Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm: Check that output polling is initialized before disabling it. In drmkmshelperpolldisable, check that output polling is initialized before disabling polling. If not, flag this as a warning. Additionally, in...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: A memory leak was fixed in the parseleasestate function. The previous patch that added a bounds check for the create lease context introduced a memory leak. When the bounds check fails, the function returns NULL, without...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: tty: ngsm: added a sanity check for gsm-receive in gsmreceivebuf A null pointer dereference can occur when attempting to access the “gsm-receive” function in gsmldreceivebuf. Currently, the code assumes that gsm-recieve is only...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of the numdests header Before accessing the numdests field of the struct batadvtvlvmcasttracker, it was attempted to check whether there is enough space in the network header. However, instead of...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: KVM: nVMX: Moving the consistency check between vTPR and TPR Threshold to “normal” checks Moving the off-by-default consistency check for vmcs12.tprthreshold versus the virtual APIC vTPR to the “normal” control checks is...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: added a bounds check in dfhgetparamsize The dfhgetparamsize function can return a parameter size that is larger than the feature region, because the loop’s bounds check is evaluated before increasing the size. If the E...

CVE-2026-74595

A flaw was found in the Linux kernel's fscrypt component. When setting an encryption policy on an idmapped mount, the fscryptioctlsetpolicy function incorrectly performs an owner check. This vulnerability can lead to legitimate users being denied access to set encryption policies, while...

CVE-2026-56865

A flaw was found in golang.org/x/mod/sumdb/tlog. A malicious Go proxy GOPROXY could exploit this vulnerability by forging sumdb tiles. This allowed the proxy to bypass integrity checks and serve malicious module content to a local Go module cache, which would then go undetected by the transparenc...

Malicious Package

Overview video-crate-check is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview dext-crate-check is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview text-crate-check is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview voice-crate-check is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Mozilla: Arbitrary JavaScript execution in PDF.js

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context...

Mozilla: Arbitrary JavaScript execution in PDF.js

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context...

PT-2026-81020

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::add opaque omits the check no metavar no fvar call that the definition and theorem paths perform, so a value containing a free variable that is absent from the local context is not rejected outright. A...

PT-2026-81024

Name of the Vulnerable Software and Affected Versions joserfc versions prior to 1.7.3 Description The JWTClaimsRegistry component incorrectly applies membership matching to list-valued iss and sub claims. This behavior allows an array-valued iss that contains the expected issuer to pass an equali...

ROS-20260824-73-0024

The vulnerability in gpac is related to the lack of checks for division by zero. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Wave5 VPU DoS

The vulnerability in the drivers/media/platform/chips-media/wave5/wave5-vpu.c component of the Linux kernel is related to insufficient validation of the state of shared resources. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

CVE-2026-59335 - UAA case insensitive check bypass | Cloud Foundry

Severity CVSSv4.0 – 7.7 — CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSSv3.1 – 8.7 — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N Vendor CloudFoundry Foundation Versions Affected Severity is High unless otherwise noted. UAA All versions prior to v78.16.0 CF Deployment All...

PT-2026-80904

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...