Rocky Linux 9.6 [TuxCare] Security Update: mod_http2 (ALMALINUX9.6:CLSA-2026:1781259837)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781259837 advisory. - Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's modhttp leads to denial of service via malicious HTTP...

PT-2026-103541

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0 Description A Server-Side Request Forgery SSRF weakness allows a remote, unauthenticated attacker to force the gateway to send crafted requests to internal or unintended network...

CentOS Linux 7 [TuxCare] Security Update: emacs-git / emacs-git-el / git / git-all / git-bzr / git-cvs / etc Multiple Vulnerabilities (CENTOS7:CLSA-2024:1712672592)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2024:1712672592 advisory. - gitconnectgit in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpecte...

The vulnerabilities of the functions pcrypt_aead_done(), pcrypt_aead_enc(), and pcrypt_aead_dec() in the crypto/pcrypt.c module of the Linux operating system allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the functions pcryptaeaddone, pcryptaeadenc, and pcryptaeaddec in the crypto/pcrypt.c module of the Linux operating system is related to errors in handling asynchronous cryptographic requests. Exploiting this vulnerability can allow a remote attacker to compromise the...

CentOS Linux 7 [TuxCare] Security Update: ctdb / ctdb-tests / libsmbclient / libsmbclient-devel / libwbclient / etc (CENTOS7:CLSA-2026:1778604245)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1778604245 advisory. - A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1776763201)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776763201 advisory. - A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF Carriage Return Line Feed Injection, occurs...

Rocky Linux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.6:CLSA-2026:1779126860)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779126860 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttprewritemodule module. This vulnerability exists when the rewrite...

Linux Distros Unpatched Vulnerability : CVE-2026-101905

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request optio...

CVE-2026-102091: Server-Side Request Forgery (SSRF)

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

PT-2026-103529

Name of the Vulnerable Software and Affected Versions Kiteworks Secure Data Forms versions prior to 9.5.0 Description An issue exists that allows an unauthenticated remote attacker to perform Server-Side Request Forgery SSRF, a technique where the attacker induces the server to make requests to a...

CentOS Linux 8.5 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.5:CLSA-2026:1779893017)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1779893017 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttprewritemodule module. This vulnerability exists when the rewrite...

CVE-2026-100291

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations...

EUVD-2026-89366

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations...

CVE-2026-100291 Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations...

CVE-2026-102821

A flaw was found in russh. An authenticated remote attacker can cause a Denial of Service DoS by initiating a Secure Shell SSH key renegotiation without completing it and flooding the server with channel open requests. Because the server continues buffering incoming requests without draining the...

CVE-2026-84784

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by flooding a connection with connection identifier update requests while withholding acknowledgments. This behavior bypasses connection limits and forces the system to accumulate pending retirement frames, resulting...

EUVD-2026-88960

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

Exposure Of Data Element To Wrong Session

org.apache.struts, struts2-json-plugin is vulnerable to an exposure of data element to wrong session. The vulnerability is due to per-request JSON parsing state being shared across concurrent requests, which allows an attacker to potentially observe data associated with another request and bypass...

CVE-2026-54160

A flaw was found in Network UPS Tools NUT. The project's automated workflow improperly runs untrusted code submitted in pull requests within an environment that holds elevated write privileges. A remote attacker can exploit this flaw by submitting a malicious pull request to achieve arbitrary cod...

Epson EH-TW5350 150075647YWWV110 Authentication Bypass

Epson EH-TW5350 version 150075647YWWV110 contains an authentication bypass vulnerability that may allow a remote attacker to cause denial of service via specially crafted HTTP requests...