CVE-2026-53939

A flaw was found in cjose. When encrypting a JSON Web Encryption JWE object using AES-CBC-HMAC algorithms, the library initializes the encryption key with all-zero bytes instead of generating a secure random key. As a result, an attacker who intercepts the encrypted message can decrypt sensitive...

openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy

A flaw was found in OpenSSH, a widely used tool for secure remote access. When a user attempts to copy files between two different remote systems using the scp command, the file might be incorrectly placed in a directory above the intended destination. This unintended file placement could lead to...

DEBIAN-CVE-2026-98207

In the Linux kernel, the following vulnerability has been resolved: mmc: spi: reset bytesxfered before retrying CRC failures mmcspidatado updates data-bytesxfered after each block has been transferred successfully. If a later block in the same data request fails with a CRC error, data-bytesxfered...

CVE-2026-71299

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-71297

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forge...

CVE-2026-71297 Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forge...

CVE-2026-71297

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forge...

EUVD-2026-92758

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-71299 Maestro: maestro: rest api write endpoints registered without authentication middleware

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-71299

A flaw was discovered in Maestro where its REST API write endpoints were registered without proper authentication middleware . This vulnerability allows a remote attacker to perform unauthorized write operations, specifically creating, modifying, or deleting consumers and resource bundles . Such ...

CVE-2026-71299

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-59787

A flaw was found in Zabbix. The Perl Simple Network Management Protocol SNMP trap receiver script does not properly sanitize the record delimiter within incoming trap content. An attacker capable of sending SNMP traps can exploit this vulnerability to inject forged trap records targeting other...

Astra Linux – Vulnerability in amd64-microcode

Incomplete system memory cleanup in the SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in a loss of data integrity...

Astra Linux – Vulnerability in PostgresSQL 11

A flaw was discovered in PostgreSQL versions prior to 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20, and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, ther...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Do not set EXT4GETBLOCKSCONVERT when splitting an unwritten extent before submitting I/O. When allocating blocks during within-EOF DIO and with dioreadnolock enabled, EXT4GETBLOCKSPREIO was set to split an existing unwritte...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: platform: exynos4-is: Added a hardware sync wait to fimcishwchangemode In fimcishwchangemode, the function changes camera modes without waiting for hardware completion. This can lead to corrupted data or a system hanging i...

PT-2026-106191

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...

CVE-2026-71297: Missing Authentication for Critical Function

A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forge...

PT-2026-106220

Name of the Vulnerable Software and Affected Versions maestro gRPC broker affected versions not specified Description A flaw in the maestro gRPC broker allows a remote attacker possessing a valid client certificate to bypass authentication. This allows the attacker to subscribe to event streams...

CVE-2026-71299: Missing Authentication for Critical Function

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...