Rocky Linux 9 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2026_19206)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619206 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2025-43213 webkitgtk: Processing maliciously crafted web...

AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787115646)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787115646 advisory. - Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143...

Rocky Linux 10.2 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc (crlsa-2026_25902)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202625902 advisory. python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens CVE-2026-48526 Tenable has extracted the preceding description block directly from the...

CVE-2026-47096

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...

CVE-2026-47096 AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...

CVE-2026-47096

AJA HELO Plus firmware versions before 2.1.7 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is an unsanitized eParamID_SystemName value accepted through the /config?action=set web configuration API. Unauthenticated attackers with network access can inject malicious Jav...

CVE-2026-103432

A flaw was found in apcupsd. A remote attacker could exploit a stack-based buffer overflow vulnerability in the web monitoring interface by supplying specially crafted data during variable parsing. A successful attack could allow the attacker to execute arbitrary code on the system or cause a...

CVE-2026-49264 vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1, k8s-sidecar, chroma, pgadmin4, datadog-agent-fips, authentik, metaflow-service, litellm, jupyter-base-notebook, ansible-operator-fips, authentik-fips, kubeflow-jupyter-web-app, dask-kubernetes, kubeflow-volumes-web-app,...

GHSA-HJ66-6F7G-4R5V vulnerabilities

Vulnerabilities for packages: openstack-keystone-2026.1, k8s-sidecar, chroma, pgadmin4, datadog-agent-fips, authentik, metaflow-service, litellm, jupyter-base-notebook, ansible-operator-fips, authentik-fips, kubeflow-jupyter-web-app, dask-kubernetes, kubeflow-volumes-web-app,...

GHSA-HJ66-6F7G-4R5V vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, az, kubeflow-pipelines, k8s-sidecar, kubeflow-jupyter-web-app, datadog-agent, dask-kubernetes, open-webui, kserve, ggshield, kubeflow-katib, kubeflow-volumes-web-app, kubeflow-pipelines-visualization-server...

CVE-2026-49264 vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, az, kubeflow-pipelines, k8s-sidecar, kubeflow-jupyter-web-app, datadog-agent, dask-kubernetes, open-webui, kserve, ggshield, kubeflow-katib, kubeflow-volumes-web-app, kubeflow-pipelines-visualization-server...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause a memory corruption issue due to improper state management and result in an unexpected process crash...

webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, leading to memory corruption...

webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, resulting in an unexpected process crash...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper validation checks...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management...

chromium-browser: angle: Chromium: Web origin policy bypass via uninitialized resource in ANGLE

A flaw was found in ANGLE, a component of Chromium. A remote attacker could exploit an uninitialized resource vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to bypass the web origin policy, leading to unauthorized access to...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause a memory corruption issue due to improper state management and result in an unexpected process crash...