ROS-20261001-73-0016

The vulnerability in perl-YAML-Syck is related to reading beyond the buffer limit in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-105787

Summary A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSH MSG CHANNEL OPEN CONFIRMATION server→client or SSH MSG CHANNEL OPEN client→server. AsyncSSH stores the peer-supplied value...

CVE-2026-56589: Improper Neutralization of Input During Web Page Generation

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data...

Rocky Linux 9 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_6340)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20266340 advisory. freerdp: FreeRDP heap-use-after-free CVE-2026-22856 freerdp: FreeRDP heap-buffer-overflow CVE-2026-22854 freerdp: FreeRDP heap-buffer-overflow CVE-2026-228...

Rocky Linux 8 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_6918)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20266918 advisory. freerdp: FreeRDP heap-use-after-free CVE-2026-22856 freerdp: FreeRDP heap-buffer-overflow CVE-2026-22854 freerdp: FreeRDP heap-buffer-overflow CVE-2026-228...

Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_7402)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257402 advisory. nginx: Memory corruption in the ngxhttpmp4module CVE-2022-41741 nginx: Memory disclosure in the ngxhttpmp4module CVE-2022-41742 nginx: specially crafted MP...

Rocky Linux 8 [CIQ] Security Update: bind / bind-chroot / bind-debuginfo / bind-debugsource / bind-devel / etc (crlsa-2026_8352)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20268352 advisory. bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone CVE-2026-1519 Tenable has extracted the preceding description block directly from the CI...

PT-2026-105194

RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/vhost/name reques...

PT-2026-103657

Name of the Vulnerable Software and Affected Versions ASUS router affected versions not specified Description An Active Debug Code issue allows a remote authenticated user to bypass security mechanisms by sending a crafted HTTP request. This action enables the Telnet service, allowing the executi...

PT-2026-105911

Impact The SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

PT-2026-105093

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

PT-2026-105090

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130...

PT-2026-105094

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

PT-2026-105096

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

PT-2026-105105

Uncontrolled Resource Consumption CWE-400 in Kibana can lead denial of service via Excessive Allocation CAPEC-130...

PT-2026-103961

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read SELECT queries, this does not write to the...

PT-2026-103901

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks...

AlmaLinux 9.2 [TuxCare] Security Update: libtiff / libtiff-devel / libtiff-static / libtiff-tools Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1745271345)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1745271345 advisory. - A NULL pointer dereference in TIFFClose is caused by a failure to open an output file non-existent path or a path that requires...

CentOS Linux 8.4 [TuxCare] Security Update: python3-rrdtool / rrdtool / rrdtool-devel / rrdtool-doc / etc (CENTOS8.4:CLSA-2026:1783688821)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1783688821 advisory. - A flaw was found in rrdcached, a component of rrdtool. A local attacker with access to a rrdcached socket can exploit a stack-based buffer...

Rocky Linux 9.6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_autofs / libsss_certmap / etc (ALMALINUX9.6:CLSA-2026:1787733592)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787733592 advisory. - A flaw was found in SSSD. The sssnssprotocolparseaddr function in the NSS responder does not validate the addrlen field against the...