Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-6.1

A flaw in memory leak prevention in the Linux kernel’s cpuentryarea mechanism for mapping X86 CPU data to memory was discovered. This flaw allows a local user to guess the locations of exception stacks or other important data. By exploiting this flaw, a local user can gain access to certain...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: virtio-gpu: A missing check was fixed to avoid NULL dereferencing. cacheent could potentially be set to NULL inside virtiogpucmdgetcapset, which could lead to a NULL dereferencing due to its recent use i.e., ptr =...

CVE-2026-10556 Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

CVE-2026-10556 Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

CVE-2026-10556

Mattermost versions 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads. This allows an unauthenticated attacker to send a crafted POST request to the public webhook endpoint, crashing the Microso...

CVE-2026-90880

creationtimestamp| type| source ---|---|--- 2026-09-14 07:31:00+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117268221776876628 2026-09-15 11:46:19+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mvkkgothuv2c...

PT-2026-91750

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A race condition occurs during supplicant re-authentication, which can leave a stale Access Control List ACL entry in the system. If an administrator restarts t...

PT-2026-91758

Name of the Vulnerable Software and Affected Versions DevSpace versions prior to 6.3.22 Description The software fails to reject parent-directory segments in tar entry names originating from the in-pod sync stream. This allows an attacker operating a malicious container to stream tar entries...

CVE-2026-33956: Out-of-bounds Write

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Sending a malformed message to the testmsg sysfs entry causes an out-of-bounds write, leading to denial of service...

CVE-2026-75944: Incomplete Cleanup

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction an AclAgent restart by an...

CVE-2026-80912

creationtimestamp| type| source ---|---|--- 2026-09-13 20:50:07+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvghv7ytma2e 2026-09-13 20:50:10+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117265701617196467...

CVE-2026-89724

creationtimestamp| type| source ---|---|--- 2026-09-13 20:00:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvgf4butcg2e 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20261002...

CVE-2026-89748

creationtimestamp| type| source ---|---|--- 2026-09-13 16:01:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvfxrdikcg22...

CVE-2026-81002

creationtimestamp| type| source ---|---|--- 2026-09-13 13:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvfo6nc4ig2n 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20261002...

CVE-2026-77773

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin (versions before 2.15.8 ) is vulnerable to unauthorized data disclosure. The flaw exists because one of its public AJAX actions fails to perform required capability, nonce, or session checks . This allows unauthenticated user...

libyal:libvsgpt_partition_fuzzer: Heap-buffer-overflow in libvsgpt_partition_entry_read_data

Detailed Report: https://oss-fuzz.com/testcase?key=6082663170244608 Project: libyal Fuzzing Engine: libFuzzer Fuzz Target: libvsgptpartitionfuzzer Job Type: libfuzzerasani386libyal Platform Id: linux Crash Type: Heap-buffer-overflow READ 16 Crash Address: 0xf4e00651 Crash State:...

CVE-2026-89626

creationtimestamp| type| source ---|---|--- 2026-09-13 00:31:43+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117260910566293006 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20261002...

PT-2026-90965

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...

CVE-2026-77102

creationtimestamp| type| source ---|---|--- 2026-09-12 17:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvdmn6ol5m2k...

CVE-2026-81402

creationtimestamp| type| source ---|---|--- 2026-09-12 16:40:10+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvdjhdpavg2t 2026-09-12 20:01:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvduoifhap2o...