CVE-2026-100353

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending specially crafted HTTP requests containing specific array query parameters or form-encoded data. Because the request decoder fails to properly validate certain array schemas before...

SUSE CVE-2026-97394

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies,...

Linux Distros Unpatched Vulnerability : CVE-2026-111130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slidepositions array via...

UBUNTU-CVE-2026-97394

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-131773)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-131773 advisory. In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Skip discovery table for offline dies This warning can be triggered if NUM...

CVE-2026-102946 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

CVE-2026-102946 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

CVE-2026-97394

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fpga: Prevent integer overflow in dflfeatureioctlsetirq The multiplication hdr.count sizeofs32 can cause integer overflow on 32-bit systems, leading to memory corruption. Use arraysize to fix this issue...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Net: qlogic/qede: fixed a potential out-of-bounds read in qedetpacont and qedetpaend. The loops in ‘qedetpacont’ and ‘qedetpaend’ iterate over ‘cqe-lenlist’ using only a zero-length terminator as the stopping condition. If the...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net: rose: fix invalid array index in rosekillbydevice rosekillbydevice collects sockets into a local array, then iterates over them to disconnect sockets bound to a device being brought down. The loop mistakenly indexes arraycnt...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: The ath5k driver seems to perform an array-index-out-of-bounds access, as indicated by the UBSAN kernel message: UBSAN: array-index-out-of-bounds in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Prevent Spectre v1 gadget construction in sysrtas. Smatch warns: arch/powerpc/kernel/rtas.c:1932 dosysrtas warning: potential Spectre issue with ‘args args’ r local limit The ‘nargs’ and ‘nret’ locals originate from...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Use variable length arrays instead of fixed-size ones. The issue with the “smatch warning” should be fixed: Error in ntfssetlabel: builtinmemcpy’s ‘uni-name’ is too small 20 vs 256...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: The issue of protecting the fetch of -fdfd in dodup2 from mispredictions has been addressed. Both callers have ensured that fd is not greater than -maxfds; however, misprediction may still lead to the speculative execution of...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfsdmap.c:1965:6 index -84 is out of range for type 's8341' aka 'signed char341'...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: parport: Proper fix for array out-of-bounds access. The recent fix for array out-of-bounds accesses replaced sprintf calls with snprintf. However, since snprintf returns the size of the data to be printed, not the actual output...

Astra Linux – vulnerability in PostgreSQL 11

A flaw was found in PostgreSQL versions prior to 13.3, prior to 12.7, prior to 11.12, prior to 10.17, and prior to 9.6.22. When modifying certain SQL array values, missing bounds checks allow authenticated database users to write arbitrary bytes to a large portion of the server’s memory. The...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: net: tulip: de4x5: fix the problem that the array 'lp-phy8' may be out of bounds At line 5001, if all elements in the array 'lp-phy8' are not 0, at the end of the 'for' loop, 'k' becomes 8. At this point, the array 'lp-phy8' may ...

Astra Linux – vulnerability in Firefox

An attacker could have written a value to the first element of a zero-length JavaScript array. Although the array was zero-length, the value was not written to an invalid memory address. This vulnerability affects Firefox 104...