Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: setting BTRFSROOTORPHANCLEANUP during subvol creation We have recently observed a number of subvolumes with corrupted dentries. Listing the parent directory shows the following: drwxrwxrwt 1 root root 16 Jan 23 16:49...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: nilfs2: Fixed state management in the error-prone path of the log writing function. After the commit a694291a6211 “nilfs2: separating the wait function from nilfssegctorwrite” was applied, the log writing function...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: jbd2: The assertion “jh-bfrozendata == NULL” failed when the journal was aborted. The following process will fail the assertion “jh-bfrozendata == NULL” in jbd2journaldirtymetadata: jbd2journalcommitTransaction; unlinkdir/a; jh-b...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: btrfs: Always report an error in runonedelayedref. Currently, we have a btrfsdebug function for handling failures in runonedelayedref. However, if end users encounter such problems, there will be no chance that btrfsdebug is...

Astra Linux – Vulnerability in isc-dhcp

In ISC DHCP 4.4.0 - 4.4.3, and ISC DHCP 4.1-ESV-R1 - 4.1-ESV-R16-P1, when the function optioncodehashlookup is called from addOption, it increments the refcount field of the option. However, there is no corresponding call to optiondereference to decrement the refcount field. The function addOptio...

Astra Linux – Vulnerability in Xen

x86: TSX Async Abort protections are not restored after S3. This issue relates to the TSX Async Abort speculative security vulnerability. For more details, please refer to https://xenbits.xen.org/xsa/advisory-305.html. To mitigate TAA by disabling TSX the default and preferred option, it is...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Perform lockless command completion in the abort path While adding and removing controllers, the following call trace was observed: WARNING: CPU: 3 PID: 623596 at kernel/dma/mapping.c:532 dmafree attrs+0x33/0x50 CP...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: btrfs: Fixed a transaction abort issue when snapping received subvolumes. Currently, a user can trigger a transaction abort by snapping a previously received snapshot multiple times until an item overflow occurs the maximum item...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: fixed a transaction abort during file creation due to name hash collisions. If we attempt to create several files with names that result in the same hash, we must package them in the same directory item, and there is a...

Amazon Linux 2023 : cups-filters, cups-filters-devel, cups-filters-libs (ALAS2023-2026-2127)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2127 advisory. A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort...

CVE-2026-90535

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...

CVE-2026-90535 Flowise before 3.1.4 Denial of Service via text-to-speech/abort

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...

CVE-2026-90535 Flowise before 3.1.4 Denial of Service via text-to-speech/abort

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...

EUVD-2026-76853

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...

CVE-2026-90535

Flowise versions before 3.1.4 are affected by an unauthenticated denial-of-service vulnerability in the /api/v1/text-to-speech/abort endpoint. The root cause is that the endpoint accepts user-supplied chatflowId and chatId values without ownership verification, allowing an attacker to terminate a...

CVE-2026-90535 Flowise before 3.1.4 Denial of Service via text-to-speech/abort

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...

PT-2026-90640

🚨 CVE-2026-90535 Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user ...

Linux Distros Unpatched Vulnerability : CVE-2026-89646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an...

CVE-2026-90535: Missing Authorization

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...

DEBIAN-CVE-2026-89646

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...