Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: afunix: Do not use GC if MSGPEEK occurred. Igor Ushakov reported that GC purged the receive queue of a live socket due to a race with MSGPEEK, with a fix provided. This is exactly the same issue that was previously fixed in the...

CVE-2026-14950

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...

CVE-2026-14951

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

CVE-2026-14952

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information tha...

EUVD-2026-63223

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information tha...

EUVD-2026-63222

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

EUVD-2026-63221

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...

CVE-2026-14950: Insufficient Session Expiration

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...

CVE-2026-14952: Missing Authentication for Critical Function

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information tha...

CVE-2026-14951: Cross-Site Request Forgery (CSRF)

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

PT-2026-78910

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information tha...

PT-2026-78908

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...

PT-2026-78909

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

fastapi-cognito (>=2.5.0, <=2.7.0), fds-sdk-utils (2.0.0) +3 more potentially affected by CVE-2026-49852 via joserfc (0.9.0)

joserfc PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on joserfc and may be impacted: - fastapi-cognito =2.5.0, =0.1.3, =0.18.1, =0.1.0, =0.5.5 Source cves: CVE-2026-49852 Source advisory: OSV:PYSEC-2026-2528...

fds-sdk-utils (>=2.0.1, <=2.1.0) potentially affected by CVE-2026-49852 via joserfc (0.11.1)

joserfc PYPI version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on joserfc and may be impacted: - fds-sdk-utils =2.0.1, =2.1.0 Source cves: CVE-2026-49852 Source advisory: OSV:PYSEC-2026-2528...

fds-sdk-utils (>=2.0.1, <=2.1.0) potentially affected by CVE-2026-27932 via joserfc (0.11.1)

joserfc PYPI version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on joserfc and may be impacted: - fds-sdk-utils =2.0.1, =2.1.0 Source cves: CVE-2026-27932 Source advisory: OSV:PYSEC-2026-2529...

fastapi-cognito (>=2.5.0, <=2.7.0), fds-sdk-utils (2.0.0) +3 more potentially affected by CVE-2026-27932 via joserfc (0.9.0)

joserfc PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on joserfc and may be impacted: - fastapi-cognito =2.5.0, =0.1.3, =0.18.1, =0.1.0, =0.5.5 Source cves: CVE-2026-27932 Source advisory: OSV:PYSEC-2026-2529...

did-sdk-python (>=1.0.0, <=1.1.3), django-ninja-aio-crud (>=1.0.5, <=3.0.1) +9 more potentially affected by CVE-2026-27932 via joserfc (>=1.0.0, <=1.6.1)

joserfc PYPI version =1.0.0, =1.0.0, =1.0.5, =2.6.0, =2.1.1, =3.0.2, =0.21.2, =0.6.0, =0.9.0, =0.1.0, =0.5.0 Source cves: CVE-2026-27932 Source advisory: OSV:PYSEC-2026-2529...

fastapi-cognito (>=2.5.0, <=2.7.0), fds-sdk-utils (2.0.0) +3 more potentially affected by CVE-2026-49852 via joserfc (0.9.0)

joserfc PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on joserfc and may be impacted: - fastapi-cognito =2.5.0, =0.1.3, =0.18.1, =0.1.0, =0.5.5 Source cves: CVE-2026-49852 Source advisory: OSV:GHSA-GG9X-QCX2-XMRH...

fds-sdk-utils (>=2.0.1, <=2.1.0) potentially affected by CVE-2026-49852 via joserfc (0.11.1)

joserfc PYPI version 0.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on joserfc and may be impacted: - fds-sdk-utils =2.0.1, =2.1.0 Source cves: CVE-2026-49852 Source advisory: OSV:GHSA-GG9X-QCX2-XMRH...