PT-2026-93109

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon versions 4.0.0 through 4.5.4 Description A flaw in the helidon-webserver-static-content component allows an unauthenticated attacker with network access via HTTP to compromise the system. This can lead to a han...

CVE-2026-87289: Uncontrolled Resource Consumption

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-static-content. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attac...

PT-2026-92067

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0 Description An out-of-bounds write issue exists in server-side static virtual channel handling when CHANNEL OPTION SHOW PROTOCOL is enabled. Authenticated clients can queue oversized channel messages, leading t...

CVE-2026-91836: Incomplete Comparison with Missing Factors

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/staticscanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The...

PT-2026-92036

Name of the Vulnerable Software and Affected Versions OpenClaw ClawScan versions prior to 0.1.7 Description A flaw in the Static Scanner component, specifically within the file internal/runner/static scanner.go, allows for an incomplete comparison with missing factors. This issue can be exploited...

CVE-2026-68489

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...

EUVD-2026-78137

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...

CVE-2026-68489

CVE-2026-68489 is a Static Code Injection vulnerability in two Plesk extensions: Ruby (before 1.6.6) and Node.js Toolkit (before 2.5.0). A remote authenticated user can execute arbitrary code as root by crafting malicious custom environment variables . The vulnerability scores 8.7 (HIGH) under CV...

CVE-2026-68489

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...

Gixy-Next v0.7.1

Gixy-Next: NGINX Configuration Security Scanner for Security Audits Overview Gixy-Next Gixy is an open-source NGINX configuration security scanner and hardening tool that statically analyzes your nginx.conf to detect security misconfigurations, hardening gaps, and common performance pitfalls befo...

CVE-2026-12258

Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email address. When the value entered belongs to a registered customer, the service returns the associated information email address...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: pinctrl: Fix: Address the issue where ofparsephandlewithargs returns a devicenode pointer with a refcount incremented in gpiospec.np. The loop iterates through all phandles, but never releases the reference, resulting in a refcou...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vmci: Speculation leaks were prevented by sanitizing the eventdata parameter in the eventdeliver function. Coverity identified that the eventmsg is controlled by user-space. The eventmsg-eventdata.event is passed to eventdeliver...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: Fixed the issue where corrupted pointer deletion occurred in cases of region creation failures. In cases where region creation fails in ipcdevlinkcreateregion, the previously created regions are deleted using a...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netdevsim: A trailing zero was added to terminate the string in nsimnexthopbucketactivitywrite. This issue was identified by a static analyzer. We should not forget the trailing zero after copyfromuser if we will perform further...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fixed a potential memory overflow issue with staticcommandline. We allocated memory of size ‘xlen + strlenbootcommandline + 1 for staticcommandline. However, the strings copied into staticcommandline were actually...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: crypto: safexcel – Added error handling for dmamapsg calls The macro dmamapsg function may return 0 in the event of an error. This patch enables checks in case of a macro failure and ensures that previously mapped buffers are...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/via: Avoid potential array out-of-bound access in addsecretdacpath The sndhdagetconnections function may return a negative error code. This could lead to accessing the ‘conn’ array at a negative index. This issue was...

Astra Linux – Vulnerability in HAPProxy

Before version 2.8.2, HAProxy allowed to be part of the URI component. This could allow remote attackers to obtain sensitive information or cause unspecified other issues due to misinterpretation of the pathend rule, such as routing index.html.png to a static server...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: mac80211: Fixed an underflow in staticbranchdec for aqldisable. syzbot reported an underflow in staticbranchdec in aqlenablewrite. 0 The issue arises because aqlenablewrite does not serialize concurrent write operations ...