Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Do not use BUGON in hfspluscreateattributesfile. When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplusfillsuper assumes that the attributes file has not yet been...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: A overflow issue was fixed in the bitmapipcreate function before the bitmap was widened. When firstip is 0, lastip is 0xFFFFFFFF, and the netmask is 31, the value of an arithmetic expression 2 netmask - maskbits...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Handle errors from amdgpucgscreatedevice in amdpowerplaycreate. Add error handling to propagate the failures of amdgpucgscreatedevice to the caller. When amdgpucgscreatedevice fails, release hwmgr and return -ENOMEM t...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: eir: Fixed possible crashes when using eircreateadvdata. eircreateadvdata may attempt to add EIRFLAGS and EIRTXPOWER without checking whether those values are compatible with the structure...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Fixed a general protection fault in runismappedfull. ntfscreate inode: Fixed the deletion of a non-resident attribute...

CVE-2026-105289

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2026-105289 feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2026-105289 feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2026-105289

The feelec-yishu feelcrm-os version 1.0.0 is vulnerable to a Cross-Site Scripting (XSS) flaw within the Create Customer Endpoint component. The root cause is the use of the htmlspecialchars_decode function in the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php. An attacker can initiate...

EUVD-2026-92393

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2025-24813_presentation

这是一个使用 create-next-app 引导创建的 Next.js 项目。 开始 首先，运行开发服务器： npm run dev 或 yarn dev 或 pnpm dev 或 bun dev 用浏览器打开 http://localhost:3000 查看结果。 你可以通过修改 app/page.tsx 文件开始编辑页面。编辑时页面将自动更新。 本项目使用 next/font 自动优化并加载 Geist 字体，这是 Vercel 新推出的一款字体。 了解更多 要了解更多关于 Next.js 的信息，请查看以下资源： Next.js 文档 —— 了解 Next.js 的功能和 API...

CVE-2024-39719

Ollama 文件存在性泄露漏洞 CVE-2024-39719 详细分析 漏洞概述 CVE-2024-39719 是一个影响 Ollama 0.3.14 及之前版本的文件存在性泄露（File Existence Disclosure）漏洞。该漏洞允许攻击者通过 API 接口探测服务器上特定文件是否存在，从而可能导致信息泄露。 发布日期 ：2024年10月31日 漏洞详情 漏洞原理 该漏洞存在于 Ollama 的 /api/create 端点中。当攻击者调用 CreateModel API...

CVE-2026-105688: Improper Privilege Management

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check used by...

PT-2026-106239

Name of the Vulnerable Software and Affected Versions Camunda versions 7.24.0 through 7.24.14 Description An incorrect authorization issue exists in the Admin web application's first-run setup endpoint. The SetupResource incorrectly determines if the setup process is available by counting only...

PT-2026-104797

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars decode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customer formremark...

EUVD-2026-92443

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...

CVE-2026-88391

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...

CVE-2026-105289: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2026-88391

Northstar (dromara/northstar, quantitative trading platform) versions

CVE-2026-88391: Undefined Security Weakness

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...