When Models Know but Can't Linearly Say: Relational Encoding Limits Linear Vulnerability Classification in Code LLMs

Large language models can detect vulnerable code, yet the form of vulnerability encoding in their representations remains unclear. We analyze 8 code models spanning 6.7B-15B parameters on C programs using three datasets DELTASECOMMITS, SVEN, and PRECISE-BUGS, comparing two diagnostic tasks on the...

PT-2026-117222

A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change info of the file webui.py. Executing a manipulation of the argument ckpt path can lead to code injection. The attack can be executed remotely. The exploit has been publish...

PT-2026-117491

Name of the Vulnerable Software and Affected Versions IBM MQ affected versions not specified Description An authenticated attacker can cause a denial of service or potentially execute arbitrary code. This occurs due to a heap buffer overflow—a condition where data exceeds the allocated memory...

PT-2026-117219

A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer. is transformer module ref of the file unsloth/models/sentence transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select class...

CVE-2026-112100: Improper Control of Generation of Code

A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.init of the file deeppavlov/models/preprocessors/multitaskpreprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be carried o...

ALSA-2026:84584 Critical: webkit2gtk3 security, bug fix, and enhancement update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read CVE-2026-87596 chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafte...

ALSA-2026:84799 Important: mariadb11.8 security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon mariadbd and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs a...

PT-2026-117512

Name of the Vulnerable Software and Affected Versions IBM MQ affected versions not specified Description A stack buffer overflow occurs during channel connection establishment when processing TLS certificates containing malformed distinguished names. This flaw allows a remote attacker to execute...

CVE-2026-112304: Deserialization of Untrusted Data

docTR through 1.1.0 contains an unsafe deserialization vulnerability in loadpretrainedparams that loads checkpoints with torch.load without weightsonly=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading...

PT-2026-117327

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description The camel-hazelcast component fails to apply a JavaSerializationFilterConfig to Hazelcast instances created through specific configuration paths...

PT-2026-117340

Improper Control of Generation of Code 'Code Injection', Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel. This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1. The...

PT-2026-117465

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible ssh common args with a ProxyCommand or...

CVE-2026-88900: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchangeMessage, which CamelJGroupsReceiver calls for every message the jgroups consumer receives...

ALSA-2026:85191 Important: xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests...

Linux Distros Unpatched Vulnerability : CVE-2026-96230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of input during web page generation 'cross-site scripting' in ASP.NET Core allows an unauthorized attacker to execute code over a networ...

Linux Distros Unpatched Vulnerability : CVE-2026-96237

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-96237 Note that Nessus...

PT-2026-117369

Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchangeMessage, which CamelJGroupsReceiver calls for every message the jgroups consumer receives...

ALSA-2026:84574 Important: xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fixes: xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling...

ALSA-2026:85193 Important: xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests...

RHEL 10 : xorg-x11-server-Xwayland (RHSA-2026:85191)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85191 advisory. Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server: xorg-x11-server: Arbitrary code execution vi...