GHSA-3MCP-22MF-VRW3 vulnerabilities

Vulnerabilities for packages: librechat, kubeflow-centraldashboard, wazuh-dashboard, azurite, prism, nextcloud-server, redisinsight, semaphore, jitsucom-jitsu, lerna, kibana, wazuh-dashboard-fips, langfuse, langfuse-fips, awx, gitlab-rails-ce-fips, opensearch-dashboards-fips, gitlab-rails-ce,...

CVE-2026-12876 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-FQ2J-3J99-RX65 vulnerabilities

Vulnerabilities for packages: librechat, kubeflow-centraldashboard, wazuh-dashboard, azurite, prism, nextcloud-server, redisinsight, semaphore, jitsucom-jitsu, lerna, kibana, wazuh-dashboard-fips, langfuse, langfuse-fips, awx, gitlab-rails-ce-fips, opensearch-dashboards-fips, gitlab-rails-ce,...

GHSA-6QM2-MCQ7-53QP vulnerabilities

Vulnerabilities for packages: ruby4.0-jrjackson, kayenta, zipkin, apache-nifi-registry, management-api-for-apache-cassandra-5.0, jenkins, pinot, py3-vllm-cuda-12.4, tritonserver-backend-vllm-cuda-13.0, kafka-fips, geoserver, wavefront-proxy, akhq, hadoop-client-modules, hadoop-fips, cassandra,...

GHSA-4WW2-RJH2-XPV9 vulnerabilities

Vulnerabilities for packages: langfuse, nextcloud-server, lerna, jitsucom-jitsu, kubeflow-centraldashboard, opensearch-dashboards, prism...

CVE-2026-12681 vulnerabilities

Vulnerabilities for packages: tbot, teleport-operator-fips, teleport...

Astra Linux – Vulnerability in Wireshark

IEEE 802.11 protocol dissector crashes in Wireshark versions 4.6.0 to 4.6.4...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: afunix: Obtaining userns from inskb in unixdiaggetexact. Wei Chen reported a NULL dereference in skuserns 01. Paolo identified the root cause: in unixdiaggetexact, the newly allocated skb does not have sk.2 We must obtain the...

CVE-2026-55622

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new projec...

CVE-2026-48769

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches th...

GHSA-JMRW-C58M-5H7J vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-XG37-CJ68-XWQ6 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-3GFH-MQ5V-C264 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-gcp, linux-azure, linux-qemu...

CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

CVE-2026-64551

In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a STALECOOKIE cause is received in the COOKIEECHOED state, sctpsfdo526stale reads the 4-byte Measure of Staleness that follows the cause...

CVE-2026-64271

In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on every complete packet twinterrupt accumulates each non-zero serial byte into a fixed three-byte buffer with a running index that is only reset once a full packet has been received and t...

CVE-2026-45383

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.0.19 have a heap buffer overflow out-of-bounds READ exists in decodercontext::decodesliceunitWPP in libde265/decctx.cc. When decoding a WPP Wavefront Parallel Processing HEVC slice, ctbAddrRS is computed as...

CVE-2026-44227

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

CVE-2026-55238

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capability sets. A remote, unauthenticated...

CVE-2026-63876

In the Linux kernel, the following vulnerability has been resolved: serial: zs: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to mono frame buffer device 160x64 fb0: PMAG-AA frame buffer device at tc0 DECstation Z85C30...