PT-2026-103930

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.68 Description A Use After Free issue exists in the mod http2 module of the Apache HTTP Server. This occurs via shared session bbtmp re-entrancy, which can lead to memory corruption when the system...

CentOS Linux 6 [TuxCare] Security Update: cups / cups-devel / cups-libs / cups-lpd / cups-php (CENTOS6:CLSA-2026:1777541087)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1777541087 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a...

PT-2026-105871

Summary Any member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778863931)

"The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778863931 advisory. - In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transf...

Rocky Linux 9 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel (crlsa-2023_0337)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230337 advisory. expat: use-after free caused by overeager destruction of a shared DTD in XMLExternalEntityParserCreate CVE-2022-43680 Tenable has extracted the preceding descriptio...

CentOS Linux 8 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (CENTOS-STREAM8:CLSA-2026:1777392623)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1777392623 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a...

Rocky Linux 8 [CIQ] Security Update: bluez / bluez-cups / bluez-cups-debuginfo / bluez-debuginfo / etc (crlsa-2021_1598)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20211598 advisory. bluez: double free in gatttool client disconnect callback handler in src/shared/att.c could lead to DoS or RCE CVE-2020-27153 Tenable has extracted the preceding...

CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc (CENTOS-STREAM8:CLSA-2026:1778783464)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1778783464 advisory. - In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing...

Rocky Linux 8 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel (crlsa-2023_0103)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230103 advisory. expat: use-after free caused by overeager destruction of a shared DTD in XMLExternalEntityParserCreate CVE-2022-43680 Tenable has extracted the preceding descriptio...

CentOS Linux 8.4 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (CENTOS8.4:CLSA-2026:1777392877)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1777392877 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2026-3963)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.5226.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3963 advisory. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a...

Rocky Linux 8 [CIQ] Security Update: aopalliance / apache-commons-cli / apache-commons-codec / etc (crlsa-2022_4798)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20224798 advisory. maven-shared-utils: Command injection via Commandline class CVE-2022-29599 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: aopalliance / apache-commons-cli / apache-commons-codec / etc (crlsa-2022_4797)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20224797 advisory. maven-shared-utils: Command injection via Commandline class CVE-2022-29599 Tenable has extracted the preceding description block directly from the CIQ security...

PT-2026-103910

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

AlmaLinux 9.2 [TuxCare] Security Update: podman / podman-docker / podman-gvproxy / podman-plugins / etc (ALMALINUX9.2:CLSA-2025:1766050574)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1766050574 advisory. - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an...

CentOS Linux 7 [TuxCare] Security Update: gzip (CENTOS7:CLSA-2026:1783589413)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1783589413 advisory. - GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2022_6437)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226437 advisory. Incomplete cleanup of multi-core shared buffers aka SBDR CVE-2022-21123 Incomplete cleanup of microarchitectural fill buffers aka SBDS CVE-2022-21125...

grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards

A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw to retrieve...

Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange

Vulnerability The hybrid ML-KEM 768 + X25519 key exchange implementation in russh/src/kex/hybridmlkem.rs does not validate that the remote peer's X25519 public key is not the zero point all-zero 32-byte value. This allows a remote peer to force the X25519 contribution to the combined shared secre...

CVE-2026-102122

The Kiteworks Core platform contains an incorrect authorization vulnerability where the system fails to properly restrict role assignments for shared folders. In a default configuration, an authenticated user with the Manager role can escalate their privileges by granting themselves or other fold...