rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure

A flaw was found in rsync. This vulnerability allows a remote attacker to bypass hostname-based access control rules. By inducing DNS resolution failures, the rsync daemon incorrectly skips deny rules, granting unauthorized access to restricted module file trees...

CVE-2026-15893 Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS

netifipv6calcreachabletime in subsys/net/ip/netif.c derives a randomized ND reachable time from ipv6-basereachabletime as minreachable + sysrand32get % maxreachable - minreachable, where minreachable = base/2 and maxreachable = 3base/2 using integer division. When basereachabletime is 1, both...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

GHSA-RRXG-G2PF-6HH4 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

Summary The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...

CVE-2026-90786 Dvidelabs flatcc Duplicate Symbol semantics.c align_order_members assertion

A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. This impacts the function alignordermembers of the file src/compiler/semantics.c of the component Duplicate Symbol Handler. This manipulation causes reachable assertion. The attack can be initiated remotely. The exploit has been...

CVE-2026-90785 Dvidelabs flatcc Struct Analysis semantics.c analyze_struct assertion

A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyzestruct of the file src/compiler/semantics.c of the component Struct Analysis. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit has been made public...

CVE-2026-90929

File Browser versions 2.5.0 through 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go). Unlike the TUS handler, the direct-upload path does not reject a target that is an existing directory. A POST with ?override=true aimed at a...

CVE-2026-90929 File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

CVE-2026-90929 File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

CVE-2026-90929 File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: power: supply: wm97xx: A NULL pointer dereferencing issue has been fixed in powersupplychanged. In probe, requestirq is called before allocating/registering a powersupply handle. If an interrupt is fired between the call to...

Astra Linux – Vulnerability in ffmpeg5

A flaw was discovered in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services a...

Astra Linux – Vulnerability in glib2.0

A flaw was discovered in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, resulting in a denial of service...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Releasing rproc-cleantable after rprocattach fails When rproc-state = RPROCDETACHED is attached to a remote processor through rprocattach, if rprochandleresources returns an error, the clean table should be...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: plfxlc: Removed an erroneous assertion in plfxlcmacrelease The plfxlcmacrelease function includes an assertion that checks whether mac-lock is held. This assertion is incorrect, because even if it were possible, it would no...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: media: cxusb: No longer judges rbuf when the write fails syzbot reported a uninit-value in cxusbi2cxfer. Only when the write operation of usbbulkmsg in dvbusbgenericrw succeeds and rlen is greater than 0, the read operation of...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: xfs: fixed issues with freemap adjustments when adding xattrs to leaf blocks. Both xfs/592 and xfs/794 fail this assertion in the leaf block freemap adjustment code after approximately 20 minutes of execution on my test VMs...

Astra Linux – Vulnerability in Apache Log4j2

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters prohibited by the XML 1.0 standard, resulting in malformed XML output. Compatible XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: SCSI: BFA: Double-free vulnerability fix When the bfadimprobe function fails during initialization, the memory pointed to by bfad-im is freed without setting bfad-im to NULL. Subsequently, during driver uninstallation, when the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: Do not log conflicting inodes if it’s a directory that was moved during the current transaction. We cannot log an conflicting inode if it’s a directory that was moved from one parent directory to another parent directory...