CVE-2026-84445 affecting package azcopy for versions less than 10.25.1-9

CVE-2026-84445 affecting package azcopy for versions less than 10.25.1-9. An upgraded version of the package is available that resolves this issue...

CVE-2026-84304 affecting package skopeo for versions less than 1.14.4-13

CVE-2026-84304 affecting package skopeo for versions less than 1.14.4-13. A patched version of the package is available...

CVE-2026-84445 affecting package telegraf for versions less than 1.31.0-33

CVE-2026-84445 affecting package telegraf for versions less than 1.31.0-33. An upgraded version of the package is available that resolves this issue...

CVE-2026-37236 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9

CVE-2026-37236 affecting package cloud-provider-kubevirt for versions less than 0.5.1-9. A patched version of the package is available...

CVE-2026-72924 affecting package gh for versions less than 2.101.0-1

CVE-2026-72924 affecting package gh for versions less than 2.101.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-84445 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10

CVE-2026-84445 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10. An upgraded version of the package is available that resolves this issue...

CVE-2026-7598 affecting package rust for versions less than 1.96.1-2

CVE-2026-7598 affecting package rust for versions less than 1.96.1-2. A patched version of the package is available...

Astra Linux – Vulnerability in Systemd

Before version 247, systemd does not properly prevent local privilege escalation for certain Sudo configurations. For example, plausible sudoers files may allow the execution of the “systemctl status” command. Specifically, systemd does not set LESSSECURE to 1, allowing other programs to be...

Astra Linux – Vulnerability in Thunderbird, Firefox

Memory safety bugs exist in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has be...

Astra Linux – Vulnerability in Less

The value “less through 653” allows for OS command execution via a newline character in the file name, due to improper handling of quotes in the filename.c file. Exploitation typically requires the use of file names controlled by the attacker, such as those extracted from untrusted archives...

Astra Linux – Vulnerability in Less

Closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE...

Astra Linux – Vulnerability in Firefox and Thunderbird

When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

CVE-2026-81910

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

EUVD-2026-76193

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

CVE-2026-81910

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in the Theme Customizer . Style values handled by classes such as ColorStyle, FontFamilyStyle, and ImageStyle are interpolated into server-compiled LESS source without neutralizing LESS syntax. An attacker with th...

PT-2026-90048

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

CVE-2026-81910: Improper Neutralization of Special Elements Used in a Template Engine

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...