Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

kernel: ipv6: fix possible UAF in icmpv6_rcv()

A flaw was found in the Linux kernel's IPv6 Internet Protocol version 6 implementation. This vulnerability, a Use-After-Free UAF error, occurs due to incorrect caching of network packet addresses before a memory operation. An attacker could potentially exploit this flaw to cause memory corruption...

kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()

A flaw was found in the Linux kernel's ioti USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the getmanufinfo function. This occurs because the driver does not properly validate the size of data read from the...

EUVD-2026-80049

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

EUVD-2026-80033

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in ntoolstcpdumpstartset.cgi caused by an unsized sprintf call when processing form values. An attacker can submit crafted input to this cgi endpoint to overflow the stack buffer and potentially execute arbitrary code...

SUSE CVE-2026-87987

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

CVE-2026-73166: Improper Control of Generation of Code

Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary code on the device, including OS...

PT-2026-93422

Name of the Vulnerable Software and Affected Versions Apache Airflow Apache Kafka provider versions 1.15.0 through 1.9.9 Description The software resolves dotted-path strings found in a Kafka connection's extra field into Python callables using the import string function without an allowlist. The...

CVE-2026-86792: Use of Externally-Controlled Input to Select Classes or Code

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-51990

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

PT-2026-93866

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An issue in the web-based management interface allows an authenticated remote attacker with at least low-privileged administrative credentials to execute arbitrary commands on the underlyin...

PT-2026-93864

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description An issue in the diagnostic tools allows an authenticated remote attacker with administrative credentials to perform command injection on the...

EUVD-2026-80932

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

CVE-2026-62997: Deserialization of Untrusted Data

Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedrodatasetsexperimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weightsonly=True, and user-supplied loadargs are silently dropped. On PyTorch versions...

PT-2026-93772

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description Insufficient validation of calls from sandboxed scripts to methods added dynamically to a class at runtime allows users with permissions to define and run...

CVE-2026-92123: Protection Mechanism Failure

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not intercept operations performed on a null receiver method calls, property and attribute accesses, and array accesses, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the...

CVE-2026-92125: Improper Control of Generation of Code

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...

CVE-2026-92122: Protection Mechanism Failure

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an interface method, allowing attackers with permission to define an...

CVE-2026-73456: Improper Control of Generation of Code

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface gNPSI enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised...

CVE-2026-92128: Download of Code Without Integrity Check

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context ...