Astra Linux – Vulnerability in libstb

stbimage.h also known as the stb image loader, version 2.23, as used in libsixel and other products, has an assertion failure in stbishiftsigned...

Astra Linux – Vulnerability in elfutils

The libcpu component, which is used by libasm of elftools version 0.177 git 47780c9e, suffers from denial-of-service vulnerabilities caused by application crashes due to out-of-bounds write CWE-787, off-by-one errors CWE-193, and reachable assertions CWE-617. To exploit these vulnerabilities,...

Astra Linux – Vulnerability in unbound

Unbound before version 1.9.5 allows assertion failures and denial of service in dnamepktcopy due to an invalid packet. NOTE: The vendor disputes that this is a vulnerability. Although the code may be vulnerable, an ongoing Unbound installation cannot be remotely or locally exploited...

Astra Linux – Vulnerability in Redis

Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server by sending a non-administrative command specifically, a SET command. NOTE: this issue was fixed for Redis 6.2.x and 7.x in 2021. Versions before 6.2 were not intended to have any safety guarantees related to...

Exploit for CVE-2026-95622

CVE-2026-95622: ModemManager CBM Assertion Failure DoS A deni...

bind9.18 security update

32:9.18.29-14.10 - Prevent assertion failure in dns64 mode with break-dnssec yes CVE-2026-19666 - Prevent memory leak on following HTTPS/SVCB RR CVE-2026-81563 - Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs CVE-2026-80274 - Reject oversized negative cached records ear...

CVE-2026-19395: Reachable Assertion

In Qt for MCUs, a Text element that displays styled text halts the device if an tag in the text contains an attribute with an empty value. The text parser passes the empty value to an internal check that only accepts non-empty values. The check fails and reports an error, and the default error...

CVE-2026-105753: Reachable Assertion

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if...

PT-2026-106263

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.28.0 Description A cache-mirroring desynchronization exists in the default multimodal LRU cache when mm processor cache type is set to lru. The system mirrors state between a frontend sender cache...

PT-2026-104568

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Description The high-level OpenPGP certificate API fails to verify if a component key of an issuing certificate has the required authority to certify when processing third-party certifications or...

CVE-2026-104434

ZcashFoundation Zebra software is affected by a reachability assertion in the z_listunifiedreceivers RPC handler. The vulnerability exists in zebra-rpc versions before 8.0.0 and zebrad versions before 4.5.0 . The issue occurs because the expect() function fails during Sapling receiver parsing whe...

EUVD-2026-91444

ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the zlistunifiedreceivers RPC handler, which calls expect on Sapling receiver parsing that fails for Unified Addresses carrying invalid Jubjub points. Authenticated RPC clients can submit such an...

CVE-2026-104434: Reachable Assertion

ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the zlistunifiedreceivers RPC handler, which calls expect on Sapling receiver parsing that fails for Unified Addresses carrying invalid Jubjub points. Authenticated RPC clients can submit such an...

social-auth-core has an Improper Authentication issue

ImpactThe SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest.Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML...

BIT-AUTHENTIK-2026-94612 authentik: Authentication bypass via assertion confusion in SAML sources

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that...

CLEANSTART-2024-LL34532 FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics

Security vulnerability affects the ffmpeg4 package. FFmpeg version git commit de8e6e67e7523e48bb27ac224a0b446df05e1640 suffers from a an assertion failure at src/libavutil/mathematics...

CLEANSTART-2024-OD86351 When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by ...

Security vulnerability affects the dnsdist package. When incoming DNS over HTTPS support is enabled using the nghttp2 provider, and queries are routed to a tcp-only or DNS over TLS backend, an attacker can trigger an assertion failure in DNSdist by sending a request for a zone transfer AXFR or IX...

CLEANSTART-2024-EO56107 Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1

Security vulnerability affects the krb5 package. A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 aka krb5 before 1...

Rocky Linux 10.0 [CIQ] Security Update: mod_http2 / mod_http2-debuginfo / mod_http2-debugsource (crlsa-2025_14625)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202514625 advisory. httpd: modproxyhttp2: untrusted input from a client causes an assertion to fail in the Apache modproxyhttp2 module CVE-2025-49630 Tenable has extracted the...

Rocky Linux 8 [CIQ] Security Update: bind / bind-chroot / bind-debuginfo / bind-debugsource / bind-devel / etc (crlsa-2021_1989)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20211989 advisory. bind: An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself CVE-2021-25215 Tenable has...