CVE-2026-28672

CVE-2026-28672 describes an OS Command Injection in Apache Ranger (via the UnixUserGroupBuilder username). The issue is caused by improper neutralization of special elements in user- or group-related processing, affecting Ranger releases 0.6 through 2.8. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S...

GHSA-55Q2-FJHQ-7XH7 vulnerabilities

Vulnerabilities for packages: nextcloud-server, opensearch-dashboards, langfuse-fips, wazuh-dashboard, langfuse, opensearch-dashboards-fips, wazuh-dashboard-fips, kibana, librechat...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2. When reading the name of a symbolic link from a UFS filesystem, grub2 fails to validate the string length provided as input. This lack of validation may lead to a heap out-of-bounds write, causing data integrity issues and potentially allowing an attacker to...

Astra Linux – Vulnerability in cups

OpenPrinting CUPS is an open-source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and earlier, the RSS notifier allowed path traversal in notify-recipient-uri e.g., rss:///../job.cache, enabling a remote IPP client to write RSS XML bytes outside of CacheDir/r...

Astra Linux – Vulnerability in libsoup2.4

A flaw was discovered in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, resulting in a buffer overread. This can allow an attacker to potentially access sensitive information or cause a denial of service at the application level...

Astra Linux – Vulnerability in Python 3.11

User-controlled header names and values containing newlines can allow for the injection of HTTP headers...

Astra Linux – Vulnerability in Firefox

Undefined behavior in the Audio/Video component. This vulnerability was fixed in Firefox 149 and Thunderbird 149...

Astra Linux – Vulnerability in Firefox

DoS attack in the XML component. This vulnerability has been fixed in Firefox 149 and Thunderbird 149...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in ANGLE in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: crypto: starfive – Properly handles the return of sgnentsforlen The return value of sgnentsforlen was assigned to a unsigned long in starfivehashdigest, causing negative error codes to be converted into large positive integers...

Astra Linux – Vulnerability in hdf5

The HDF5 library from version 1.14.3 has a heap-based buffer overflow issue in the H5Tconvstructopt function within H5Tconv.c...

Astra Linux – Vulnerability in Firefox and Thunderbird

Privilege escalation in the Messaging System component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Astra Linux – Vulnerability in Firefox and Thunderbird

A use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when the cpuphysicalmemorymap function returns a shorter length than expected, resulting in an out-of-bounds write. Successful exploitati...

Astra Linux – Vulnerability in Python 3.11

The webbrowser.open API accepts URLs with leading hyphens, which can be treated as command-line options for certain web browsers. However, the new behavior disallows the use of leading hyphens. It is recommended that users sanitize URLs before passing them to webbrowser.open...

Astra Linux – Vulnerability in GIMP

GIMP XWD File Parsing: Out-of-Bounds Write Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a malicious file. The...

Astra Linux – Vulnerability in Squid

Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resources during their expected lifetime and heap Use-After-Free bugs, Squid was vulnerable to Denial of Service attacks when handling ICP traffic. This issue allowed a remote attacker to carry out a reliable...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in libtasn1-6

Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data, resulting in a buffer overflow in asn1expendoctetstring...

Astra Linux – Vulnerability in libsoup3

A flaw was discovered in the cookie parsing logic of the libsoup HTTP library, which is used in GNOME applications and other software. The vulnerability arises when processing the expiration dates of cookies, where a specially crafted value can trigger an integer overflow. This may lead to...