Important: Red Hat Security Advisory: jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 9 : jackson-databind (RHSA-2026:89924)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89924 advisory. The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator...

Frappe Builder authorization issue vulnerability

Versions of Frappe Builder prior to 1.33.0 and 1.36.0 contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks on the improveprompt endpoint; any authenticated non-Guest session can trigger LLM completion. Attackers can exploit resolveapikey to...

RHEL 9 : jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base (RHSA-2026:89734)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89734 advisory. Core part of Jackson that defines Streaming API as well as basic shared abstractions. Security Fixes:...

WordPress WP Stripe Checkout plugin < 1.2.2.62 - Unauthenticated Forged Payment Completion vulnerability

Unauthenticated Forged Payment Completion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin WP Stripe Checkout versions 1.2.2.62...

openSUSE 16: docker / docker-bash-completion / docker-buildx / etc (openSUSE-SU-2026:22158-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22158-1 advisory. Security issues fixed: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc126578...

CLSA-2026-1792217772 vim: Fix of 3 CVEs

CVE-2026-73073: match the tags typeref literally with \V in the C omni-completion :vimgrep pattern so an unclosed cannot break out of the pattern and run the rest of the tag value as Ex commands...

cateye (>=0.3.4, <=0.3.8), edx-completion (>=0.0.1, <=0.1.1) +4 more potentially affected by CVE-2026-113717 via virtualenv (15.1.0)

virtualenv PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cateye =0.3.4, =0.0.1, =0.5.7, =1.0.0rc1, =1.2.0, =1.7.1 Source cves: CVE-2026-113717 Source advisory: OSV:GHSA-CX28-75Q4-X26Q...

cateye (>=0.3.4, <=0.3.8), edx-completion (>=0.0.1, <=0.1.1) +4 more potentially affected by CVE-2026-113714 via virtualenv (15.1.0)

virtualenv PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cateye =0.3.4, =0.0.1, =0.5.7, =1.0.0rc1, =1.2.0, =1.7.1 Source cves: CVE-2026-113714 Source advisory: OSV:GHSA-494P-63J8-28P3...

cateye (>=0.3.4, <=0.3.8), edx-completion (>=0.0.1, <=0.1.1) +4 more potentially affected by CVE-2026-113718 via virtualenv (15.1.0)

virtualenv PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cateye =0.3.4, =0.0.1, =0.5.7, =1.0.0rc1, =1.2.0, =1.7.1 Source cves: CVE-2026-113718 Source advisory: OSV:GHSA-394H-QWMC-48PF...

cateye (>=0.3.4, <=0.3.8), edx-completion (>=0.0.1, <=0.1.1) +4 more potentially affected by CVE-2026-113720 via virtualenv (15.1.0)

virtualenv PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cateye =0.3.4, =0.0.1, =0.5.7, =1.0.0rc1, =1.2.0, =1.7.1 Source cves: CVE-2026-113720 Source advisory: OSV:GHSA-FC2G-4W5P-6WHM...

cateye (>=0.3.4, <=0.3.8), edx-completion (>=0.0.1, <=0.1.1) +4 more potentially affected by CVE-2026-113723 via virtualenv (15.1.0)

virtualenv PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cateye =0.3.4, =0.0.1, =0.5.7, =1.0.0rc1, =1.2.0, =1.7.1 Source cves: CVE-2026-113723 Source advisory: OSV:GHSA-6W3R-XR62-4XCP...

cateye (>=0.3.4, <=0.3.8), edx-completion (>=0.0.1, <=0.1.1) +4 more potentially affected by CVE-2026-113715 via virtualenv (15.1.0)

virtualenv PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cateye =0.3.4, =0.0.1, =0.5.7, =1.0.0rc1, =1.2.0, =1.7.1 Source cves: CVE-2026-113715 Source advisory: OSV:GHSA-QMX5-4P3X-WVQF...

cateye (>=0.3.4, <=0.3.8), edx-completion (>=0.0.1, <=0.1.1) +4 more potentially affected by CVE-2026-113719 via virtualenv (15.1.0)

virtualenv PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cateye =0.3.4, =0.0.1, =0.5.7, =1.0.0rc1, =1.2.0, =1.7.1 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

DEBIAN-CVE-2026-99046

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the bufstate and its attached buffer should be freed. In the case of AFXDP ZC, the XSK buffer was not freed, leading to a lea...

CVE-2026-99046

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the bufstate and its attached buffer should be freed. In the case of AFXDP ZC, the XSK buffer was not freed, leading to a lea...

CVE-2026-99046 gve: fix XSK buffer leak on error descriptor

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the bufstate and its attached buffer should be freed. In the case of AFXDP ZC, the XSK buffer was not freed, leading to a lea...

CVE-2026-99039

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

CVE-2026-99038

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsxusbms: complete requests after eject instead of dropping them memstickcheck can pass its host-removing check just before rtsxusbmsdrvremove sets eject/removing. Its next request is then silently dropped:...

PT-2026-122016

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free write occurs in the memstick subsystem when wait for completion timeout expires in the memstick alloc card and memstick set rw addr functions. Because the subsystem...