Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode The MDSMap exporttargets entries are monitored. checknewmap uses each entry as a bit number within a fixed stack bitmap; thus, a rank outside the protocol namespace c...

Astra Linux – vulnerability in Chromium

In Google Chrome on Aura, use of “After Free” after 154.0.8037.57 allows a local attacker to potentially execute arbitrary code outside the sandbox via UI interaction. Chromium security severity: High...

Astra Linux – vulnerability in Chromium

In Google Chrome’s WebUI, incorrect authorization prior to version 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a specially crafted HTML page. Chromium security severity: High...

Astra Linux – vulnerability in Chromium

After free in the Actor in Google Chrome prior to version 154.0.8037.57, a remote attacker could execute arbitrary code within the sandbox by using a specially crafted HTML page. Chromium security severity: Medium...

Astra Linux – vulnerability in Chromium

In WebAudio in Google Chrome prior to version 154.0.8037.57, use of “after free” allowed a remote attacker to execute arbitrary code within the sandbox via a specially crafted HTML page. Chromium security severity: High...

Astra Linux – vulnerability in Chromium

Prior to version 154.0.8037.57, using “After Free” in the Verifier component within Google Chrome allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via specially crafted network traffic. Chromium security severity: Medium...

Astra Linux – vulnerability in Chromium

In Google Chrome on HID, use of “After Free” was permitted prior to version 154.0.8037.57; this allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a specially crafted HTML page. Chromium security severity: High...

Astra Linux – vulnerability in Chromium

In ANGLE, using “after free” in Google Chrome prior to version 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a specially crafted HTML page. Chromium security severity: Medium...

Exploit for Improper Access Control in Widgetfactorylimited Jce

ZERODAY // JCE RCE CONSOLE Console operator all-in-one untuk...

libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements

A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the xmlSnprintfElements function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited...

Important: Red Hat Security Advisory: libxml2 security update

An update for libxml2 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow

A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the xmlDictAddQString function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its...

CVE-2026-91908

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution...

Security Bulletin: User Entity Behavior Analytics App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. User Entity Behavior Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2025-11226 DESCRIPTION:...

CVE-2026-109083 Apache Syncope: Remote Code Execution via Flowable JUEL expression

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expressi...

CVE-2026-109083

Apache Syncope is vulnerable to Remote Code Execution (RCE) due to improper isolation or compartmentalization. An administrator with sufficient entitlements can use the REST API to import arbitrary BPMN process definitions . If these processes contain JUEL expressions , the expressions execute di...

kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period

A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol TCP connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could explo...

pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint)

A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's...

Important: Red Hat Security Advisory: pki-core:10.6 security update

An update for the pki-core:10.6 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

flatpak: Flatpak: Arbitrary code execution via missing symlink protection

A flaw was found in Flatpak. A malicious sandboxed application can exploit missing symlink protection during the creation and bind-mounting of app data directories. By manipulating attacker-controlled path components, a malicious symlink can redirect these directories to arbitrary locations on th...