GHSA-3MCP-22MF-VRW3 vulnerabilities

Vulnerabilities for packages: semaphore, opensearch-dashboards-fips, opensearch-dashboards, wazuh-dashboard, librechat, prism, redisinsight, langfuse-fips, nextcloud-server, kibana, kubeflow-centraldashboard, wazuh-dashboard-fips, azurite, lerna, langfuse, jitsucom-jitsu, gitlab-rails-ce-fips, aw...

CVE-2026-12876 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-FQ2J-3J99-RX65 vulnerabilities

Vulnerabilities for packages: semaphore, opensearch-dashboards-fips, opensearch-dashboards, wazuh-dashboard, librechat, prism, redisinsight, langfuse-fips, nextcloud-server, kibana, kubeflow-centraldashboard, wazuh-dashboard-fips, azurite, lerna, langfuse, jitsucom-jitsu, gitlab-rails-ce-fips, aw...

GHSA-6QM2-MCQ7-53QP vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, kafbat-ui, hadoop-client-modules, jenkins-plugin-manager, conductor-fips, geoserver, spark-kubernetes-operator, kafka, knative-kafka-broker, akhq, tez, ruby3.4-jrjackson, zookeeper, py3-vllm-cuda-12.4, nacos, spark-fips, jenkins, apache-tika,...

GHSA-4WW2-RJH2-XPV9 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, prism, langfuse, lerna, nextcloud-server, kubeflow-centraldashboard, opensearch-dashboards...

CVE-2026-12681 vulnerabilities

Vulnerabilities for packages: teleport-operator-fips, teleport, tbot...

Astra Linux – Vulnerability in Wireshark

IEEE 802.11 protocol dissector crashes in Wireshark versions 4.6.0 to 4.6.4...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: afunix: Obtaining userns from inskb in unixdiaggetexact. Wei Chen reported a NULL dereference in skuserns 01. Paolo identified the root cause: in unixdiaggetexact, the newly allocated skb does not have sk.2 We must obtain the...

CVE-2026-55622

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new projec...

CVE-2026-48769

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches th...

GHSA-JMRW-C58M-5H7J vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-XG37-CJ68-XWQ6 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-3GFH-MQ5V-C264 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu, linux-vmware, linux-gcp...

CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

CVE-2026-64551

In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a STALECOOKIE cause is received in the COOKIEECHOED state, sctpsfdo526stale reads the 4-byte Measure of Staleness that follows the cause...

CVE-2026-64271

In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on every complete packet twinterrupt accumulates each non-zero serial byte into a fixed three-byte buffer with a running index that is only reset once a full packet has been received and t...

CVE-2026-45383

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow out-of-bounds READ exists in decodercontext::decodesliceunitWPP in libde265/decctx.cc. When decoding a WPP Wavefront Parallel Processing HEVC slice, ctbAddrRS is computed as...

CVE-2026-44227

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

CVE-2026-55238

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capability sets. A remote, unauthenticated...

CVE-2026-63876

In the Linux kernel, the following vulnerability has been resolved: serial: zs: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to mono frame buffer device 160x64 fb0: PMAG-AA frame buffer device at tc0 DECstation Z85C30...