CVE-2026-90801

A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cachebwrite of the file bfd/cache.c of the component ld. The manipulation of the argument nbytes results in buffer overflow. The attack requires a local approach. The exploit has been released to the public and ma...

CVE-2026-90802

A weakness has been identified in GNU Binutils 2.47. Affected is the function bfdputl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to the public and could be used for attack...

CVE-2026-90804

A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function bfdelfwritesectionehframe of the file bfd/elf-eh-frame.c of the component Eh Frame Section Handler. Performing a manipulation of the argument cielength/fdelength/augmentationdatasize/writeoffset results in...

UBUNTU-CVE-2026-90802

A weakness has been identified in GNU Binutils 2.47. Affected is the function bfdputl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to the public and could be used for attack...

CVE-2026-90804

A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function bfdelfwritesectionehframe of the file bfd/elf-eh-frame.c of the component Eh Frame Section Handler. Performing a manipulation of the argument cielength/fdelength/augmentationdatasize/writeoffset results in...

CVE-2026-90803

A security vulnerability has been detected in GNU Binutils 2.47. Affected by this vulnerability is the function elfx8664relocatesection of the file bfd/elf64-x86-64.c of the component ld. Such manipulation of the argument roff leads to buffer overflow. An attack has to be approached locally. The...

CVE-2026-90790

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

EUVD-2026-77535

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

OPENSUSE-SU-2026:21849-1 Security update for kimi-code

This update for kimi-code fixes the following issues: Changes in kimi-code: Update to version 0.42.0: Add an experimental Updates panel with paginated progress messages from the main agent and subagents, enabled with KIMICODEEXPERIMENTALNOTIFYUSER=1 Turn the subagent model pool, Remote Control an...

CVE-2026-90957

MISP versions ≤2.5.45 are affected by a stored XSS vulnerability in the serve path for uploaded SVG images , which are delivered inline without a restrictive browser sandbox. Because SVGs are XML documents rather than passive bitmaps, embedded [removed] elements, event handlers, or javascript: UR...

Astra Linux – Vulnerability in u-boot

A issue was discovered in Das U-Boot during the period from 2019.07. There is a stack-based buffer overflow in the nfshandler reply helper function: nfsreadlinkreply...

Astra Linux – Vulnerability in u-boot

A carefully crafted self-referential DOS partition table will cause all Das U-Boot versions up to 2019.07-rc4 to infinitely recur, causing the stack to grow indefinitely. This could lead to a system crash or the overwriting of other data...

CVE-2026-90714 marcobambini Gravity JSON parser gravity_json.c memory corruption

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravityjson.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been mad...

Security Bulletin: Multiple vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2026-11710 etc.)

Summary WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about multiple vulnerabilities affecting WebSphere Application Server have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in...

Astra Linux – Vulnerability in sysstat

Sysstat is a set of system performance tools for the Linux operating system. On 32-bit systems, in versions 9.1.16 and later, but before version 12.7.1, the allocatestructures function contained a sizet overflow in the sacommon.c file. The allocatestructures function insufficiently checked the...

Astra Linux – Vulnerability in Chromium

The use of after-free in V8 in Google Chrome before 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in pyasn1

pyasn1 is a generic ASN.1 library for Python. Prior to version 0.6.2, a Denial-of-Service issue was identified that could lead to memory exhaustion due to malformed RELATIVE-OID values with excessive continuation octets. This vulnerability has been fixed in version 0.6.2...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the WebUI of Google Chrome prior to version 87.0.4280.141 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape through a crafted Chrome Extension...

Astra Linux – Vulnerability in Tomcat9

In some unusual configurations of multipart uploads, an Integer Overflow vulnerability in Apache Tomcat can lead to a Denial-of-Service attack by bypassing size limits. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, and from 9.0.0.M1 throu...

Astra Linux – Vulnerability in unbound

Before version 1.9.5, Unbound allowed configuration injection in the createunboundadservers.sh script after a successful man-in-the-middle attack on a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. createunboundadservers.sh is a contribute...