tnp/l/ is registered with permissioncallback = 'returntrue' and, upon receiving...

PT-2026-103861

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw datachannels value in i readraw wiol. Nothing range-checks raw datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large...

PT-2026-105819

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...

CVE-2026-92537: Insufficiently Protected Credentials

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route /tnp/l/ is registered with permissioncallback = 'returntrue' and, upon receiving...

AlmaLinux 9.2 [TuxCare] Security Update: nmap / nmap-ncat (ALMALINUX9.2:CLSA-2026:1788629925)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788629925 advisory. - Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6getdataprimitive libnetutil/netutil.cc, so...

Linux Distros Unpatched Vulnerability : CVE-2026-102272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.preparekey in jwt/algorithms.py is affected because raw-JW...

AlmaLinux 9.6 [TuxCare] Security Update: nmap / nmap-ncat (ALMALINUX9.6:CLSA-2026:1788628939)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788628939 advisory. - Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6getdataprimitive libnetutil/netutil.cc, so...

ALSA-2026:73765 Important: dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: Certificate Authority CA Key Recovery Authority KRA Online Certificate Status Protocol OCSP Manager Token Key Service TKS Token Processing...

AlmaLinux 9.6 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789738618)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789738618 advisory. - Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses Pillow which is vulnerable to CVE-2026-54058, CVE-2026-59197, CVE-2026-59198, CVE-2026-59199, CVE-2026-59200, CVE-2026-59203, CVE-2026-59204, CVE-2026-59205

Summary IBM Maximo Application Suite - Visual Inspection component uses Pillow which is vulnerable to CVE-2026-54058, CVE-2026-59197, CVE-2026-59198, CVE-2026-59199, CVE-2026-59200, CVE-2026-59203, CVE-2026-59204, CVE-2026-59205, This bulletin contains information regarding the vulnerability and...

PT-2026-105972

Using the IdentityBasedStrategy setting when calling Device::encrypt event raw or OlmMachine::encrypt content for devices may cause a panic if the recipient does not have cross-signing keys...

ROS-20260929-73-0013

The vulnerability of the drivers/mtd/nand/raw/cadence-nand-controller.c component in the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

CVE-2026-102269

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation. This occurs when non-Base64URL characters are appended to a valid compact JWS...

GHSA-J3R3-MXQP-R2P4 Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization of ProcessingInstruction DOM nodes , nodeType === 7 when nested inside fallback raw-content elements , , , . While processing instruction data escaped to , it did not check for or...

EUVD-2026-75681

Angular SSR: XSS via Unescaped Processing Instruction Nodes in Fallback Raw-Content Elements...

Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization of ProcessingInstruction DOM nodes , nodeType === 7 when nested inside fallback raw-content elements , , , . While processing instruction data escaped to , it did not check for or...