Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the “block” section, there’s a issue where rq and qos structures are released without the disk being handled first. The blkcginitqueue function may add these structures to the request queue. Previously, the blkcleanupqueue...

CVE-2026-74690

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ismdevexit A ism interrupt handler can be active in parallel with ismdevexit, accessing freed data structures. No new interrupts will be generated after unregisterieq. Drain ongoing interru...

EUVD-2026-58508

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

Linux Distros Unpatched Vulnerability : CVE-2026-33818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-33818 Note that Nessus relies on t...

AZL-96653 CVE-2026-33818 affecting package golang 1.25.12-1

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CVE-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

CVE-2026-72785

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission without saveCategories for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via t...

CVE-2026-72785

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission without saveCategories for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via t...

CVE-2026-72785 Craft CMS before 5.10.6 Authorization Bypass via structures/move-element

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission without saveCategories for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via t...

CVE-2026-72785

Summary (CVE-2026-72785) Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability in the category structure controls. A control-panel user with only the viewCategories permission (no saveCategories ) for a category group can permanently reorder or re-parent categories ...

CVE-2026-72785: Incorrect Authorization

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission without saveCategories for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via t...

PT-2026-70203

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.5 Description An incorrect authorization issue exists where a control-panel user with only the viewCategories permission, but lacking the saveCategories permission, can permanently modify a category...

PT-2026-76017

A control-panel user who holds only the viewCategories permission for a category group and not saveCategories can permanently modify that group's category structure — reordering and re-parenting categories via the structures/move-element action. A read-time authorization grant that a write endpoi...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the IETFUtils.valueToString method, reached through X500Name.toString, equals, and hashCode via AbstractX500NameStyle, which escapes each special character with vBuf.insertindex, "\" on the same...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in JcePKCSPBEInputDecryptorProviderBuilder and JceOpenSSLPKCS8DecryptorProviderBuilder, which parse PBES2Parameters from attacker-supplied EncryptedPrivateKeyInfo, PKCS12, or CMS...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in JcePKCSPBEInputDecryptorProviderBuilder and JceOpenSSLPKCS8DecryptorProviderBuilder, which parse PBES2Parameters from attacker-supplied EncryptedPrivateKeyInfo, PKCS12, or CMS...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in JcePKCSPBEInputDecryptorProviderBuilder and JceOpenSSLPKCS8DecryptorProviderBuilder, which parse PBES2Parameters from attacker-supplied EncryptedPrivateKeyInfo, PKCS12, or CMS...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in JcePKCSPBEInputDecryptorProviderBuilder and JceOpenSSLPKCS8DecryptorProviderBuilder, which parse PBES2Parameters from attacker-supplied EncryptedPrivateKeyInfo, PKCS12, or CMS...

The vulnerability of the Microsoft SQL Server database management system lies in the lack of measures taken to protect SQL query structures, allowing attackers to enhance their privileges.

The vulnerability of the Microsoft SQL Server database management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...

SUSE CVE-2026-46668

SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0...