Astra Linux – Vulnerability in Linux, Linux 5.10

A race condition accessing file objects in the Linux kernel OverlayFS subsystem was identified. This occurs when users renames files using OverlayFS in a specific manner. A local user could exploit this flaw to cause the system to crash...

Astra Linux – Vulnerability in Intel Microcode

A observable discrepancy in the RAPL interface of certain Intel processors may allow a privileged user to potentially enable information disclosure through local access...

Astra Linux – Vulnerability in dpdk

A flaw was discovered in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as auxiliary data to VHOSTUSERGETINFLIGHTFD / VHOSTUSERSETINFLIGHTFD messages that are not closed by the vhost-user slave. By continuously sending such messages, the malicious...

Astra Linux – Vulnerability in Linux 5.15

A flaw in the NULL Pointer Dereference mechanism within the Linux kernel’s NTFS3 driver function attrpunchhole was identified. A local user could exploit this flaw to crash the system...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In 64-bit versions of the Linux kernel, Copyfromuser does not implement uaccessbeginnospec, which allows a user to bypass the “accessok” check and pass a kernel pointer to copyfromuser. This would enable an attacker to leak sensitive information. We recommend upgrading beyond commit...

Astra Linux – Vulnerability in Chromium

Type confusion in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted UI interaction. Chromium security severity: Low...

Astra Linux – Vulnerability in Intel Microcode

Improper initialization of shared resources in some IntelR processors may allow an authenticated user to potentially enable information disclosure via local access...

Astra Linux – Vulnerability in FLAC

In FLACbitreaderreadricesignedblock of bitreader.c, there is a potential out-of-bounds read due to a heap buffer overflow. This could lead to remote information disclosure without requiring additional execution privileges. User interaction is required for exploitation. Product: Android. Versions:...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk.Authenticated users can use string matching commands such as SCAN or KEYS with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% of CPU resources. This issue has been fixed in...

Astra Linux - Vulnerability in golang-github-emicklei-go-restful

Authorization bypass through user-controlled keys in the GitHub repository in the emicklei/go-restful library, prior to version 3.8.0...

postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...

CVE-2026-12882

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and...

CVE-2026-15814

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a...

CVE-2026-8821 Playbooks run owner channel membership permission bypass

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field...

CVE-2026-8821

Mattermost versions 11.9.0, 11.8.4, 11.7.7, and 10.11.22 (and below within their respective branches) contain a permission bypass in the Playbooks feature. During playbook run creation, the system fails to validate the channel member-management permission, allowing an authenticated channel member...

CVE-2026-15814

Mattermost Server versions 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files. An authenticated user can cause excessive server memory consumption and potential denial of service by uploading a ...

CVE-2026-15814 Uploading a crafted image causes excessive memory allocation in the Mattermost Server

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a...

CVE-2026-15814 Uploading a crafted image causes excessive memory allocation in the Mattermost Server

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a...

CVE-2026-14344 Inconsistent authorization checks in Mattermost Boards endpoints

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.. Mattermost Advisory I...