Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Net: Ethernet: ti: am65-cpsw: Fix for freeing the IRQ in am65cpswnussremove Txchns. When obtaining the IRQ, we use k3udmagluetxgetirq, which returns a negative error value if there is an error. Therefore, checking if the IRQ is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: sh: dma: Fixed the DMA channel offset calculation. Various SoCs from the SH3, SH4, and SH4A family, which use this driver, have different numbers of DMA channels, and these channels can be distributed across up to two DMAC...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: do not trust the firmware’s nChannels value. If the firmware sends us a corrupted MCC response where nChannels is much larger than what the command response can handle, we might copy too much uninitialized...

Astra Linux – Vulnerability in Chromium

Side-channel information leakage in keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page...

Astra Linux – Vulnerability in Firefox and Thunderbird

A use-after-free vulnerability in media channels could lead to memory corruption and potentially exploitable crashes. This vulnerability affects Thunderbird 78.13, Thunderbird 91, Firefox ESR 78.13, and Firefox 91...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: dmaengine: Fixed an issue where the clientcount variable was incremented twice for public channels when dmachanget was called for a channel. This occurred first in balancerefcount, and again before returning. As a result, the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sfc: Fixed the TX channel offset when using legacy interrupts. In the legacy interrupt mode, the txchanneloffset was hardcoded to 1, but this is incorrect if efxsepparatetxChannels is set to false. In that case, the offset is 0...

CVE-2026-63466

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...

EUVD-2026-64042

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...

CVE-2026-9693

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

CVE-2026-9693

Mattermost 10.11.x (≤10.11.20) and 11.7.x (≤11.7.5) fail to delete thread membership records when a user leaves or is removed from a team. A previously removed user who is later re-invited can access private channel thread root post content and metadata via the team threads API, causing low confi...

CVE-2026-74549

In the Linux kernel, the following vulnerability has been resolved: hwmon: nct6775-core Prevent access to unsupported weight registers Sashiko reports: During initialization of the nct6116 chip, the driver sets data-pwmnum to 5. However, it assigns several NCT6106 register arrays such as...

UBUNTU-CVE-2026-72148

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Add spinlock to protect DONEINTMASK and ABORTINTMASK The DONEINTMASK and ABORTINTMASK registers are shared by all DMA channels, and modifying them requires a read-modify-write sequence. Because this operation ...

CVE-2026-72148 dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Add spinlock to protect DONEINTMASK and ABORTINTMASK The DONEINTMASK and ABORTINTMASK registers are shared by all DMA channels, and modifying them requires a read-modify-write sequence. Because this operation ...

PT-2026-72336

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Add spinlock to protect DONE INT MASK and ABORT INT MASK The DONE INT MASK and ABORT INT MASK registers are shared by all DMA channels, and modifying them requires a read-modify-write sequence. Because this...

CVE-2026-59714

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

EUVD-2026-55417

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...

EUVD-2026-54311

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-48078

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated /api/tenants/id/schedule endpoint returns every non-archived channel for a tenant regardless of the channel's isPublic flag. Channels marked...

CVE-2026-48078

OpenReception’s CVE-2026-48078 affects the scheduling endpoint prior to version 1.0.5. The unauthenticated /api/tenants/{id}/schedule endpoint exposed all non-archived channels for a tenant, including those with isPublic = false, disclosing channel names, descriptions, IDs, agent associations, pa...