Astra Linux – Vulnerability in docker.io-app

Moby version 25.0.3 has a race condition vulnerability in the StreamFormatter package. This vulnerability can be exploited to trigger multiple concurrent write operations, leading to data corruption or application crashes...

Astra Linux – Vulnerability in Chromium

In incorrect security user interfaces of web app installations in Google Chrome on Android before version 90.0.4430.212, an attacker who convinced a user to install a web application could inject scripts or HTML into a privileged page through a crafted HTML page...

Astra Linux – Vulnerability in containerd-app

Due to a missing nil check, sending HTTP/2 frames with values 0x0a-0x0f will cause a running server to panic...

Astra Linux – Vulnerability in Chromium

Before version 90.0.4430.212, using “after free” in Google Chrome’s payments functionality allowed an attacker who convinced a user to install a malicious payment app to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Before version 102.0.5005.61, using “after free” in the App Service in Google Chrome allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted Chrome Extension...

Astra Linux – Vulnerability in Tomcat9

URL redirection to untrusted sites “open redirect” vulnerability in FORM authentication with Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.0-M10, 10.1.0-M1 through 10.0.12, 9.0.0-M1 through 9.0.79, and 8.5.0 through 8.5.92. Older, end-of-life versions...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Android intents in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious application to obtain potentially sensitive information via a crafted HTML page...

Astra Linux – Vulnerability in docker.io-app

Moby v25.0.5 is affected by a race condition in the builder/builder-next/adapters/snapshot/layer.go file. This vulnerability could be exploited to trigger concurrent builds that invoke the EnsureLayer function, leading to resource leaks or exhaustion...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework. Prior to version 29.3.1, a security vulnerability was detected that allowed attackers to bypass authorization plugins AuthZ. This issue has been fixed in version 29.3.1...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform UI spoofing via a crafted app. Chromium security severity: Medium...

Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.27 and 13.5.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...

CVE-2026-90616

A flaw was found in Flatpak. A malicious sandboxed application can exploit missing symlink protection during the creation and bind-mounting of app data directories. By manipulating attacker-controlled path components, a malicious symlink can redirect these directories to arbitrary locations on th...

CVE-2026-85125

The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. The in-app browser may cause information leakage from the app or redirect users to unintended websites...

EUVD-2026-77253

The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. The in-app browser may cause information leakage from the app or redirect users to unintended websites...

CVE-2026-85125

The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. The in-app browser may cause information leakage from the app or redirect users to unintended websites...

"YAMAP -Social Trekking GPS App" vulnerable to improper access control

Overview Android application "YAMAP -Social Trekking GPS App" provided by YAMAP INC. contains the following vulnerability: Improper Verification of Source of a Communication Channel CWE-940 - CVE-2026-85125 Koki Sato of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC...

EUVD-2025-210901

A Cross-Site Scripting XSS vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field...

CVE-2025-63842

A Cross-Site Scripting XSS vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field...

PT-2026-91705

A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks...

PT-2026-91689

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier...