Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: qrtr: The MHI channel should start after the endpoint creation. The MHI channel may generate an event/interrupt right after enabling. This can lead to two race condition issues. 1. Such events may be dropped by the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: dsa: Fix the dereferencing of netdevpriv before type checking in non-DSA network device events. After the affected commit, we began handling this dereferencing for every NETDEVCHANGEUPPER and NETDEVPRECHANGEUPPER event in th...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: bridge: switchdev: Skip MDB replays of deferred events on offload Before this change, the generation of the list of MDB events to replay competed with the creation of new group memberhips, either through the IGMP/MLD snoopin...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Tracing: Free buffers when a used dynamic event is removed After 65536 dynamic events have been added and removed, the “type” field of the event uses the first available type number which is not currently used by other events. A...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Tracing: Ensure that the traceprintk function can be used as soon as it is available. Currently, the traceprintk function can be used as soon as the earlyTraceinit function is called from startkernel. However, if a crash occurs,...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: traceeventshist: A check was added to ensure that the return value of createhistfield is checked. The function createhistfield is called recursively at line 1954 of traceeventshist.c, and it may return a NULL value. Therefore, we...

Astra Linux – Vulnerability in Firefox and Thunderbird

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks were executed for those events. Web content that attempted to use those interfaces would not be able to do so with elevated privileges. However, the presence of these interfaces indicated...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: KVM: The mask PEBSENABLE must be loaded for guests with a specified vCPU value. When generating the MSRIA32PEBSENABLE value that will be loaded on the VM-Entry to a KVM guest, the value should be masked with the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fixed a data race between perfeventsetoutput and perfmmapclose. Yang Jihing reported a race between perfeventsetoutput and perfmmapclose: CPU1 CPU2 perfmmapclosee2 if atomicdecandtest&e2-rb-mmapcount // 1 - 0 then...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7091r: Allow users to configure device events AD7091R-5 devices are supported by the ad7091r-5 driver, along with the ad7091r-base driver. These drivers declare iio events to notify user space when ADC readings fall...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: KVM: x86: Acquiring kvm-srcu when handling KVMSETVCPUEVENTS Acquire kvm-srcu when processing KVMSETVCPUEVENTS. When SMM mode is toggled, KVM will forcibly leave the nested VMX/SVM state. Leaving such a state also results in...

WordPress Mobile Events Manager plugin <= 1.4.8.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Enrico Marcolini Dottor Marc, Claudio Marchesini Dottor Marc in WordPress Plugin Mobile Events Manager versions = 1.4.8.3...

CVE-2026-45057

A flaw was found in matrix-sdk-ui. The component's message edit validation logic does not properly enforce encryption for replacement events, even when the original message was encrypted. This vulnerability allows a malicious homeserver administrator, or an attacker with similar capabilities, to...

VulnCheck KEV: CVE-2026-78159

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance objec...

PT-2026-91194

Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values. This issue affects Apache...

PT-2026-91747

Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events to a calendar governed by an approval...

CVE-2026-75015: Insufficiently Protected Credentials

Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowing administrators to access such sensitive values. This issue affects Apache...

CVE-2026-88802

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...

CVE-2026-88802 MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...

CVE-2026-88802

CVE-2026-88802 affects two WordPress plugins: MDJM Event Management (before 1.7.8.5) and Mobile Events Manager (through 1.4.8.3). The root cause is the absence of a capability check, nonce validation, or record-type verification in the plugins' playlist entry removal endpoint. An unauthenticated ...