PT-2026-132367

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread...

Rocky Linux 9.6 [CIQ] Security Update: aspnetcore-runtime-9.0 / aspnetcore-runtime-dbg-9.0 / etc (ciqsa-2026_1730)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261730 advisory. This advisory aggregates security fixes for the dotnet9.0 SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2026-111497. Tenable has extracted the preceding descriptio...

hugo-jupyter (>=0.2.1, <=0.3.0), kitehistory (1.4.0) +2 more potentially affected by CVE-2026-115927 via tornado (4.5.1)

tornado PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - hugo-jupyter =0.2.1, =0.3.1, =1.5.1 Source cves: CVE-2026-115927 Source advisory: OSV:GHSA-R4J5-9XPP-3985...

hugo-jupyter (>=0.2.1, <=0.3.0), kitehistory (1.4.0) +2 more potentially affected by CVE-2026-116578 via tornado (4.5.1)

tornado PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - hugo-jupyter =0.2.1, =0.3.1, =1.5.1 Source cves: CVE-2026-116578 Source advisory: OSV:GHSA-PW9P-V7R6-GX4P...

hugo-jupyter (>=0.2.1, <=0.3.0), kitehistory (1.4.0) +2 more potentially affected by CVE-2026-116577 via tornado (4.5.1)

tornado PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - hugo-jupyter =0.2.1, =0.3.1, =1.5.1 Source cves: CVE-2026-116577 Source advisory: OSV:GHSA-PCG2-G6CJ-Q92C...

SUSE CVE-2026-99150

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

com.salesforce.mirus:mirus (0.7.0), com.scaleoutsoftware.modules.connectors:connectors-abstractions (>=3.0.0, <=3.1.1) +86 more potentially affected by CVE-2026-116593 via org.apache.kafka:connect-runtime (>=4.2.0, <=4.2.1)

org.apache.kafka:connect-runtime MAVEN version =4.2.0, =3.0.0, =3.1.1 - io.debezium.quarkus:debezium-quarkus-agroal 3.6.0.alpha2 - io.debezium.quarkus:debezium-quarkus-agroal-deployment 3.6.0.alpha2 - io.debezium.quarkus:debezium-quarkus-db2 3.6.0.alpha2 -...

io.debezium.quarkus:debezium-quarkus-agroal (>=3.6.0.beta1, <=3.7.0.final), io.debezium.quarkus:debezium-quarkus-agroal-deployment (>=3.6.0.beta1, <=3.7.0.final) +90 more potentially affected by CVE-2026-116593 via org.apache.kafka:connect-runtime (>=4.3.0, <=4.3.1)

org.apache.kafka:connect-runtime MAVEN version =4.3.0, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1,...

com.salesforce.mirus:mirus (0.7.0), com.scaleoutsoftware.modules.connectors:connectors-abstractions (>=3.0.0, <=3.1.1) +86 more potentially affected by CVE-2026-115644 via org.apache.kafka:connect-runtime (>=4.2.0, <=4.2.1)

org.apache.kafka:connect-runtime MAVEN version =4.2.0, =3.0.0, =3.1.1 - io.debezium.quarkus:debezium-quarkus-agroal 3.6.0.alpha2 - io.debezium.quarkus:debezium-quarkus-agroal-deployment 3.6.0.alpha2 - io.debezium.quarkus:debezium-quarkus-db2 3.6.0.alpha2 -...

io.debezium.quarkus:debezium-quarkus-agroal (>=3.6.0.beta1, <=3.7.0.final), io.debezium.quarkus:debezium-quarkus-agroal-deployment (>=3.6.0.beta1, <=3.7.0.final) +90 more potentially affected by CVE-2026-115644 via org.apache.kafka:connect-runtime (>=4.3.0, <=4.3.1)

org.apache.kafka:connect-runtime MAVEN version =4.3.0, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1, =3.6.0.beta1,...

Security Bulletin: Security Vulnerabilities were found in IBM Semeru Runtime Certified Edition provided with IBM Verify Directory

Summary Security Vulnerabilities were addressed in IBM Semeru Runtime Certified Edition provided with IBM Verify Directory Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed...

AZL-111281 CVE-2026-99150 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

DEBIAN-CVE-2026-99150

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

CVE-2026-99150

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

CVE-2026-99150 drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

CVE-2026-99150

The Linux kernel contains a vulnerability in the drm/amdgpu driver where the amdgpu_debugfs_gpr_read() function incorrectly drops its runtime PM reference twice. Specifically, the reference is dropped after reading the wave registers, but if the copy to userspace fails, the function jumps to an e...

EUVD-2026-111902

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

CVE-2026-99150 drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpugpr amdgpudebugfsgprread drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which...

PT-2026-128143

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu gpr amdgpu debugfs gpr read drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label,...

CARI: Cross-Boundary Adversarial Runtime Injection in Coding-Agent Workflows

Coding agents increasingly develop, test, and integrate software whose components are owned by different developers, teams, or services. This exposes a distinct attack surface: a malicious or compromised peer development role can manipulate a live component of the software under development e.g.,...