Astra Linux – Vulnerability in Apache2

A out-of-bounds read vulnerability exists in the modmacro module of the Apache HTTP Server. This issue affects the Apache HTTP Server version up to 2.4.57...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.65 and earlier, with Server Side Includes SSI enabled and modcgid but not modcgi, pass the shell-escaped query string to the exec cmd="..." directives. This issue affects Apache HTTP Server versions prior to 2.4.66. Users are recommended to upgrade to version 2.4.66, which...

Astra Linux – Vulnerability in Apache2

A properly crafted method sent via HTTP/2 will bypass validation and be forwarded by modproxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server versions 2.4.17 to 2.4.48...

Astra Linux – Vulnerability in Apache2

The Apache HTTP Server protocol handler for the HTTP/2 protocol checks the received request headers against the size limitations configured for the server. These restrictions are also applied to the HTTP/1 protocol. If any violations occur, an HTTP response is sent to the client with a status cod...

Astra Linux – Vulnerability in Linux 5.15

The following vulnerability has been resolved in the Linux kernel: btrfs: fixed an issue with the tree mod log handling of reallocated nodes. We have observed the following panics in production: - Kernel bug at fs/btrfs/tree-mod-log.c:677! - Invalid opcode: 0000 1 SMP - RIP:...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server versions 2.4.0 to 2.4.46: A specially crafted Digest nonce can cause a stack overflow in modauthdigest. There is no report of this overflow being exploitable, nor can the Apache HTTP Server team have created such a report. However, certain compilers and/or compilation options...

Astra Linux – Vulnerability in Apache2

A potential vulnerability in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly set up URLs to be handled by modproxy. Users are recommended to upgrade to version 2.4.60, which fixes this issue...

Astra Linux – Vulnerability in Apache2

In Apache HTTP Server 2.4.59 and earlier, a null pointer dereference vulnerability in modproxy allows an attacker to crash the server through a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107313)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107313 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix tree mod log mishandling of reallocated nodes We have been seeing the following panic...

CVE-2026-56864

A flaw was found in golang.org/x/mod/sumdb. A malicious Go checksum database GOSUMDB can serve arbitrary module content that is not recorded in the transparency log. This allows a coordinated Go proxy GOPROXY and GOSUMDB to deliver malicious module content to a client, which cannot be detected by...

CVE-2026-79387

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields including passwords and roles via crafted parameters to the User/mod interface, enabling account takeover...

CVE-2026-79387

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields including passwords and roles via crafted parameters to the User/mod interface, enabling account takeover...

CVE-2026-79387

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields including passwords and roles via crafted parameters to the User/mod interface, enabling account takeover...

PT-2026-89154

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields including passwords and roles via crafted parameters to the User/mod interface, enabling account takeover...

EUVD-2026-75157

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields including passwords and roles via crafted parameters to the User/mod interface, enabling account takeover...

CVE-2026-79387

A SQL injection (CWE-89) in PbootCMS versions 3.2.0 through 3.2.5 resides in the User/mod interface. The field and value GET parameters in UserController::mod() are concatenated directly into a SQL UPDATE statement with no whitelist validation or parameterized query , allowing an authenticated at...

CVE-2026-79387: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields including passwords and roles via crafted parameters to the User/mod interface, enabling account takeover...

CVE-2026-6244

libpcap BPF interpreter for the 'div k' and 'mod k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero...

PT-2026-84268

The mod auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all...

PT-2026-84264

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.16 Erlang/OTP versions 28.0 through 28.5.0.5 Erlang/OTP versions 29.0 through 29.0.5 Description Improper handling of case sensitivity in the inets httpd component allows a remote unauthenticated attacke...