PT-2026-93572

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the KVM nVMX component where the KVM REQ GET NESTED STATE PAGES flag is not consistently cleared during a nested VM-Exit emulation. This occurs even when KVM is built...

Linux Distros Unpatched Vulnerability : CVE-2026-89929

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU When emulating INVVPID, KVM executes INVVPID on the physical CPU using vpid02 instead of the L1...

CVE-2026-89929: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU When emulating INVVPID, KVM executes INVVPID on the physical CPU using vpid02 instead of the L1 assigned VPID, after doing some validations on the operands. However...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in faraday

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in faraday Vulnerability Details CVEID:CVE-2026-54297 DESCRIPTION: Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3,...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in multer

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in multer Vulnerability Details CVEID:CVE-2026-5038 DESCRIPTION: Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malform...

CVE-2026-58755

In smmuinstallnestedste of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58718

In smmudetachdevnested of arm-smmu-v3.c, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-12150

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker with a trusted TLS client certificate to cause a denial of service and...

CVE-2026-11918

IBM ContextForge MCP Gateway = v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content...

aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON

A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service DoS in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json...

Important: Red Hat Security Advisory: goose bug fix and enhancement update

An update for goose is now available for Red Hat Enterprise Linux 9. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Security Fixes: goose: aws-smithy-json: Denial of Service via uncontrolled...

Important: Red Hat Security Advisory: goose bug fix and enhancement update

An update for goose is now available for Red Hat Enterprise Linux 10. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Security Fixes: goose: aws-smithy-json: Denial of Service via uncontrolled...

aws-smithy-json: aws-smithy-json: Denial of Service via uncontrolled recursion with deeply nested JSON

A flaw was found in aws-smithy-json. This vulnerability allows a remote, unauthenticated attacker to cause a denial of service DoS in smithy-rs generated servers. By sending a small HTTP request containing deeply nested JSON, the attacker can trigger uncontrolled recursion in the aws-smithy-json...

CVE-2026-57442 MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored deny-list patterns, so nested .git, .obsidian, and nodemodules path segments do not match the restriction and pass both...

CVE-2026-11918 IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures

IBM ContextForge MCP Gateway = v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content...

CVE-2026-11918 IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures

IBM ContextForge MCP Gateway = v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content...

EUVD-2026-78898

IBM ContextForge MCP Gateway = v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content...

CVE-2026-11918

IBM ContextForge MCP Gateway (versions ≤ v1.0.4) is vulnerable to a security filter bypass in its regex_filter and deny_filter plugins. The root cause (CWE-184) is that these plugins' scanning loops only inspect top-level keys of payload.args without recursive traversal, allowing an authenticated...

CVE-2026-12150 IBM MQ queue manager is vulnerable to denial of service

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker with a trusted TLS client certificate to cause a denial of service and...

CVE-2026-12150

IBM MQ is vulnerable to an unbounded recursion flaw in the queue manager's TLS certificate parser (CWE-121, stack-based buffer overflow). A remote attacker holding a trusted TLS client certificate can craft deeply nested certificate data to trigger denial of service and potentially corrupt memory...