PT-2026-136092

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking dm cache used a rw semaphore for background work lock. Write locks on rw semaphores have strict owner semantics, but there was no guarantee that the process that locked background...

CVE-2026-73292

CVE-2026-73292 – CSRF Password Change in Semaphore UI For educational and responsible disclosure purposes only. This vulnerability has been reported in GHSA-8cj9-r88m-8945 and affect semaphoreui versions below 2.18.21. Vulnerability The password change endpoint of Semaphore UI does not implement...

SUSE CVE-2026-112305

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

EUVD-2026-104397

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305

Semaphore UI versions through 2.19.16 are vulnerable to remote code execution (RCE) due to an improperly controlled modification of dynamically-determined object attributes (CWE-915). Users with the task_runner role can override protected Ansible variables by injecting arbitrary keys into the tas...

CVE-2026-112305 Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305 Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112305 Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

PT-2026-117465

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible ssh common args with a ProxyCommand or...

CVE-2026-112305: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

Semaphore UI input validation error vulnerability

Semaphore UI versions prior to 2.19.16 have a vulnerability in input validation. This vulnerability arises because users with the taskrunner role can provide arbitrary keys in the task environment JSON, thereby overriding protected Ansible variables. This allows them to set ansiblesshcommonargs’s...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A issue was discovered in the file drivers/media/dvb-core/dvbfrontend.c within the Linux kernel version 6.2. There is a blocking operation that occurs when a task is in the !TASKRUNNING state. In the function dvbfrontendgetevent, the function waiteventinterruptible is called; the condition used i...

Astra Linux – vulnerability in linux-5.10

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix use-after-free bug for mm struct Under certain conditions, such as MPIAbort, the hfi1 cleanup code may represent the last reference held on the task mm. hfi1mmurbunregister then drops this last reference and frees...

CVE-2026-98245

In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in markblockgrouptocopy markblockgrouptocopy iterates over the commit root with skiplocking=true. A concurrent transaction commit can swap and free the commit root during iteration...

CVE-2026-101898 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, commercial-gitlab-rails-ee, lambda-nodejs, kibana, prism, librechat, langfuse, awx, kubeflow-centraldashboard, gitlab-rails-ce, nextcloud-server, redisinsight, semaphore, commercial-gitlab-rails-ee-fips, lerna,...

CVE-2026-101899 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, commercial-gitlab-rails-ee, lambda-nodejs, kibana, prism, librechat, langfuse, awx, kubeflow-centraldashboard, gitlab-rails-ce, nextcloud-server, redisinsight, semaphore, commercial-gitlab-rails-ee-fips, lerna,...

CVE-2026-101902 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, commercial-gitlab-rails-ee, lambda-nodejs, kibana, azurite, prism, librechat, langfuse, awx, kubeflow-centraldashboard, gitlab-rails-ce, nextcloud-server, redisinsight, semaphore, commercial-gitlab-rails-ee-fips,...

CVE-2026-101907 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, commercial-gitlab-rails-ee, lambda-nodejs, kibana, prism, librechat, langfuse, awx, kubeflow-centraldashboard, gitlab-rails-ce, nextcloud-server, redisinsight, semaphore, commercial-gitlab-rails-ee-fips, lerna,...