jackson-databind security update

An update is available for jackson-databind. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The general-purpose data-binding functionality and tree-model for...

TYPO3-EXT-SA-2026-031: Insecure Direct Object Reference in extension "Analytics" (analytics)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-031...

Path Equivalence

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Path Equivalence via the serialize, normalize, and resolve functions when called with the non-default option reference: 'suffix' on a reference that has no authority. A...

CVE-2026-110725

A flaw was found in fast-uri. A remote attacker could exploit this vulnerability to trigger cross-site scripting XSS by providing crafted input to applications that serialize or normalize relative Uniform Resource Identifiers URIs using the suffix reference option. Because the library fails to...

CVE-2026-110725

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize, normalize, or resolve are called with the non-default option reference set to suffix on a reference that has no authority...

CVE-2026-98598

A flaw was found in the Linux kernel's IPv6 networking subsystem. A local attacker or network traffic triggering route exceptions while an IPv6 route is being removed can cause a circular reference leak. This failure to release resources prevents network devices from unregistering, resulting in...

CVE-2026-98552

A flaw was found in the Linux kernel's Performance Counters for Linux perf subsystem. A race condition during the attachment of performance monitoring context data can cause the kernel to fail to update tracking flags, resulting in a reference count leak. A local attacker could exploit this...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23291)

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: properly drop the usb interface reference on disconnect When the device is disconnected from the driver, there is a 'dangling' reference count on the usb interface that was grabbed in the probe callback. Fix this up b...

Linux Distros Unpatched Vulnerability : CVE-2026-98553

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an...

RockyLinux 9 : jackson-databind (RLSA-2026:85231)

The remote RockyLinux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:85231 advisory. com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion...

Linux Distros Unpatched Vulnerability : CVE-2026-98781

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/mediatek: Fix pdev reference leak in mtkdrmbind When the device is not the mmsys master, mtkdrmbind returns early after taking a reference on the disp-mutex...

Linux Distros Unpatched Vulnerability : CVE-2026-98437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: qcom: iris: fix runtime PM reference leaks Use pmruntimeresumeandget in irisenablepowerdomains to avoid leaking a runtime PM usage count on failure. Also...

PT-2026-118647

Name of the Vulnerable Software and Affected Versions markdown-it versions 14.1.0 through 14.3.2 markdown-it versions 15.0.0 through 15.0.2 Description An algorithmic-complexity denial of service exists when processing a link reference definition with a label or title that is never closed. Using...

Linux Distros Unpatched Vulnerability : CVE-2026-98746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - serial: ma35d1: Fix clock reference leak in ma35d1serialprobe ofclkget returns a clock with a reference that has to be released with clkput. ma35d1serialprobe...

Linux Distros Unpatched Vulnerability : CVE-2026-98516

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/nouveau: Fix bridge reference leak in nv1aramnew pcigetdomainbusandslot takes a reference to the PCI device, which is never released once the memory size ha...

Linux Distros Unpatched Vulnerability : CVE-2026-98690

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: Fix domain reference leak when DPRX read is canceled tbtunnelonedp takes a domain reference which is only dropped once tbdptunnelactive has run on...

Linux Distros Unpatched Vulnerability : CVE-2026-98535

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fsl/fman: Fix clk reference leak in readdtsnode ofclkget returns a clock with its reference count incremented, but readdtsnode only uses it to read the rate and...

CVE-2026-73539

A flaw was found in Gitea. This vulnerability allows an attacker to achieve arbitrary code execution by injecting unintended arguments into external markup rendering commands. When handling markup requests, Gitea fails to sanitize URL reference paths before command argument processing. If an...

CVE-2026-112778

The Traefik ingress controller (versions before 2.11.46 , 3.x before 3.6.17 , and 3.7.0 ) is vulnerable to a cross-namespace resource reference issue within the Kubernetes Ingress provider . The root cause is a lack of namespace validation for Ingress and Service annotations. This allows an attac...

CVE-2026-112778 Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations

Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service...