PT-2026-95282

Name of the Vulnerable Software and Affected Versions Mapster WP Maps versions prior to 1.23.1 Description The plugin contains an Arbitrary User Meta Write flaw within the my profile update function. The issue occurs because the function fails to perform nonce verification, capability checks, and...

CVE-2026-81626: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the...

AZL-103325 CVE-2026-86000 affecting package python-soupsieve 2.6-3

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/cssparser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an...

keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2

A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and...

PT-2026-93764

Name of the Vulnerable Software and Affected Versions @fastify/auth versions 5.0.0 through 5.1.0 Description This plugin composes multiple authentication and authorization strategies into a single route guard. An issue exists when strategies are composed using the relation "or" option combined wi...

CVE-2026-81899

Concrete CMS versions 9.0.0 through 9.5.2 are affected by a stored cross-site scripting (XSS) vulnerability in the group folder name handling. The add and edit group-folder handlers stored submitted folder names without sanitizing HTML, and the group search grid returned them without output encod...

CVE-2026-81899 Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboard

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group...

Security Bulletin: IBM watsonx Code Assistant On Prem product impacted by Vulnerability Found in runtime-7.26.10.tgz

Summary A vulnerability CVE-2025-27789 has been identified in the Babel runtime package @babel/runtime version 7.26.10 and earlier, which impacts the IBM watsonx Code Assistant On Prem Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel is a compiler for writing next generation...

CVE-2026-81899: Improper Neutralization of Input During Web Page Generation

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group...

Astra Linux – Vulnerability in Chromium

Before version 115.0.5790.98, using tab groups with free in Google Chrome allowed a remote attacker who convinced a user to perform certain UI interactions to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Linux, Linux 5.10

A use-after-free read flaw was discovered in the sockgetsockopt function in net/core/sock.c, due to race conditions involving SOPEERCRED and SOPEERGROUPS functions when used with listen and connect in the Linux kernel. In this flaw, an attacker with user privileges could potentially crash the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvdimm: The memory pointed to by ndpmu-pmu.attrgroups is allocated in the function registernvdimmpmu, and it is lost after the kfreendpmu call in the function unregisternvdimmpmu...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: afnetlink: Fixed an out-of-bounds shift in the group mask calculation When a netlink message is received, netlinkrecvmsg fills in the address of the sender. One of the fields is the 32-bit bitfield nlgroups, which carries the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/smp: Added a check for a failure in kcalloc in parsethreadgroups. Since kcalloc may fail, it is necessary to check its return value to prevent a NULL pointer derefrence when passing it to ofpropertyreadu32array...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisipcie: Fixed out-of-bound access when a valid event group is used. The perf tool allows users to create event groups using the cmd 1. However, the driver does not check whether the array index is out of bounds wh...

Astra Linux – Vulnerability in Chromium

Before version 100.0.4896.88, using tab groups in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Class: Fixed a possible memory leak in classregister. If classaddgroups returns an error, the cp-subsys needs to be unregistered, and the cp needs to be freed. We cannot call ksetunregister here, because the cls will be freed in...

Astra Linux – Vulnerability in docker.io

Moby is an open-source project created by Docker to enable software containerization. A bug was discovered in Moby Docker Engine where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates the supplementary group permissions, they may be abl...

Astra Linux – Vulnerability in Chromium

The use of tab groups for after-free operations in Google Chrome before version 148.0.7778.168 allowed a remote attacker to execute arbitrary code through malicious network traffic. Chromium security severity: Critical...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

A flaw was discovered in the filelockinit function in the fs/locks.c file within the Linux kernel. This issue can lead to host memory exhaustion, as memcg does not limit the number of POSIX file locks that can be created...