Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Two use-after-free operations in ibmasminitone have been fixed. In ibmasminitone, it calls ibmasminitremoteinputdev. Inside ibmasminitremoteinputdev, mousedev and keybddev are allocated by inputallocatedevice...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fixed the null-ptr-deref issue in ibcorecleanup. KASAN reported a null-ptr-deref error: KASAN: Null pointer dereferencing in the range 0x0000000000000118–0x000000000000011f. CPU: 1; PID: 379. Hardware name: QEMU Standa...

PT-2026-115066

bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie init file in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num pages field as the loop bound for byte-swapping page sizes entries. A crafted file can make the loo...

PT-2026-115162

Name of the Vulnerable Software and Affected Versions libTiMidity versions prior to 0.2.9 Description An out-of-bounds access issue exists in the init soundfont function within src/sndfont.c. This occurs when the software processes unvalidated SF2 preset header bank and preset values. A remote...

CVE-2026-110611

REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or...

CVE-2026-73130

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can...

CVE-2026-110611 REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid

REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or...

CVE-2026-110611

REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or...

PT-2026-114053

Name of the Vulnerable Software and Affected Versions REBUILD versions REBUILD through 4.5.0 Description An authorization bypass exists in the AiBot2Controller /aibot2 endpoints. The system processes a caller-supplied chatid without verifying if the requester owns that ID. This allows authenticat...

Linux Distros Unpatched Vulnerability : CVE-2026-107615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary...

PT-2026-114043

Name of the Vulnerable Software and Affected Versions libsixel versions prior to 1.8.7-r1 libsixel versions 1.9.0 through 1.10.5 Description A heap out-of-bounds write occurs in the gif init frame function within src/fromgif.c because the GIF transparent color index is not validated against the...

CVE-2026-110611: Authorization Bypass Through User-Controlled Key

REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-delete, chat-feedback, or...

PT-2026-111204

A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function gguf init from file of the file ggml.c of the component GGUF Parser. This manipulation of the argument data offset causes out-of-bounds read. The attack requires local...

UBUNTU-CVE-2026-107615

An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init and ThemeLib load screenhooks32.dll / screenhooks64.dll with LoadLibrary using a bare fi...

CVE-2026-44828

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

CVE-2026-44828

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/initstep/ through initstepapi without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first...

PT-2026-110983

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init step/ through init step api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the fir...

EulerOS 2.0 SP13 : kbd (EulerOS-SA-2026-4147)

According to the versions of the kbd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented...

OPENSUSE-SU-2026:12107-1 amazon-ecs-init-1.108.0-1.1 on GA media

These are all security issues fixed in the amazon-ecs-init-1.108.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-108751

MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so...