ROS-20260922-73-0042

The vulnerability of the tlspushrecord function in the net/tls/tlssw.c module of the TLS protocol implementation in the Linux operating system is related to incorrect access to elements of the structure. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality...

EUVD-2026-84013

The Intel SEDI IPM inter-processor mailbox driver in drivers/ipm/ipmsedi.c handles an inbound message interrupt in ipmeventdispose. It read the peer-written doorbell register, extracted the payload length with IPCHEADERGETLENGTH, and passed that length straight to sediipcreadmsg to copy the messa...

ROS-20260921-73-0129

The vulnerability in Golang is related to the lack of protection for the structure of web pages. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the ColdFusion software platform, related to the lack of measures taken to protect the website structure, allows attackers to enhance their privileges.

The vulnerability of the ColdFusion software platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerabilities in the scripts included/language/language.php, includes/logging/blockLogFormatter.php, includes/logging/logFormatter.php, includes/logging/patrolLogFormatter.php, includes/logging/renameuserLogFormatter.php, includes/logging/tagLogFormatter.php, and includes/specials/specialVersion.php of the MediaWik software, which is used to implement the hypertext environment, allow attackers to perform cross-site scripting (XSS) attacks.

The vulnerability in the scripts included/language/language.php, includes/logging/blockLogFormatter.php, includes/logging/logFormatter.php, includes/logging/patrolLogFormatter.php, includes/logging/renameuserLogFormatter.php, includes/logging/tagLogFormatter.php, and...

ROS-20260916-73-0067

The vulnerability in the fs/btrfs/transaction.c component of the Linux operating system is related to incorrect handling of structure elements. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the script included in the syntaxhighlight.php tool used for implementing the MediaWiki hypertext environment allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the syntaxHighlight.php script used by the MediaWiki hypertext environment is related to insufficient protection of the web page structure. Exploiting this vulnerability could allow a malicious actor, operating remotely, to perform cross-site scripting attacks XSS...

CVE-2026-11864

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to...

CVE-2026-11864 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to...

CVE-2026-45766

A flaw was found in Suricata, a network Intrusion Detection System. Insufficiently bounded Network File System NFS parser state structures can be exploited by a remote attacker sending crafted NFS traffic. This can cause Suricata to consume excessive memory, leading to a denial of service...

CVE-2026-54503: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, includi...

ROS-20260915-73-0016

The vulnerability of the SVG component in Google Chrome and Microsoft Edge relates to the lack of protective measures for the structure of web pages. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and influence the integrity of data through a special...

ROS-20260915-73-0032

The vulnerability of the CSS component in Google Chrome and Microsoft Edge relates to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and influence the integrity of data through a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fixed an oops due to the absence of a prealloc backlog struct. If an AFRXRPC service socket is opened and bound, but the calls are pre-allocated, then rxrpcallocincomingcall will cause an oops because the rxrpcbacklog stru...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: actskbmod: prevent kernel-infoleak The syzbot discovered that tcfskbmoddump was copying four bytes from the kernel stack to user space 1. The issue here is that ‘struct tcskbmod’ has a four-byte hole. We need to cle...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: sched: actconnmark: Initialize struct tcife to prevent kernel leaks. In tcfconnmarkdump, the variable ‘opt’ was partially initialized using a specified initializer. As a result, the padding bytes remained uninitialized. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: usb: xhci: A memory leak was fixed in xhcidisableSlot. xhcialloccommand allocates a command structure. When the second argument is true, it also allocates a completion structure. Currently, the error handling code in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: authenable: avoid using current-nsproxy As mentioned in a previous commit of this series, using the net structure via current is not recommended for various reasons: - Inconsistency: obtaining information from the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Input: mtk-pmic-keys – fixed the issue of possible null pointer dereferencing. In mtkpmickeysprobe, the regs parameter is only set if the button is parsed in the device tree. However, on hardware where the button is left floating...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: PCI/DOE: Fixed the race involving destroyworkonstack. The following debug object splat was observed during testing: ODEBUG: Freeing an active object active state 0: 0000000097d23782; Object type: workstruct; Hint:...