CentOS Linux 8.5 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1785335008)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1785335008 advisory. - Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length...

ROS-20260930-73-0052

The vulnerability in the kernel-lt is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-103536

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description A stored SQL injection exists within an administrative reporting feature. This issue allows an authenticated administrator to read sensitive data from the underlying database and potentially...

TencentOS Server 4: libXfont2 (TSSA-2026:1066)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1066 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

AlmaLinux 9.2 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786499335)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786499335 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-26, an...

AlmaLinux 9.6 [TuxCare] Security Update: nmap / nmap-ncat (ALMALINUX9.6:CLSA-2026:1788628939)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788628939 advisory. - Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6getdataprimitive libnetutil/netutil.cc, so...

Rocky Linux 9.6 [TuxCare] Security Update: nmap / nmap-ncat (ALMALINUX9.6:CLSA-2026:1788628939)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788628939 advisory. - Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6getdataprimitive libnetutil/netutil.cc, ...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1783791447)

"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783791447 advisory. - In the Linux kernel, the following vulnerability has been resolved: phy: mdio: fix memory leak Syzbot reported memory leak in MDI...

SUSE CVE-2026-97399

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker...

SUSE CVE-2026-97920

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the entry count when the histogram stats allocation fails printentries uses nentries both as the number of sort entries and as its own return value, so the -ENOMEM it stores when the stats allocation fails overwrite...

SUSE CVE-2026-101894

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

SUSE CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

SUSE CVE-2026-102567

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent he...

CVE-2026-86136 Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user including a read-only or guest administrator account to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a...

CVE-2026-86136 Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user including a read-only or guest administrator account to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a...

CVE-2026-13224

A path traversal vulnerability exists in the Fireware OS WebUI management agent . This flaw allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request. The vulnerability impacts the confidentiality of local syste...

CVE-2026-90441 Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user including a read-only or guest administrator account to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a...

CVE-2026-90441

The Fireware OS is affected by a missing authorization vulnerability in the wgagent management daemon's session initialization function. An authenticated, low-privileged user—such as a guest or read-only administrator—can submit a specially crafted management API request to crash the wgagent proc...

CVE-2026-13224 Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read

A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request...

CVE-2026-13224 Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read

A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request...