Rocky Linux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790063765)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790063765 advisory. - A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompressio...

AlmaLinux 9.2 [TuxCare] Security Update: qemu-guest-agent / qemu-img / qemu-kvm / qemu-kvm-audio-pa / etc (ALMALINUX9.2:CLSA-2026:1779580341)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779580341 advisory. - A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This c...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1788514837)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788514837 advisory. - Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed...

AlmaLinux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790063765)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790063765 advisory. - A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779957268)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779957268 advisory. - Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779957268)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779957268 advisory. - Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through...

PT-2026-103279

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash...

PT-2026-103604

Name of the Vulnerable Software and Affected Versions agentscope versions 1.0.18 through 1.0.19 Description A remote WebSocket user can prompt the agent to execute arbitrary Python code within the service environment. This occurs when the RealtimeAgent session exposes the execute python code tool...

CVE-2026-101881: Allocation of Resources Without Limits or Throttling

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation frames without EndOfMessage to cause...

CVE-2026-103057: Missing Authentication for Critical Function

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...

CVE-2026-102717: Out-of-bounds Read

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash...

CVE-2026-51856: Improper Control of Generation of Code

In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes executepythoncode as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent.acting forwards the...

CVE-2026-103055: Use of Hard-coded Cryptographic Key

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOCREALTIMEJWTSECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access...

PT-2026-103516

Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.7.1 Description The gateway WebSocket transport contains an allocation of resources without limits. This allows connected gateways to exhaust node memory by sending an unending sequence of WebSocket...

PT-2026-103514

Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.7.1-3 Description NodeService capture handlers lack proper authorization, allowing connected gateways or agents to perform unauthorized captures without consent prompts. An attacker can use the node...

PT-2026-102967

Name of the Vulnerable Software and Affected Versions AiSOC versions 5.1.0 through 11.9.9 Description An authentication bypass exists in the realtime service internal endpoints 'POST /internal/agent-event' and 'POST /internal/push'. This allows attackers to submit arbitrary events using spoofed...

CVE-2026-103472: Allocation of Resources Without Limits or Throttling

restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial ...

EUVD-2026-90424

In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes executepythoncode as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent.acting forwards the...

CVE-2026-51856

In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes executepythoncode as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent.acting forwards the...

CVE-2026-51856

In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes executepythoncode as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent.acting forwards the...