CVE-2026-62679 Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...

CVE-2026-57569

The photo-management tool Lychee is vulnerable to a Server-Side Request Forgery (SSRF) via a DNS rebinding time-of-check to time-of-use (TOCTOU) mismatch in the POST /api/v2/Photo::fromUrl flow. Prior to version 7.6.0 , the application validates a hostname and its resolved addresses in app/Rules/...

CVE-2026-57569 Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.p...

CVE-2026-105474

A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root...

WordPress Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance plugin <= 1.31.4 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.4...

Astra Linux – Vulnerability in xorg-server

A use-after-free vulnerability was discovered in the ProcRenderAddGlyphs function of Xorg servers. This issue arises when the AllocateGlyph function is called to store new glyphs sent by the client to the X server. As a result, multiple entries may point to the same non-refcounted glyphs...

Astra Linux – Vulnerability in Intel Microcode

A domain-bypass transient execution vulnerability in some Intel AtomR processors may allow an authenticated user to potentially enable information disclosure through local access...

Astra Linux – Vulnerability in Intel Microcode

Hardware logic in some Intel processors may contain race conditions, which could allow an authenticated user to potentially enable partial information disclosure through local access...

Astra Linux – Vulnerability in Intel Microcode

The exposure of sensitive information due to shared microarchitectural predictor states, which affect transient execution for some IntelR Core™ processors 10th generation, may allow an authenticated user to potentially disclose information through local access...

Astra Linux – Vulnerability in the 389-DS-base

A flaw was discovered in the ‘deref’ plugin of 389-ds-base, where it could use the ‘search’ permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes...

Astra Linux – Vulnerability in Redis

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can provide a crafted serialized payload that triggers invalid memory access and may...

Astra Linux – Vulnerability in Intel Microcode

The sequence of processor instructions may lead to unexpected behavior on some Intel processors. This could potentially allow an authenticated user to enable privilege escalation, information disclosure, or denial of service through local access...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba’s DNS server. A authenticated user could exploit this flaw to cause damage to the RPC server. This RPC server, which also supports protocols other than dnsserver, will be restarted after a short delay. However, it is easy for an authenticated, non-administrative...

Astra Linux – Vulnerability in Dbus

A issue was discovered in D-Bus before 1.12.24, 1.13.x, and 1.14.x, before 1.14.4, and 1.15.x, before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format...

Astra Linux – Vulnerability in Intel Microcode

Observable timing discrepancies in some Intel processors may allow an authenticated user to potentially enable information disclosure through local access...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. In versions prior to 8.0.3, as well as in 7.4.5, 7.2.10, and 6.2.19, an authenticated user could use a specially crafted string to trigger an out-of-bounds write operation on the hyperloglog data structure, potentially leadin...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: Do not modify the data when using authenticated encryption. It was stated that authenticated encryption could produce invalid tags when the data being encrypted was modified 1. Therefore, this issue can be addressed by...

Astra Linux – Vulnerability in Intel Microcode

The sequence of processor instructions in IntelR CoreTM Ultra Processors may lead to unexpected behaviors. This could potentially allow an authenticated user to enable denial of service through local access...

CVE-2026-105474

A server-side template injection vulnerability exists in SolusVM 2 up to version 2.0.0-44576 . This flaw allows remote authenticated users to achieve arbitrary code execution with root privileges. The vulnerability is associated with CWE-1336 (Improper Neutralization of Special Elements Used in a...

CVE-2026-58392

The OPNsense firewall and routing platform (prior to version 26.1.11 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the NTP GPS page. The root cause is that the src/www/services_ntpd_gps.php component applies legacy_html_escape_form_data() to a base64-encoded initcmd value but sub...