CVE-2025-26686-The-TCP-IP-Flaw-That-Opens-the-Gates

CVE-2025-26686-The-TCP-IP-Flaw-That-Opens-the-Gates A critical RCE vulnerability in Windows TCP/IP stack CVE-2025-26686 leaves sensitive memory unlocked, allowing remote attackers to hijack systems. Exploitable over the network, it risks full compromise. Patch now By Mark Mallia Type: Remote Code...

EUVD-2026-108761

In the Linux kernel, the following vulnerability has been resolved: cxgb4/chktls: disable softirqs around tidlist erases chcrktlscplactopenrpl inserts into tidlist from the receive path using xainsertbh. The array is shared by the adapter's connections and initialized with XAFLAGSLOCKBH. However,...

Pillow: TarIO negative size field causes infinite CPU-spin loop

Summary TarIO.init does not check that a tar header's size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns. Details TarIO.init reads 512-byte tar headers one at a time, looking for a...

CVE-2026-96642 Pillow: TarIO negative size field causes infinite CPU-spin loop

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

CVE-2026-96642

The Pillow Python imaging library is vulnerable to an infinite CPU-spin loop in the TarIO initializer (located in src/PIL/TarIO.py) in versions prior to 13.0.0 . The root cause is the acceptance of a negative octal member size , which triggers a backward seek that returns to the same 512-byte hea...

CVE-2026-96642 Pillow: TarIO negative size field causes infinite CPU-spin loop

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

PT-2026-117051

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkg tryget closest bio set dev associates the bio with a blkg through bio associate blkg. If the blkg lookup misses, blkg tryget closest takes q-queue lock with spin lock irq and releases it with sp...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: can: bcm: fixed locking issues for runtime updates of bcmop. The commit c2aba69d0c36 “can: bcm: added locking for runtime updates of bcmop” added locking for certain variables that can be modified during runtime when updating the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8192u: Fixed a deadlock in ieee80211beaconsstop. There is a deadlock in ieee80211beaconsstop, as shown below: Thread 1 | Thread 2 | ieee80211sendbeacon ieee80211beaconsstop | modtimer spinlockirqsave //1 | Wa...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: smc91x: fixed a broken irq-context in PREEMPTRT When smc91x.c is built with PREEMPTRT, the following error occurs in FVPRevC: 13.055000 smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000 13.062137 BUG: The workqueu...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Drivers: tty: serial: Fixed a deadlock in sa1100settermios There is a deadlock in sa1100settermios, as shown below: Thread 1 | Thread 2 | sa1100enablems sa1100settermios | modtimer spinlockirqsave //1 | Wait for a while ... |...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: rainshadow-cec: Fixed the TOCTOU race condition in raininterrupt. In the interrupt handler raininterrupt, the check for buffer fullness on rain-buflen is performed before acquiring rain-buflock. This creates a Time-of-Chec...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/hns: Fixed the use of spinunlockirqrestore, which is called with IRQs enabled. Fixed incorrect use of spinlockirq/spinunlockirq when spinlockirqsave/spinlockirqrestore was held. This issue was discovered through lock...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: PM: core: keep irq flags in devicepmcheckcallbacks The function devicepmcheckcallbacks can be called under the spin lock in the reported case, it happens from genpdadddevice - devpmdomainset, when the genpd uses spinlocks rather...

CVE-2026-106031

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones...

EUVD-2026-101851

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones...

CVE-2026-106031 Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones...

WordPress Spin Wheel plugin < 2.2.1 - Unauthenticated Coupon Code Disclosure vulnerability

Unauthenticated Coupon Code Disclosure vulnerability discovered by Aditya Gurav in WordPress Plugin Spin Wheel versions 2.2.1...

CVE-2026-106031

The Spin Wheel WordPress plugin, in versions prior to 2.2.1 , is vulnerable to Unauthenticated Coupon Code Disclosure due to a lack of verification that a visitor performed a legitimate spin. Attackers can forge spin results to disclose and drain stored prize coupon codes from any campaign, inclu...

CVE-2026-106031 Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones...