Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: UDP: Fixed the wildcard binding conflict check when using hash2. When binding an udpsock to a local address and port, UDP uses two hashes udptable-hash and udptable-hash2 for collision detection. The current code switches to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: vsock: Keep the binding until the socket is destroyed. The bindings of sockets are preserved; this includes both those created through an explicit bind call and those implicitly bound during the connect operation. This fix...

Astra Linux – Vulnerability in ujson

UltraJSON is a fast JSON encoder and decoder written in pure C, with bindings for Python 3.7+. Before version 5.12.1, when the ujsondump function wrote to a file-like object, and the write operation raised an exception, the serialized JSON string object was not decremented, resulting in memory...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow actct to bind to clsact/ingress qdiscs and shared blocks. As Paolo mentioned earlier 1: “Since the problematic commit below, classify can return TCACTCONSUMED while holding the current skb that is managed by...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

A issue was discovered in net/netfilter/nftablesapi.c within the Linux kernel prior to version 5.19.6. A denial of service can occur when binding to an already bound chain...

The vulnerability of the API that binds repositories to teams in the Git repository management system Gitea allows a hacker to increase their privileges.

The vulnerability of the API that binds repositories to Git repository management systems like Gitea is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain increased privileges remotely...

CVE-2026-38924

In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a...

CVE-2025-68624

N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server...

CVE-2026-38924

CVE-2026-38924 affects Oraios AI Serena prior to 1.0.0 , where the MCP server in HTTP mode binds its listen address to 0.0.0.0 (all interfaces) rather than 127.0.0.1. The supplier acknowledged this as a "potential security hazard," though documentation at the time recommended running Serena in a ...

EUVD-2026-77175

In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a...

PT-2026-91437

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i...

CVE-2026-18065: Authentication Bypass by Spoofing

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

Linux Distros Unpatched Vulnerability : CVE-2026-80972

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: aloop: Check card index validity at probe aloop driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It's ...

Linux Distros Unpatched Vulnerability : CVE-2026-80964

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: virmidi: Check card index validity at probe virmidi driver blindly trusts that the given devptr-id value is within the proper card index range at probe...

Linux Distros Unpatched Vulnerability : CVE-2026-80965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: serial-u16550: Check card index validity at probe serial-u16550 driver blindly trusts that the given devptr-id value is within the proper card index range...

openSUSE 16 Security Update : python-jwcrypto (openSUSE-SU-2026:21827-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21827-1 advisory. - CVE-2026-80179: denial of service via malformed JWE tokens bsc1277639. - CVE-2026-84185: general JSON JWS kid binding bypass during JWKSet...

Linux Distros Unpatched Vulnerability : CVE-2026-80969

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: mpu401: Check card index validity at probe mpu401 driver blindly trusts that the given devptr-id value is within the proper card index range at probe. It'...

CVE-2026-80964

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture virmidi driver. This vulnerability allows a local user to trigger an out-of-bounds access by manually binding a device via the sysfs interface with an invalid card index. This can lead to system instability or potential...