Astra Linux – Vulnerability in libde265

A issue has been found in libde265 v1.0.8 due to incorrect access control. A segmentation fault has occurred as a result of a READ memory access in the deriveboundaryStrength function of deblock.cc. This vulnerability causes a segmentation fault and results in the crash of the application, leadin...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Samba

A vulnerability was discovered in Samba. A delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object’s creation. This issue arises because the administrator...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: nfs: fixed the acl memory leak in posixaclcreate When reviewing another nfs xfstests report, I found that errors related to acl and defaultACL in nfs3proccreate and nfs3procmknod might be exposed. These issues need to be...

Astra Linux – Vulnerability in the 389-DS-base

A access control bypass vulnerability was discovered in version 389-ds-base. This issue arises from improper handling of filters, which can lead to incorrect results. However, further analysis revealed that it actually constitutes an access control bypass. This vulnerability could allow any remot...

Astra Linux – Vulnerability in Python-Django

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validateipv4address, and validateipv46address did not prohibit leading zero characters in octal literals. This may allow bypassing access control based on IP addresses. validateipv4address and validateipv46address...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker to bypass discretionary access control through a crafted command. Chromium security severity: Low...

Astra Linux – Vulnerability in LibreOffice

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to create documents that would load external links without any prompts. In affected versions of LibreOffice documents that used “floating frames” linked to external files, the contents of those...

CVE-2026-90891

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to write to improperly restricted I/O ports, resulting in a forced operating system reboo...

CVE-2026-8821

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field...

CVE-2026-81566

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

CVE-2026-20773

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...

EUVD-2026-77385

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

CVE-2026-81566 Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

CVE-2026-81566 Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

CVE-2026-81566

SP Page Builder (Free and Pro, versions 4.0.0 – 6.9.0 ) for Joomla contains a missing access control vulnerability in its add-to-menu routine. The routine invoked the com_menus item model's save() method directly, bypassing the authorization checks that normally reside in the com_menus controller...

perl: Perl: Incorrect regular expression processing via large regular expressions

A flaw was found in Perl. When the Perl regular expression engine processes patterns with a very large number of alternative fixed strings, an internal data field can overflow. This leads to silently incorrect regular expression matches, causing the engine to either match strings it should not...

CVE-2026-20773 Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...

CVE-2026-20773

CVE-2026-20773 is an improper authorization flaw in PingFederate (Ping Identity), specifically in the administrative expression evaluation endpoint . A role-based access control (RBAC) deficiency allows users holding certain administrative roles to access expression testing capabilities beyond th...

EUVD-2026-77373

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...