Astra Linux – Vulnerability in Firefox, Thunderbird

When checking whether the Browsing Context was discarded in HttpBaseChannel, if the load group was not available, it was assumed that the Browsing Context had already been discarded. However, this assumption was not always true for private channels after the private session ended. This...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: rcv: process: Fixed kernel gp leakage childregs represents the registers that are active for the new thread in the user context. For a kernel thread, childregs-gp is never used, as the kernel’s gp value is not touched by the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

A race condition was detected in the Linux kernel’s RxRPC network protocol, during the processing of RxRPC bundles. This issue arises due to the lack of proper locking when performing operations on an object. This could allow an attacker to escalate privileges and execute arbitrary code within th...

Astra Linux – Vulnerability in Linux, Linux 5.10

A heap-based buffer overflow flaw was discovered in the way the legacyparseparam function in the Linux kernel’s Filesystem Context functionality verifies the length of the supplied parameters. A non-privileged user if non-privileged user namespaces are enabled, otherwise requiring CAPSYSADMIN...

EUVD-2026-77426

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 6.9.0 - In the ajaxcontact, optinform and formbuilder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was...

CVE-2026-79701 Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0 - In the ajaxcontact, optinform and formbuilder addons, the result returned by the CAPTCHA plugin's...

CVE-2026-85196

Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla 20.0.0, Users Anywhere extension for Joomla 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is use...

EUVD-2026-77214

Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla 20.0.0, Users Anywhere extension for Joomla 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is use...

PT-2026-91743

Name of the Vulnerable Software and Affected Versions Activiti versions prior to 7.1.0.M7 Description Failure to validate hash-brace deferred expressions in process variables allows attackers to bypass expression filtering. By injecting expressions starting with , an attacker can store these...

PT-2026-91457

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description An authenticated attacker can access the MCP server context of another user. This issue occurs due to improper cache key isolation within the MCP Tools component. Recommendations Updat...

PT-2026-91161

Name of the Vulnerable Software and Affected Versions Bifrost HTTP transport versions prior to 2.1.0 Description Bifrost allows the registration of MCP clients through its management API, where a stdio client consists of a command and arguments. The software starts the program in the gateway...

PT-2026-91105

Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla 20.0.0, Users Anywhere extension for Joomla 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is use...

PT-2026-91166

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 6.9.0 - In the ajax contact, optin form and form builder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was...

Linux Kernel Crypto Subsystem Use-After-Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...

Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. Furthermore, only systems with KSMBD enabled are vulnerable. The specific flaw exists within the handling of dirfp...

Linux Kernel eMPIA USB Device Driver Race Condition Code Execution Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of em28xxv4l2 structures. The issue results from the lack of prope...

CVE-2026-91145: Improper Neutralization of Special Elements used in an Expression Language Statement

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

Linux Kernel NTFS3 Journal Heap-based Buffer Overflow Code Execution Vulnerability

This vulnerability allows local attackers to execute arbitrary code on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Cisco Secure_Firewall_Management_Center

CVE-2026-20079 Cisco FMC Read-Only Checker A small, deliberat...

SUSE CVE-2026-81010

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: honor taskwork cancellation iowaitidcb may run through the fallback taskwork path when taskworkadd can no longer queue work to the originating task. The fallback runs from a kworker and iouring marks such task wor...