CLEANSTART-2026-VR06102 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the helm package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

PT-2026-91919

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

PT-2026-92515

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description Improper neutralization of a user-supplied custom date format when rendering conversation messages leads to reflected cross-site scripting XSS, a technique where malicious scripts are injected...

CVE-2026-82567: Missing Authorization

The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the...

PT-2026-98424

Multiple security vulnerabilities affect the helm package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

CVE-2026-84600

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A malicious shortcut may be able to send messages without user confirmation...

CVE-2026-19872

A flaw was found in HTML::FormHandler. A remote attacker could exploit this vulnerability by submitting malicious input that is then rendered unescaped in error messages. This allows the attacker to execute arbitrary script code in the victim's browser, potentially leading to information disclosu...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

CVE-2026-90771

A flaw was found in joi. This vulnerability, known as prototype pollution, exists in the messages compilation function. A remote attacker can exploit this by supplying specially crafted proto keys in custom messages. This allows the attacker to manipulate object properties, which could lead to...

CVE-2026-90938 LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket

LangBot's plugin runtime pip package langbotplugin through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 /plugin/ws whose authentication is gated on plugindebugkey, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose which...

Astra Linux – Vulnerability in Thunderbird

Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird versions earlier than 128.4.3 and Thunderbird version 132.0.1...

Astra Linux – Vulnerability in Golang-1.19

Calling Decoder.Decode on a message that contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...

Astra Linux – Vulnerability in sudo

Before version 1.9.13, Sudo did not escape control characters in log messages...

Astra Linux – Vulnerability in rabbitMQ-server

RabbitMQ is a multi-protocol messaging and streaming broker. The HTTP API does not enforce a limit on the size of HTTP request bodies, making it vulnerable to Denial of Service DoS attacks involving very large messages. A verified user with sufficient credentials can publish very large messages...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: fixed a stack overflow issue in line6miditransmit. The issue was addressed by correctly calculating the available space, including the size of the buffer. This correction prevents a buffer overflow when multiple MIDI...

Astra Linux – Vulnerability in Thunderbird

Certain crafted MIME email messages that claimed to contain encrypted OpenPGP messages actually contained an OpenPGP-signed message. These messages were incorrectly displayed as encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8...

Astra Linux – Vulnerability in openjpeg2

A flaw was discovered in OpenJPEG. Pictures constructed maliciously can cause the program to enter a large loop and continuously print warning messages on the terminal...

Astra Linux – Vulnerability in NBD

In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a crafted NBDOPTINFO or NBDOPTGO message with a large value as the length of the name...