CVE-2026-86348 MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fixed the nested key length validation in the set action. It is not safe to access nlalenovskey if the data is smaller than the netlink header. Ensure that the attribute is valid first...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check the frame size of the S1G action. Before checking the action code, make sure that it actually exists in the frame...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: tracing/hist: Fix out-of-bound write on ‘actiondata.varrefidx’ When generating a synthetic event with many parameters and then creating a trace action for it 1, a kernel panic occurred 2. This issue arises because in...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: gpio: mvebu: fixed the irq domain leak Uwe Kleine-König pointed out that we still have one resource leak in the mvebu driver, which is triggered when the driver is detached. We will address this issue by implementing a custom...

Astra Linux – Vulnerability in Rails

The Actionpack Ruby gem versions prior to 6.1.3.2, 6.0.3.7, 5.2.4.6, and 5.2.6 have a possible denial-of-service vulnerability in the Token Authentication logic of the Action Controller, due to overly permissive regular expressions. Affected code uses authenticateorrequestwithhttptoken or...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: Skip non-Ethernet packets Currently, tcfskbmodact assumes that packets use Ethernet as their L2 protocol. This assumption is not always true. For example, for CAN devices: bash $ ip link add dev vcan0 type...

Astra Linux – Vulnerability in Rails

An XSS vulnerability exists in Action Pack versions = 5.2.0 and 5.2.0, which could allow an attacker to bypass the Content Security Policy and generate non-HTML responses...

Astra Linux – Vulnerability in Rails

Action Pack is a framework for handling and responding to web requests. Under certain circumstances, response bodies may not be closed properly. If a response does not notify the system of a close operation, ActionDispatch::Executor will not know to reset the thread local state for the next...

Astra Linux – Vulnerability in Rails

An XSS vulnerability exists in the Action View tag helpers versions 5.2.0 and below, which would allow an attacker to inject content if they can control the input into specific attributes...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: net: sfp: fixed a memory leak in sfpprobe The sfpprobe function allocates a memory chunk from the sfp structure using sfpalloc. When devmaddaction fails, the sfp structure is not freed, resulting in a memory leak. We should use...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: mctp: It now takes ownership of the skb in mctplocaloutput. Currently, mctplocaloutput only takes ownership of the skb on a successful operation. In some cases where mctplocaloutput fails, we might leak the skb. Ownership of...

Astra Linux – Vulnerability in unrar-nonfree

RARLAB WinRAR Recovery Volume: Improper validation of array index leads to remote code execution vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability, as the targe...

Astra Linux – Vulnerability in Zabbix

Reflected XSS attacks occur when a malicious script is reflected from a web application into the victim’s browser. The script can be activated through action form fields, which are sent as requests to a website with vulnerabilities that allow the execution of malicious scripts...

Astra Linux – Vulnerability in Rails

Action View provides conventions and helpers for building web pages using the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string was used as an HTML attribute name in Action View tag helpers, attribute escaping was bypassed, resulting in malformed HTML. A...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: A NULL dereference occurred in meshmatcheslocal. meshmatcheslocal unconditionally dereferes ie-meshconfig to compare mesh configuration parameters. When called from meshrxcsaframe, the parsed action-frame elements...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: A strict check is performed for the maximum number of actions allowed. The maximum number of hardware-offload actions for flowtable in IPv6 is as follows: - Ethernet mangling: 4 payload actions; 2 actions pe...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: actife: Fixed the behavior of metalist updates Whenever an ife action replaces a meta-list element, it does not replace the old data on the meta-list. Instead, the current ife code appends new metadata to the...

Astra Linux – Vulnerability in OpenVSwitch

A flaw was discovered in OpenVSwitch OVS. When processing an IP packet with protocol 0, OVS will install a datapath flow without modifying the IP header. This issue results in the installation of a datapath flow that matches all IP protocols with “nwproto” set to wildcard, but with an incorrect...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: actct: fix skb leak and crash on ooo frags actct adds skb-users before defragmentation. If frags arrive in order, the reference of the last frag is reset in inetfragreasmprepare, which is a straightforward process...