Moderate: Red Hat Security Advisory: RHEL AI 3.0 RPM runtime CVE fix - ffmpeg

AIPCC Security Alerts identified CVEs in the 3.0 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

Exploit for CVE-2026-94545

CVE-2026-94545: Next.js next/og Unauthenticated Remote Code...

CVE-2026-92954

A flaw was found in vm2. An attacker capable of running untrusted code within the sandbox can trigger a Denial of Service DoS by causing the host application process to terminate. This vulnerability exists because asynchronous operations Promises returned from the host environment are not properl...

CVE-2026-79625

The CODESYS Control Runtime is vulnerable to an improper synchronization flaw within its monitoring functionality. When multiple clients submit concurrent requests, the system fails to properly synchronize access, potentially resulting in incorrect reads or writes or the corruption of internal me...

CVE-2026-79625 Improper Synchronization in Monitoring in CODESYS Control Runtime

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit...

Security Bulletin: This Power System update is being released to address CVE-2026-96264

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be...

Security Bulletin: This Power System update is being released to address CVE-2026-96262

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be...

AlmaLinux 9.6 [TuxCare] Security Update: git-lfs (ALMALINUX9.6:CLSA-2026:1773314343)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1773314343 advisory. - Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out...

AlmaLinux 9.6 [TuxCare] Security Update: butane / butane-redistributable Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772573053)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772573053 advisory. - The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for...

AlmaLinux 9.6 [TuxCare] Security Update: containernetworking-plugins Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772576264)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772576264 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters ...

Rocky Linux 9.6 [TuxCare] Security Update: git-lfs (ALMALINUX9.6:CLSA-2026:1773314343)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1773314343 advisory. - Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out...

CentOS Linux 6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS6:CLSA-2026:1780067104)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1780067104 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tarVimuntar in...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782382498)

"The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782382498 advisory. - In the Linux kernel, the following vulnerability has been resolved: efi: Do not import certificates from UEFI Secure Boot for T2...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782382498)

"The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782382498 advisory. - In the Linux kernel, the following vulnerability has been resolved: efi: Do not import certificates from UEFI Secure Boot for T...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +2096 more potentially affected by CVE-2026-84947 via undici (>=7.1.0, <=7.29.0)

undici NPM version =7.1.0, =0.1.1, =0.0.1-251008.90016, =1.0.0, =0.6.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.0.6, =1.0.0, =1.52.3 and more Source cves: CVE-2026-84947 Source advisory: OSV:GHSA-2GQQ-GQF2-X968...

org.apache.polaris:polaris-extensions-auth-opa-tests (>=1.3.0-incubating, <=1.6.0), org.apache.polaris:polaris-extensions-auth-ranger-tests (>=1.5.0, <=1.6.0) +9 more potentially affected by CVE-2026-97395 via org.apache.polaris:polaris-runtime-service (>=1.1.0-incubating, <=1.7.0)

org.apache.polaris:polaris-runtime-service MAVEN version =1.1.0-incubating, =1.3.0-incubating, =1.5.0, =1.1.0-incubating, =1.1.0-incubating, =1.1.0-incubating, =1.1.0-incubating, =1.6.0 - org.apache.polaris:polaris-spark-integration-4.02.13 1.6.0 Source cves: CVE-2026-97395 Source advisory:...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module tar (CVE-2026-59871, CVE-2026-59873, CVE-2026-59874 and CVE-2026-59875)

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to Node.js module tar. Vulnerability Details CVEID:CVE-2026-59871 DESCRIPTION: node-tar ...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to jackson-databind (CVE-2026-19032, CVE-2026-83557 and CVE-2026-68497)

Summary IBM App Connect Enterprise Runtime is vulnerable to multiple vulnerabilities due to jackson-databind. Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing t...

HARDE: Optimizing Agent Harnesses for Runtime Risk Detection and Execution Control

Large language model LLM agents are vulnerable to safety risks such as injected malicious instructions or misleading information, motivating runtime defenses that prevent unsafe action in execution across diverse risks while preserving benign-task utility. Existing system-level defenses either...

ac.pao:reports-web (1.0.0), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +34744 more potentially affected by CVE-2026-68497 via com.fasterxml.jackson.core:jackson-databind (>=2.19.0, <=2.21.5)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.19.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.6 and more Source cves:...