PT-2026-61735

Name of the Vulnerable Software and Affected Versions GRAPHIFY versions 0.3.2 through 0.4.29 Description A remote attacker can execute arbitrary code through the validate url, safe fetch, build opener, fetch html, and download binary functions. Recommendations At the moment, there is no informati...

.NET 8.0 security, bug fix, and enhancement update

8.0.129-1.0.1 - Add support for Oracle Linux 8.0.129-1 - Update to .NET SDK 8.0.129 and Runtime 8.0.29 - Resolves: RHEL-192468 8.0.128-2 - Reduce time to detect hanging builds - Resolves: RHEL-191650...

.NET 8.0 security, bug fix, and enhancement update

8.0.129-1.0.1 - Add support for Oracle Linux 8.0.129-1 - Update to .NET SDK 8.0.129 and Runtime 8.0.29 - Resolves: RHEL-192467 8.0.128-2 - Reduce time to detect hanging builds - Resolves: RHEL-191652...

AZL-92781 CVE-2026-63881 affecting package kernel for versions less than 6.6.143-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger getqueueids computes arraysize = numqueues sizeofuint32t, which could overflow on 32-bit sizet build. using arraysize instead, it saturates to SIZEMAX on overflo...

CVE-2026-63994 tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skbcow in iptunnelpmtudbuildicmpv6 Sashiko found that iptunnelpmtudbuildicmp and iptunnelpmtudbuildicmpv6 were caching iphdr and ipv6hdr before an skbcow call which can reallocate skb-head. Fix...

[SECURITY] Fedora 44 Update: python-uv-build-0.11.28-1.fc44

This package is a slimmed down version of uv containing only the build backend...

[SECURITY] Fedora 43 Update: python-uv-build-0.11.28-1.fc43

This package is a slimmed down version of uv containing only the build backend...

Fedora 44 : python-uv-build / rust-astral_async_zip / uv (2026-be84487fdd)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-be84487fdd advisory. Update uv / python-uv-build to 0.11.28, with significant hardening of zip file handling against parser differentials. Tenable has extracted the preceding...

Fedora 43 : python-uv-build / rust-astral_async_zip / uv (2026-8893ec1aeb)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-8893ec1aeb advisory. Update uv / python-uv-build to 0.11.28, with significant hardening of zip file handling against parser differentials. Tenable has extracted the preceding...

CVE-2026-63881: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger getqueueids computes arraysize = numqueues sizeofuint32t, which could overflow on 32-bit sizet build. using arraysize instead, it saturates to SIZEMAX on overflo...

CVE-2026-16095

A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by this issue is the function setupconntrack of the file /sbin/rc. Executing a manipulation of the argument cttcptimeout can lead to out-of-bounds write. The attack may be performed from remote. This project is supersed...

CVE-2026-16096

A vulnerability has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. This affects the function sub40BB50 of the file /proc/webmonrecentdomains. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. This project is superseded by FreshTomato...

EUVD-2026-45371

A vulnerability has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. This affects the function sub40BB50 of the file /proc/webmonrecentdomains. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. This project is superseded by FreshTomato...

EUVD-2026-45370

A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by this issue is the function setupconntrack of the file /sbin/rc. Executing a manipulation of the argument cttcptimeout can lead to out-of-bounds write. The attack may be performed from remote. This project is supersed...

Code Injection

Nuclio is vulnerable to Code Injection. The vulnerability is due to unsanitized runtimeAttributes.repositories values being injected into the generated build.gradle file, which allows an attacker to inject and execute arbitrary Groovy code during the Gradle build process, resulting in remote code...

Fedora 43 : spoofdpi (2026-77f23c0bc4)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-77f23c0bc4 advisory. Fix Go version requirement for F43 build compatibility Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

PT-2026-60933

A vulnerability has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. This affects the function sub 40BB50 of the file /proc/webmon recent domains. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. This project is superseded by...

Fedora 44 : python-libcst (2026-17c484fafa)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-17c484fafa advisory. Update to 1.8.6. Build with PyO3 fixes RUSTSEC-2026-0176, RUSTSEC-2026-0177. Tenable has extracted the preceding description block directly from the Fedora...

CVE-2026-13448

IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint /api/v1/buildpublictmp/flowid/flow . The vulnerability stems from an incomplete denylist in the validatepublicflownocodeexecution function that fails...

CVE-2026-13448 Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint /api/v1/buildpublictmp/flowid/flow . The vulnerability stems from an incomplete denylist in the validatepublicflownocodeexecution function that fails...