Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - spi: rockchip: Fixed improper handling of runtime PM/system PM operations. The commit e882575efc77 “spi: rockchip: Suspend and resume the bus during NOIRQSYSTEMSLEEPPM ops” no longer respects the runtime PM status and simply...

Astra Linux – Vulnerability in Chromium

A cryptographic flaw in PDFium in Google Chrome prior to version 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs through a brute-force attack. Chromium security severity: Medium...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: omap – Correctly allocate OMAPCRYPTOFORCECOPY scatterlists The current allocation of scatterlists in oprcryptocopysglists was incorrect; it was allocating an array of scatterlist pointers, rather than scatterlist objects...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: uinput – fixed a circular locking dependency with ff-core A circular locking dependency warning can be triggered reproducibly when using a force-feedback gamepad with uinput for example, playing ELDEN RING under Wine with ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ACPI: APEI: Send SIGBUS to the current task if a synchronous memory error is not recovered. If a synchronous error is detected due to a user-space process triggering a 2-bit uncorrected error, the CPU will raise an exception...

Astra Linux – Vulnerability in PHP 8.1, PHP 7.3

In PHP versions 8.1. before 8.1.30, and 8.2. before 8.2.24, as well as 8.3. before 8.3.12, the HTTPREDIRECTSTATUS variable was used to determine whether a CGI binary was being executed by the HTTP server. However, in certain scenarios, the content of this variable could be controlled by the reque...

Astra Linux – Vulnerability in Systemd

There is an exploitable denial-of-service vulnerability in Systemd 245. A specially crafted DHCP FORCERENEW packet can expose a server running the DHCP client to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server...

Astra Linux – Vulnerability in freeipa

A vulnerability was discovered in FreeIPA when a Kerberos TGS-REQ is encrypted using the client’s session key. This key varies for each new session, which helps protect it from brute-force attacks. However, the tickets contained within are encrypted using the target principal key directly. For us...

tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm

In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...

tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm

In Apache Tomcat, LockOutRealm mishandled case sensitivity in usernames, resulting in less effective blocking of brute force attacks...

CVE-2023-24035

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

CVE-2023-24035

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

PT-2026-91038

An issue was discovered in Nagios XI before 5.9.3. The is insecure login authenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

CVE-2023-24035

CVE-2023-24035 affects Nagios XI before 5.9.3 . The vulnerable component is the "Insecure Backend Ticket" Authentication mechanism, specifically the is_insecure_login_authenticated function, which uses a timing-unsafe comparison of the admin password. An attacker can exploit this by measuring tim...

EUVD-2023-60635

An issue was discovered in Nagios XI before 5.9.3. The isinsecureloginauthenticated function uses a insecure timing comparison that leads to an attacker being able to bruteforce the admin password, by measuring timing differences in the comparison...

The vulnerability of the Azure Cosmos DB database management system, related to bypassing authentication using a user-controlled key, allows attackers to perform spear-phishing attacks.

The vulnerability of the Azure Cosmos DB database management system is related to the ability to bypass authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to perform brute-force attacks remotely...

Exploit for CVE-2026-77771

CVE-2026-77771 — miniOrange 2FA Free & Pro: 2FA Bypass via S...

Linux Distros Unpatched Vulnerability : CVE-2026-89624

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: universal-pidff: stop the device when force-feedback init fails universalpidffprobe starts the device with hidhwstart and then, if force-feedback...

CVE-2026-89624

A flaw was found in the Linux kernel's universal-pidff driver. This vulnerability occurs when the force-feedback initialization fails, leaving a hidraw character device active. A local attacker can exploit this by opening the device, leading to a use-after-free condition where the system attempts...

AZL-100731 CVE-2026-89624 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universalpidffprobe starts the device with hidhwstart and then, if force-feedback initialisation fails, returns the error through a label that only does "return...