PT-2026-117368

A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit h...

PT-2026-117357

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than...

PT-2026-117358

Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. The security processor validated the issuer of an introspected token only when the introspection response actually carried an iss claim...

PT-2026-117359

Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel...

PT-2026-117361

Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. CVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format...

Oracle Linux 9 : jackson-databind (ELSA-2026-85231)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-85231 advisory. 2.21.6-1.1 - Resolves: RHEL-276419 - Fix CVE-2026-91777 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

ALSA-2026:85231 Important: jackson-databind security update

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fixes: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind:...

CVE-2026-98496

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdtwork after releasing the WDT IRQ airohanpuremove calls cancelworksync on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq and is freed only after .remove return...

CVE-2026-98494

In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmbtpdnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

Fedora 44 : GitPython (2026-6576997f43)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6576997f43 advisory. Update to 3.2.1; security fix for GHSA-83vg-56qc-22m7 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Fedora 44 : aom (2026-61e3db09f9)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-61e3db09f9 advisory. Update to version 3.15.2. Release notes since 3.13.3: - https://aomedia.googlesource.com/aom/+/refs/tags/v3.14.0 -...

PT-2026-117341

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler set Access-Control-Allow-Credentials: true outside the origin check, so the...

PT-2026-117336

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker-named class from untrusted JSON. This issue affects Apache Johnzon: from 1.0.0 before 2.2.0. Users are recommended to upgrade to...

CVE-2026-98596

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags, ip6rtputflags, and ip6dstcheck detect an uncached route by listempty&rt-dst.rtuncached, which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 "net:...

CVE-2026-98452

In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens opencacheddir sends CREATE and QUERYINFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common...

CVE-2026-98483

In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfcgetlocalgeneralbytes Commit 6709d4b7bc2e "net: nfc: Fix use-after-free caused by nfcllcpfindlocal" attempted to fix a use-after-free UAF issue by invoking nfcllcplocalputlocal after accessing local-g...

CVE-2026-98544

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnadpciremove and the probe disableioceth path call timerdeletesync for ioctimer, semtimer and hbtimer, but not for iocpftimer...

CVE-2026-98594

In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3getinvariants can register an MDIO bus and connect a PHY for USEPHYLIB devices. If tg3initone later fails, its common error path releases the mappings and netdev without undoing...

CVE-2026-98566

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the...

Oracle Linux 9 : emacs (ELSA-2026-85245)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-85245 advisory. - Generalize trusted-content-p check to all Flymake backends CVE-2026-96442 Tenable has extracted the preceding description block directly from the Oracle Linu...