OESA-2026-3723 util-linux security update

The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fixes: util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privilege...

CVE-2026-59569

creationtimestamp| type| source ---|---|--- 2026-09-14 16:05:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6zfkww6wjfg5h 2026-09-21 12:10:41+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117308957574042512 2026-09-21 12:20:05+00:00| seen|...

CVE-2026-61797

creationtimestamp| type| source ---|---|--- 2026-09-14 15:09:41+00:00| seen| https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mvifdge5ft2z 2026-09-14 21:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102329 2026-09-15 00:00:09+00:00| published-proof-of-concept|...

CVE-2026-90786

creationtimestamp| type| source ---|---|--- 2026-09-14 14:36:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2vqxxinlsgmbn...

CVE-2026-71801

creationtimestamp| type| source ---|---|--- 2026-09-14 14:22:41+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3mvicpf4it42q...

CVE-2026-86348

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...

CVE-2026-15600 SQL Injection in Alior Bank raty PrestaShop module

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts value of the POST parameter "status" into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or...

CVE-2026-7848

The Alior Bank "raty" PrestaShop module for commercial partners is vulnerable to SQL Injection in three hook methods (hookActionObjectProductUpdateBefore, hookActionObjectCategoryUpdateBefore, and hookActionObjectCategoryAddAfter). The module inserts the POST parameters alior_product_promotion, a...

CVE-2026-7848 SQL Injection in Alior Bank raty PrestaShop module

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters...

EUVD-2026-77518

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters...

CVE-2026-88024

creationtimestamp| type| source ---|---|--- 2026-09-14 14:00:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mvibhel47j2u...

CVE-2026-88023

creationtimestamp| type| source ---|---|--- 2026-09-14 14:00:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mvibhel47j2u...

CVE-2026-86348 MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...

EUVD-2026-77481

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...

CVE-2026-86348 MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...

CVE-2026-86348

CVE-2026-86348 affects the MS Calendar plugin for Mattermost (versions ≤11.9, 11.0.9, 11.4.8, 11.7.7, and 10.22.11.0). The plugin fails to recover from handler panics triggered by a post-action request containing an unexpected field type , allowing an authenticated user to crash the plugin proces...

CVE-2026-89099

creationtimestamp| type| source ---|---|--- 2026-09-14 12:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvi3ca5sl224 2026-09-14 14:00:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mvibhel47j2u...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: rocker: A memory leak was fixed in rockerworldportpostfini. In rockerworldportpreinit, rockerport-wpriv is allocated using kzallocwops-portprivsize, GFPKERNEL. However, in rockerworldportpostfini, the memory is only freed when th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validates wqesize before using it in ibuverbspostsend. The ibuverbspostsend function uses cmd.wqesize from the user space without any validation before passing it to kmalloc. As a result, the allocated buffer is used...

Astra Linux – Vulnerability in curl

There is an information disclosure vulnerability in curl v8.1.0 when performing HTTPS transfers. libcurl may incorrectly use the read callback CURLOPTREADFUNCTION to request data to be sent, even when the CURLOPTPOSTFIELDS option is set. This occurs if the same handle was previously used to issue...