Rocky Linux 9 [CIQ] Security Update: crun / crun-debuginfo / crun-debugsource (crlsa-2026_19178)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619178 advisory. crun: crun: Privilege escalation due to incorrect parsing of the --user option CVE-2026-30892 Tenable has extracted the preceding description block directly from t...

AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.2:CLSA-2025:1758709744)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1758709744 advisory. - GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary...

Rocky Linux 8 [CIQ] Security Update: bpftrace / bpftrace-debuginfo / bpftrace-debugsource (crlsa-2024_8830)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20248830 advisory. bpftrace: unprivileged users can force loading of compromised linux headers CVE-2024-2313 Tenable has extracted the preceding description block directly from the CI...

Rocky Linux 8 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2026_25918)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202625918 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2026-28946 webkitgtk: Processing maliciously crafted web...

Rocky Linux 10.2 [CIQ] Security Update: crun / crun-debuginfo / crun-debugsource (crlsa-2026_19020)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619020 advisory. crun: crun: Privilege escalation due to incorrect parsing of the --user option CVE-2026-30892 Tenable has extracted the preceding description block directly fro...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2026:1780067463)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780067463 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS...

CentOS Linux 8.5 [TuxCare] Security Update: git / git-all / git-core / git-core-doc / git-credential-libsecret / etc (CENTOS8.5:CLSA-2025:1750352922)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1750352922 advisory. - Git is a source code management tool. When cloning from a server or fetching, or pushing, informational or error messages are transported...

Rocky Linux 10.1 [CIQ] Security Update: crun / crun-debuginfo / crun-debugsource (crlsa-2026_6622)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20266622 advisory. crun: crun: Privilege escalation due to incorrect parsing of the --user option CVE-2026-30892 Tenable has extracted the preceding description block directly from...

AlmaLinux 9.6 [TuxCare] Security Update: cloud-init (ALMALINUX9.6:CLSA-2026:1779098063)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779098063 advisory. - cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions,...

AlmaLinux 9.6 [TuxCare] Security Update: PackageKit / PackageKit-command-not-found / PackageKit-cron / etc (ALMALINUX9.6:CLSA-2026:1778773906)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778773906 advisory. - PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture...

Rocky Linux 8 [CIQ] Security Update: shim-unsigned-aarch64 Multiple Vulnerabilities (crlsa-2021_1734)

The Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20211734 advisory. grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled CVE-2020-14372 grub2: Use-after-free in rmmod command...

CentOS Linux 6 [TuxCare] Security Update: spamassassin Multiple Vulnerabilities (CENTOS6:CLSA-2026:1777548877)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1777548877 advisory. - A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certai...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging Multiple Vulnerabilities (crlsa-2021_0549)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20210549 advisory. nodejs-mixin-deep: prototype pollution in function mixin-deep CVE-2019-10746 nodejs-set-value: prototype pollution in function set-value CVE-2019-10747...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging Multiple Vulnerabilities (crlsa-2021_0551)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20210551 advisory. nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS CVE-2020-7754 nodejs-y18n: prototype pollution vulnerability...

PT-2026-103741

Name of the Vulnerable Software and Affected Versions Redux Framework versions prior to 4.5.15 Description Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access and above to perform Stored Cross-Site Scripting. Attackers can inject arbitrar...

CVE-2026-90992: Improper Neutralization of Input During Web Page Generation

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

PT-2026-103697

Comelit Multi-User Gateway for VIP System model 1456B firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer administrator account password...

Rocky Linux 9 [CIQ] Security Update: ipa-client / ipa-client-common / ipa-client-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3754)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243754 advisory. freeipa: delegation rules allow a proxy service to impersonate any user to access another target service CVE-2024-2698 freeipa: user can obtain a hash of t...

Rocky Linux 8 [CIQ] Security Update: open-vm-tools / open-vm-tools-debuginfo / open-vm-tools-debugsource / etc Multiple Vulnerabilities (crlsa-2023_7265)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237265 advisory. open-vm-tools: SAML token signature bypass CVE-2023-34058 open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper CVE-2023-3405...

CentOS Linux 6 [TuxCare] Security Update: cups / cups-devel / cups-libs / cups-lpd / cups-php (CENTOS6:CLSA-2026:1778142413)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1778142413 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon...