CVE-2026-72760

The CVE-2026-72760 issue affects MISP cti-transmute where the account following-list endpoint returns the followed user’s email field in get_following() in addition to name, user ID, and follow date. The root cause is that email is included in the API response despite not being required for follo...

ROOT-OS-DEBIAN-13-CVE-2025-49506 CVE-2025-49506 in apr-util - Patched by Root

Root has patched CVE-2025-49506 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-68352

The CVE-2026-68352 affects the Linux kernel driver ath6kl (wifi). The issue is an out-of-bounds read in ath6kl_wmi_connect_event_rx() caused by firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len not being validated against the actual WMI event buffer length. The combined length ...

CVE-2026-68244

The CVE relates to the Linux kernel DRM/I915 GEM component. After a BALANCE/PARALLEL_SUBMIT extension during context creation, an error in processing the next user extension could leak the siblings[] array; this has been resolved. The fix is cherry-picked from commit aa65e0a4b51b3b54b53e4142aaa2d...

EUVD-2026-55511

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer destroyprevioussession until after NTLM authentication In ntlmauthenticate, destroyprevioussession is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response ...

EUVD-2026-55492

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx9: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054...

EUVD-2026-55489

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions e.g. 65536×65536 cause 32-bit integer overflow, wrapping the calculated buffer size to ...

ROOT-APP-PYPI-CVE-2026-34525 CVE-2026-34525 in aiohttp - Patched by Root

Root has patched CVE-2026-34525 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

EUVD-2026-55256

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

ROOT-APP-PYPI-CVE-2024-28219 CVE-2024-28219 in pillow - Patched by Root

Root has patched CVE-2024-28219 in the pillow package for Root:PyPI. Multiple fixed versions available...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: libceph: Prevent potential out-of-bounds reads in handleauthdone. Perform an explicit bounds check on payloadlen to avoid possible out-of-bounds accesses during the callout operation. idryomov: changelog...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: Removed the RTNL delay for SIOCBRADDIF and SIOCBRDELIF. SIOCBRDELIF is passed to devioctl first, and then forwarded to brioctlcall. This causes an unnecessary RTNL delay and a segmentation fault below 0 under RTNL pressur...

Astra Linux – Vulnerability in Firefox and Thunderbird

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Fixed a potential underflow in virtiotransportgetcredit. The credit calculation in virtiotransportgetcredit uses unsigned arithmetic: c ret = vvs-peerbufalloc - vvs-txcnt - vvs-peerfwdcnt; If the peer reduces its...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/handshake: The function handshakereqsubmit replaces sk-skdestruct, but it never restores it when submission fails before the request is hashed. As a result, handshakeskdestruct returns early, and the original destructor never...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: KEYS: Trusted – Fixed a memory leak in tpm2loadcmd. tpm2loadcmd allocates a temporary blob indirectly through tpm2keydecode, but the blob is not freed during failure paths. This issue can be addressed by wrapping the blob with a...

Astra Linux – Vulnerability in Firefox and Thunderbird

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

Astra Linux – Vulnerability in Firefox and Thunderbird

Sandbox escape due to a use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check dcehwseq before dereferencing it. WHAT hws was checked for being null earlier in dce110blankstream, indicating that hws can be null. This check should be performed whenever hws is used. Cherry-picked from...

Vite - Arbitrary File Read

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it...