Rocky Linux 8 [CIQ] Security Update: systemd / systemd-container / systemd-container-debuginfo / etc (crlsa-2024_3203)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243203 advisory. systemd-resolved: Unsigned name response in signed zone is not refused when DNSSEC=yes CVE-2023-7008 Tenable has extracted the preceding description block directly...

Rocky Linux 9 [CIQ] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc (crlsa-2024_2463)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20242463 advisory. systemd-resolved: Unsigned name response in signed zone is not refused when DNSSEC=yes CVE-2023-7008 Tenable has extracted the preceding description block directly...

Rocky Linux 8 [CIQ] Security Update: systemd / systemd-container / systemd-container-debuginfo / etc (crlsa-2022_6206)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20226206 advisory. systemd-resolved: use-after-free when dealing with DnsStream in resolved-dns-stream.c CVE-2022-2526 Tenable has extracted the preceding description block directly...

AlmaLinux 9.2 [TuxCare] Security Update: systemd / systemd-boot-unsigned / systemd-container / systemd-devel / etc (ALMALINUX9.2:CLSA-2024:1722535503)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1722535503 advisory. - A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when...

ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included...

GHSA-W3RP-4CM2-4WGC ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

Impact Type: Improper authorization leading to unauthorized movement of user funds. The x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included...

CVE-2026-61604

Prior to v8.0.0 , the ixo Blockchain (Layer 1) x/bonds module contained a flaw where funds could be moved from addresses resolved via DID verification methods without verifying ownership by the transaction signer. An attacker could register a victim's address as a verification method on their own...

CVE-2026-61604 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...

CVE-2026-61604 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...

CVE-2026-61604 ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...

CLEANSTART-2026-QE34516 Security fix for CVE-2025-46817 applied in: redis 7.2.11-r0, redis 7.4.6-r0, redis 8.0.4-r0, redis 8.2.2-r0

CVE-2025-46817 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LM41855 Security fix for CVE-2026-33812 applied in: gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, mailpit 1.29.6-r0, mailpit-fips 1.29.6-r0, ollama 0.20.3-r1, ollama 0.31.2-r2, ollama 0.32.11-r3, ollama-fips 0.18.3-r0, ollama-fips 0.21.0-r0, ollama-fips 0.32.11-r2, ollama-fips 0.32.9-r1

CVE-2026-33812 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CD57328 Security fix for CVE-2026-44903 applied in: amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, amazon-cloudwatch-agent-fips 1.300069.0-r1, certificate-transparency-trillian-ctserver 1.3.2-r2, certificate-transparency-trillian-ctserver-fips 1.3.2-r0, elastic-beats 9.2.8-r6, grafana 12.2.10-r1, grafana 12.3.10-r1, grafana 12.4.7-r1, grafana 12.4.9-r1, grafana 13.0.5-r1, grafana 13.0.7-r1, helm-operator-fips 1.41.1-r2, istio 1.29.2-r1, istio-fips 1.30.0-r0, istio-pilot-discovery 1.28.3-r1, istio-pilot-discovery-fips 1.28.3-r1, keda 2.19.0-r3, keda-fips 2.18.3-r3, keda-fips 2.19.0-r2, metrics-server 0.8.1-r5, pmm 3.5.0-r0, prometheus-operator 0.69.1-r1, prometheus-operator 0.87.1-r3, prometheus-pushgateway 1.10.0-r3, prometheus-pushgateway 1.8.0-r3, prometheus-pushgateway 1.9.0-r1, prometheus-pushgateway-fips 1.10.0-r3, prometheus-pushgateway-fips 1.11.3-r1, prometheus-pushgateway-fips 1.8.0-r2, tempo 2.10.4-r1

CVE-2026-44903 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CD10863 Security fix for CVE-2026-45674 applied in: apache-hive 4.2.0-r5, apache-nifi 2.9.0-r1, elasticsearch 9.2.7-r0, elasticsearch 9.2.8-r0, elasticsearch 9.3.5-r2, elasticsearch 9.3.7-r0, elasticsearch 9.4.3-r0, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r2, kafka-ui 1.4.2-r6, keycloak 26.3.5-r3, keycloak 26.4.2-r0, keycloak 26.4.7-r3, keycloak 26.5.7-r1, keycloak 26.6.3-r2, s3proxy 3.3.0-r1, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

CVE-2026-45674 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OD95693 Security fix for CVE-2026-44249 applied in: apache-hive 4.2.0-r5, apache-nifi 2.9.0-r1, apache-nifi-registry 2.9.0-r3, cassandra 5.0.8-r1, cassandra-reaper-fips 3.8.0-r9, cassandra-reaper-fips 4.0.2-r3, cassandra-reaper-fips 4.1.1-r3, cassandra-reaper-fips 4.2.5-r1, cloud-config-server 4.3.2-r3, elasticsearch 9.2.7-r0, elasticsearch 9.2.8-r0, elasticsearch 9.3.5-r2, elasticsearch 9.3.7-r0, elasticsearch 9.4.3-r0, hazelcast 5.7.0-r1, incubator-kie-kogito-data-index-ephemeral 10.1.0-r2, kafka-ui 1.4.2-r6, keycloak 26.3.5-r3, keycloak 26.4.10-r1, keycloak 26.4.2-r0, keycloak 26.4.7-r3, keycloak 26.5.6-r6, keycloak 26.5.7-r1, keycloak 26.6.1-r3, keycloak 26.6.3-r2, kserve-modelmesh 0.12.0-r17, s3proxy 3.3.0-r1, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, wildfly 41.0.0-r1

CVE-2026-44249 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GK74613 Security fix for CVE-2026-55833 applied in: apache-activemq-artemis 2.56.0-r1, apache-nifi 2.10.0-r3, elasticsearch 9.1.10-r1, elasticsearch 9.2.8-r1, elasticsearch 9.3.5-r3, elasticsearch 9.3.8-r1, elasticsearch 9.4.4-r4, hazelcast 5.7.0-r1, keycloak 26.5.7-r7, keycloak 26.7.1-r0, logstash-fips 9.4.3-r1, strimzi-kafka-operator 1.1.0-r2

CVE-2026-55833 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-90386

In the Linux kernel, the following vulnerability has been resolved: i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices On an empty bus ENTDAA assigns nothing, so cmd-rxlen the count of addresses left unassigned equals master-maxdevs. The GENMASK index master-maxdevs - cmd-rxlen - 1 th...

CVE-2026-93112

In the Linux kernel, the following vulnerability has been resolved: bpf: Require a BPF cpumask for bpfcpumaskpopulate bpfcpumaskpopulate writes to its destination with bitmapcopy, but the destination is typed as struct cpumask . That allows the verifier to accept borrowed cpumask pointers returne...

UBUNTU-CVE-2026-93123

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: do not advance stale DMA completions The qcom GENI serial DMA TX completion path advances the transmit fifo by the number of bytes recorded in port-txremaining. If uartflushbuffer runs after the hardware has...

UBUNTU-CVE-2026-93192

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Clear queue-activejob when v3dfencecreate fails The runjob callbacks for BIN, RENDER, TFU and CSD assign the incoming job to queue-activejob before calling v3dfencecreate. If v3dfencecreate fails, the callback returns NU...