Rocky Linux 10.2 [CIQ] Security Update: libXfont2 / libXfont2-debuginfo / libXfont2-debugsource / etc Multiple Vulnerabilities (crlsa-2026_55448)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202655448 advisory. libxfont2: Font Server Client encoding Out-Of-Bounds Read/Write CVE-2026-59679 libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in...

AlmaLinux 9.2 [TuxCare] Security Update: squashfs-tools (ALMALINUX9.2:CLSA-2025:1750782908)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1750782908 advisory. - squashfsopendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create...

Rocky Linux 8 [CIQ] Security Update: qt5-qtbase / qt5-qtbase-common / qt5-qtbase-debuginfo / etc (crlsa-2022_1796)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221796 advisory. qt: out-of-bounds write in QOutlineMapper::convertPath called from QRasterPaintEngine::fill and QPaintEngineEx::stroke CVE-2021-38593 Tenable has extracted the...

CentOS Linux 8.5 [TuxCare] Security Update: grub2-efi-ia32-cdboot / grub2-efi-ia32-modules / grub2-efi-x64 / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2025:1744628858)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2025:1744628858 advisory. - A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG parser of grub2 to incorrectly check the bounds of its...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2026_9345)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20269345 advisory. libpng: libpng: Arbitrary code execution due to use-after-free vulnerability CVE-2026-33416 libpng: libpng: Information disclosure and denial of service vi...

Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_5942)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20265942 advisory. cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61731 net/url: Incorrect parsing of IPv6 host literals in net/url...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1727352561)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1727352561 advisory. - Information exposure through microarchitectural state after transient execution in certain vector execution units for some IntelR...

Rocky Linux 9 [CIQ] Security Update: compat-openssl11 / compat-openssl11-debuginfo / etc (crlsa-2026_19187)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619187 advisory. openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS12 processing CVE-2025-69419 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2025_21702)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202521702 advisory. runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2025-52881 Tenable has extracted the preceding descripti...

AlmaLinux 9.2 [TuxCare] Security Update: libpng15 (ALMALINUX9.2:CLSA-2026:1776424888)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776424888 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. I...

Rocky Linux 8 [CIQ] Security Update: gstreamer1-plugins-base / gstreamer1-plugins-base-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_11345)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202411345 advisory. gstreamer1-plugins-base: GStreamer has a stack-buffer overflow in vorbishandleidentificationpacket CVE-2024-47538 gstreamer1-plugins-base: out-of-bounds...

Rocky Linux 8 [CIQ] Security Update: xz / xz-debuginfo / xz-debugsource / xz-devel / xz-libs / etc (crlsa-2022_4991)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20224991 advisory. gzip: arbitrary-file-write vulnerability CVE-2022-1271 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Ness...

Rocky Linux 8 [CIQ] Security Update: compat-libpthread-nonshared / glibc / glibc-all-langpacks / etc (crlsa-2024_3269)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20243269 advisory. glibc: Out of bounds write in iconv may lead to remote code execution CVE-2024-2961 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2022_1301)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20221301 advisory. Mozilla: Use-after-free in NSSToken objects CVE-2022-1097 Mozilla: Out of bounds write due to unexpected WebAuthN Extensions CVE-2022-28281 Mozilla: Memory...

PT-2026-105172

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:joinTraceDir, Name ++ ".log" where Name comes from PUT /api/traces/:vhost/:name. No safe relative path / traversal check is applied ...

CVE-2026-51873

Devika v1.0 is vulnerable to Directory Traversal in the Coder.savecodetoproject function, which allows attackers to write files outside the intended project workspace...

PT-2026-103908

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, gh teacher download clones each student's assignment repository and then writes autograde artifacts result.json and results.json into the just-cloned working tree. The...

PT-2026-103987

Name of the Vulnerable Software and Affected Versions FortiMail versions 8.0.0 through 8.0.1 FortiMail versions 7.6.0 through 7.6.6 FortiMail versions 7.4.0 through 7.4.8 FortiMail versions 7.2.0 through 7.2.9 Description An unauthenticated path traversal and NULL-byte handling flaw in the GUI...

Linux Distros Unpatched Vulnerability : CVE-2026-102301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute...

PT-2026-105917

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load custom generate. The function fetches and caches a remote module file before performing the required trust...