CVE-2026-78336

An insertion of sensitive information into sent data vulnerability exists in Apache Syncope . Any authenticated user can query the list of OIDC providers configured for SSO with Console and Enduser, resulting in a payload that discloses all configuration settings, including client secrets , regar...

CVE-2026-78336 Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user

Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless ...

WordPress PublishPress Authors plugin <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin PublishPress Authors versions = 4.15.0...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 has an improper neutralization of line delimiters. An authenticated remote SMTP client can insert newline characters into a spool file which indirectly leads to remote code execution as root via the AUTH= parameter in the MAIL FROM command...

Astra Linux – Vulnerability in Intel Microcode

Insufficient control flow management in some IntelR processors may allow an authenticated user to potentially enable a denial of service via local access...

Astra Linux – Vulnerability in HAPProxy

A vulnerability related to uncontrolled resource consumption was discovered in HAProxy, which could cause the service to crash. This issue could allow an authenticated remote attacker to run a specially crafted malicious server within an OpenShift cluster. The most significant impact is related t...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba. An incomplete access check on dnsHostName allows authenticated, but otherwise unprivileged users to delete this attribute from any object in the directory...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in the QEMU’s built-in VNC server during the processing of ClientCutText messages. The qemuclipboardrequest function can be accessed before vncservercuttextcaps is called, which gives a malicious authenticated VNC client the opportunity to initialize the clipboard peer. This...

Astra Linux – Vulnerability in Intel Microcode

Access to certain resources under complex microarchitectural conditions in the memory subsystem of some Intel AtomR processors may allow authenticated users to potentially disclose information or cause a denial of service through network access...

Astra Linux – Vulnerability in Intel Microcode

Improper initialization of shared resources in some IntelR processors may allow an authenticated user to potentially enable information disclosure via local access...

Astra Linux – Vulnerability in the 389-DS-base

When using a syncrepl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, resulting in a crash...

Astra Linux – Vulnerability in PostgresSQL 11

A flaw was discovered in PostgreSQL that allows authenticated database users to execute arbitrary code through insufficient overflow checks during SQL array value modifications. This issue arises due to an integer overflow during array modifications, where a remote user can trigger the overflow b...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk.Authenticated users can use string matching commands such as SCAN or KEYS with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% of CPU resources. This issue has been fixed in...

Astra Linux – Vulnerability in PostgresSQL 11

A flaw was discovered in PostgreSQL. A specially crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can carry out this attack at will. The attack does not require the ability to create objects. If the server settings include...

Astra Linux – Vulnerability in Linux 5.10

Improper restriction of operations within the bounds of a memory buffer in some IntelR i915 Graphics drivers for Linux before the kernel version 6.2.10 may allow an authenticated user to potentially enable privilege escalation via local access...

Astra Linux – Vulnerability in Dbus

A issue was discovered in D-Bus before 1.12.24, 1.13.x, and 1.14.x, before 1.14.4, and 1.15.x, before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where the array length is inconsistent with the size of the element...

Astra Linux – Vulnerability in Sogo

There is a cross-site scripting XSS vulnerability in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation file allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue arises because the SVG content embedded in the description field of a...

Astra Linux – Vulnerability in the 389-DS-base

The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying userPassword using malformed input...

Astra Linux – Vulnerability in Intel Microcode

Improper isolation of shared resources in some IntelR processors may allow an authenticated user to potentially enable information disclosure via local access...

Astra Linux – Vulnerability in Intel Microcode

The improper removal of sensitive information before storage or transfer in some IntelR processors may allow an authenticated user to potentially enable information disclosure via local access...