CVE-2026-12985 Mattermost DCR redirect URI allowlist bypass via improper URL component validation

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...

OPENSUSE-SU-2026:21846-1 Security update for keybase-client

This update for keybase-client fixes the following issues: Changes in keybase-client: - CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library Add update-go-crypto.patch to update affected dependency bsc1278586. - Update to go 1.26 as required ...

Security Bulletin: IBM MQ Java messaging is vulnerable to remote code execution (CVE-2026-13293)

Summary IBM MQ has addressed a bypass of the Java deserialization allowlist in the IBM MQ JMS client that could allow a remote authenticated attacker to execute arbitrary code on a system consuming JMS ObjectMessages Vulnerability Details CVEID:CVE-2026-13293 DESCRIPTION: IBM MQ could allow a...

Security Bulletin: IBM MQ Java messaging is vulnerable to remote code execution (CVE-2026-10751)

Summary IBM MQ has addressed a Java deserialization filter bypass in the IBM MQ JMS client that could allow a remote authenticated attacker to execute arbitrary code Vulnerability Details CVEID:CVE-2026-10751 DESCRIPTION: IBM MQ Java and JMS client libraries could allow an authenticated attacker ...

CVE-2026-78336

Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless ...

Astra Linux – Vulnerability in isc-dhcp

In ISC DHCP 4.1-ESV-R1 - 4.1-ESV-R16, ISC DHCP 4.4.0 - 4.4.2 Other branches of ISC DHCP e.g., releases in the 4.0.x series or earlier, and releases in the 4.3.x series are beyond their End-of-Life period and are no longer supported by ISC. It is clear that this defect is also present in releases...

Astra Linux – Vulnerability in mbedtls

In Mbed TLS versions prior to 2.28.10, and 3.x versions prior to 3.6.3, on the client side, servers with trusted certificates for arbitrary hostnames are accepted, unless the TLS client application calls mbedtlssslsethostname...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fixed a potential Use-after-Allocation UAF in cifsstatsprocwrite. Skipped sessions that are being terminated status == SESEXITING to avoid UAF...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. This flaw occurs when dropping packets during a bulk transfer from a SPICE client, due to the packet queue being full. A malicious SPICE client could exploit this flaw to call the free function in...

Astra Linux – Vulnerability in Squid

A issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, sensitive information about clients using the proxy may be exposed through an HTTPS request to an internal cache manager URL. This issue has been fixed in version 5.7...

Astra Linux – Vulnerability in Tomcat9

There is an improper authentication vulnerability in Apache Tomcat, which means that under certain circumstances e.g., using CLIENT-CERT or SPNEGO, a user can be authenticated even if the user does not exist in the DataSourceRealm. This issue affects Apache Tomcat versions from 11.0.0-M1 through...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: smb: client: fixed UAF in async decryption Performing async decryption large read results in a crash due to a slabuseafterfree issue in the crypto API. Reproducing the issue: mount.cifs -o ...,seal,esize=1 //srv/share /mnt dd...

Astra Linux – Vulnerability in libvncserver

A divide by zero issue was detected in libvncserver-0.9.12. A malicious client could exploit this flaw to send a specially crafted message. When this message is processed by the VNC server, it will cause a floating-point exception, resulting in a denial of service...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Check if there is a station first in the client probe. When probing a client, first check if one exists, and then check the channel context. Otherwise, a warning can easily be triggered by probing when the AP hasn...

Astra Linux – Vulnerability in OpenSSL

Issue summary: A uncommon configuration where clients perform DANE TLSA-based server authentication, combined with unusual server DANE TLSA records, may lead to a use-after-free or double-free on the client side. Impact summary: A use-after-free can have various potential consequences, such as th...

Astra Linux – Vulnerability in libpgjava

pgjdbc is an open-source PostgreSQL JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc was vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server could instruct the driver to perform SCRAM authentication with a very large iteration...

Astra Linux – Vulnerability in Python 3.7, Python 2.7, Pypy

A vulnerability was discovered in Python before version 3.8.18, 3.9.x before version 3.9.18, 3.10.x before version 3.10.13, and 3.11.x before version 3.11.5. This vulnerability primarily affects servers such as HTTP servers that use TLS client authentication. When a TLS server-side socket is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fixed a use-after-free in cryptmessage when using asynchronous crypto. The fix for CVE-2024-50047 removes the asynchronous crypto handling from cryptmessage, assuming that all crypto operations are synchronous...

Astra Linux – Vulnerability in freerdp3, freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.22.0, the URBDRC client used server-supplied interface numbers as array indices without bounds checks, resulting in a out-of-bounds read in libusbudevselectinterface. This vulnerability has been fixed in version...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: smb: Client side – fixed a potential deadlock that could occur when releasing mids. All callers of releasemid seem to hold a reference to @mid. Therefore, there is no need to call krefput&mid-refcount, releasemid under...