Rocky Linux 9.6 [TuxCare] Security Update: git-lfs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789464832)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789464832 advisory. - Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large...

Rocky Linux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc (ALMALINUX9.6:CLSA-2026:1779789234)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779789234 advisory. - NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade...

AlmaLinux 9.6 [TuxCare] Security Update: git-lfs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789464832)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789464832 advisory. - Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large...

CentOS Linux 6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS6:CLSA-2026:1787083167)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1787083167 advisory. - Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file...

AlmaLinux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc (ALMALINUX9.6:CLSA-2026:1779789234)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779789234 advisory. - NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade...

CentOS Linux 7 [TuxCare] Security Update: bsdcpio / bsdtar / libarchive / libarchive-devel Multiple Vulnerabilities (CENTOS7:CLSA-2026:1777544831)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1777544831 advisory. - An improper link resolution flaw while extracting an archive can lead to changing the access control list ACL of the target of the lin...

MGASA-2026-0462 Updated fuse-overlayfs package fixes security vulnerabilities

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/openOTRUNC. CVE-2026-52791 Operations on hardlinked lower-layer files resolving to the wrong layer. CVE-2026-77478...

CVE-2026-102242

Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...

EUVD-2026-89186

Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CLEANSTART-2026-BJ90324 Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4

Security vulnerability affects the spark-sc212-jdk17-py311 package. Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4...

PT-2026-102751

Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2026-3933)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.5226.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3933 advisory. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a...

CVE-2026-95334: Use of Incorrectly-Resolved Name or Reference

Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...

Linux Distros Unpatched Vulnerability : CVE-2026-87798

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 fixed in 4.0.14, 5.0.10 and 5.21.8 o...

Linux Distros Unpatched Vulnerability : CVE-2026-87799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an...

CVE-2026-102242: Improper Link Resolution Before File Access

Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...

SUSE CVE-2026-75036

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet...