Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fixed a use-after-free in iscsitdecsessionusagecount. In iscsitdecsessionusagecount, the function calls complete while holding the sess-sessionusagelock. Similar to the connection usage counting logic, the...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939sessionactivate fail if the device is no longer registered. syzbot still reports: unregisternetdevice: waiting for vcan0 to become free. Usage count = 2. Even after commit 93a27b5891b8 “can: j1939: add missi...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: tpm2-sessions: Fixed an issue with out-of-range indexing in namesize. namesize does not have any range checks; it simply indexes using TPMALGID, which could lead to memory corruption in extreme cases. The issue was addressed b...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: Fixed a race condition in the RPC handle list access mechanism. The sess-rpchandlelist XArray manages RPC handles within a ksmbd session. Access to this list is intended to be protected by sess-rpclock a rwsemaphore...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fixed a reference count leak when an invalid session is found during session lookup. When a session is found, but its state is not SMB2SESSIONVALID, it indicates that no valid session was found. However, the reference coun...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb/server: A possible reference count leak in smb2sesssetup has been fixed. The reference count of ksmbdsession will leak when the session requires reconnection. This issue has been fixed by adding the missing ksmbdusersessionpu...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: j1939xtprxrtssessionactive – The session is deactivated upon receiving the second RTS packet. Since j1939tprxtimer calls j1939sessiondeactivateactivatenext only when the timer is enabled, we need to call this...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: l2tp: Fixed a memory leak in l2tpudpencaprecv. syzbot reported a memory leak in struct l2tpsession, l2tptunnel, sock, etc. 0 The referenced commit moved the validation of the protocol version in l2tpudpencaprecv. The new...

PT-2026-69989

Name of the Vulnerable Software and Affected Versions PingFederate versions prior to 13.1 Description Cross-Site Request Forgery CSRF weaknesses in the Administrative Console may allow actors to perform unauthorized actions. This occurs when administrators with active sessions are triggered to...

Linux Distros Unpatched Vulnerability : CVE-2026-68130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: defer destroyprevioussession until after NTLM authentication In ntlmauthenticate, destroyprevioussession is called using a user pointer resolved from the...

Linux Distros Unpatched Vulnerability : CVE-2026-68408

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: cfg80211: convert pmsrfreewk to wiphywork to fix deadlock When a netlink socket that owns a PMSR session is closed, cfg80211releasepmsr clears the...

CVE-2026-19370 bartekke8it56w2 new-mcp geminithinking index.ts fs.readFileSync path traversal

A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires...

CVE-2026-15038

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-15038 InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

EUVD-2026-54882

The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator sessio...

CVE-2026-15038

The CVE affects the InfiniteWP Client WordPress plugin (before 1.13.6). Root cause: it does not properly verify the site-connection state or the authenticity of requests to its remote-management endpoint on WordPress Multisite installations. Impact: unauthenticated attackers can bind their own ke...

CVE-2026-19327

A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is calle...

CVE-2026-19327

CVE-2026-19327 affects the package abracadabra50 claude-sesh 1.0.0. The flaw is in the function getEnrichedData/enrichSession within src/services/enricher.ts, where manipulating the argument sessionId can trigger path traversal. The issue is operable locally, with CVSS-based assessments indicatin...

CVE-2026-19327 abracadabra50 claude-sesh enricher.ts enrichSession path traversal

A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is calle...

Linux Distros Unpatched Vulnerability : CVE-2026-19016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted...