CentOS Linux 7 [TuxCare] Security Update: freetype / freetype-demos / freetype-devel (CENTOS7:CLSA-2025:1742926404)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1742926404 advisory. - An out of bounds write exists in FreeType versions 2.13.0 and below newer versions of FreeType are not vulnerable when attempting to parse font...

Rocky Linux 10.1 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_23932)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523932 advisory. httpd: Apache HTTP Server: CGI environment variable override CVE-2025-65082 httpd: Apache HTTP Server: moduserdir+suexec bypass via AllowOverride...

Rocky Linux 8 [CIQ] Security Update: freetype / freetype-debuginfo / freetype-debugsource / etc (crlsa-2025_3421)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20253421 advisory. freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and variable font files CVE-2025-27363 Tenable has extracted the...

Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_23919)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523919 advisory. httpd: Apache HTTP Server: CGI environment variable override CVE-2025-65082 httpd: Apache HTTP Server: moduserdir+suexec bypass via AllowOverride FileInfo...

AlmaLinux 9.2 [TuxCare] Security Update: podman / podman-docker / podman-gvproxy / podman-plugins / etc (ALMALINUX9.2:CLSA-2026:1784074201)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784074201 advisory. - Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc Multiple Vulnerabilities (crlsa-2025_23732)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523732 advisory. httpd: Apache HTTP Server: CGI environment variable override CVE-2025-65082 modmd: Apache HTTP Server: modmd ACME, unintended retry intervals CVE-2025-557...

PT-2026-105809

Impact Users of the python-hyper/hpack library, most commonly used as downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blockin...

PT-2026-105590

Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei...

AlmaLinux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1777942724)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777942724 advisory. - vim is vulnerable to Use of Uninitialized Variable CVE-2021-3928 - Use after free in appendcommand in GitHub repository vim/vim...

CVE-2026-103252: Authorization Bypass Through User-Controlled Key

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request...

PT-2026-103785

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request...

AlmaLinux 9.2 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778009078)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778009078 advisory. - vim is vulnerable to Use of Uninitialized Variable CVE-2021-3928 - vim is vulnerable to Use After Free CVE-2021-3974 - Use after...

Rocky Linux 8 [CIQ] Security Update: wavpack / wavpack-debuginfo / wavpack-debugsource / wavpack-devel Multiple Vulnerabilities (crlsa-2020_1581)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20201581 advisory. wawpack: Infinite loop in WavpackPackInit function lead to DoS CVE-2018-19840 wawpack: Out-of-bounds read in WavpackVerifySingleBlock function leads to DoS...

CLEANSTART-2026-MQ70542 If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", "

Security vulnerability affects the buildkitd package. If the PATH environment variable contains paths which are executables rather than just directories, passing certain strings to LookPath "", "...

CVE-2026-101884 OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GITCONFIG, DOTNETSTARTUPHOOKS, and JAVATOOLOPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or...

EUVD-2026-90257

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GITCONFIG, DOTNETSTARTUPHOOKS, and JAVATOOLOPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or...

CVE-2026-101884 OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GITCONFIG, DOTNETSTARTUPHOOKS, and JAVATOOLOPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or...

CVE-2026-101884 OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GITCONFIG, DOTNETSTARTUPHOOKS, and JAVATOOLOPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or...

CVE-2026-101884: Incomplete List of Disallowed Inputs

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GITCONFIG, DOTNETSTARTUPHOOKS, and JAVATOOLOPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or...

PT-2026-103519

Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.7.1 Description An incomplete environment-variable sanitizer in the system.run function fails to block specific variables. Attackers with gateway or agent access can supply GIT CONFIG , DOTNET START...