Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix integer underflow in chain mode The jumbofrm function’s chain-mode implementation calculates len = nopagedlen - bmax without conditions. Here, nopagedlen = skbheadlenskb only linear bytes, and bmax is either...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in removewaiter. removewaiter is used by the slowlock paths, but it is also used for proxy-lock rollback in rtmutexstartproxylock when invoked from futexrequeue. In the latter case,...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

A use-after-free flaw was discovered in the Linux kernel’s Netfilter functionality when adding a rule with NFTARULECHAINID. This flaw allows a local user to crash or escalate their privileges on the system...

Astra Linux – Vulnerability in Golang 1.19, Golang 1.23

During the chain building process, the amount of work performed is not properly limited when a large number of intermediate certificates are passed in as VerifyOptions intermediates. This can lead to a denial of service. This issue affects both direct users of crypto/x509 and users of crypto/tls...

Astra Linux – Vulnerability in OpenSSL

A security vulnerability has been identified in all supported versions of OpenSSL, related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use o...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

A issue was discovered in net/netfilter/nftablesapi.c within the Linux kernel prior to version 5.19.6. A denial of service can occur when binding to an already bound chain...

Astra Linux – Vulnerability in Twisted

Twisted is an event-based framework for internet applications, compatible with Python 3.6+. Before version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the twisted.web.http module, parsed several HTTP request constructs more leniently than allowed by RFC 7230. This non-conformant parsin...

Exploit for Code Injection in Craftcms Craft_Cms

CVE-2025-32432 — Craft CMS getRequest-getBodyParam'handle'...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

Malicious code in faiss-cpu-avx512 (PyPI)

[email protected] through 1.9.7 on PyPI impersonates faiss-cpu and ships no FAISS code: faisscpuavx512/init.py fetchnative downloads an xz-compressed binary from https://files.catbox.moe/ ffoa50.xz in 1.9.0 to 1.9.3, 0oreqo.xz in 1.9.4, vwfr94.xz in 1.9.5, 3l3x0v.xz in 1.9.6, weu5u2.xz in...

Malicious code in pino-ulid (npm)

The npm package pino-ulid is named like a ULID generator, but it is a remote-access trojan. On install, its package.json postinstall script runs node dist/node/utils.js after checking the dist files exist with existsSync. dist/node/utils.js writes a PID lock file, sets up persistence on Windows...

PT-2026-91835

The backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowed classes restriction. Any code path that could write to a widget. session key with attacker-controlled bytes could trigger PHP object injection the next time the...

MAL-2026-16203 Malicious code in faiss-cpu-avx512 (PyPI)

[email protected] through 1.9.7 on PyPI impersonates faiss-cpu and ships no FAISS code: faisscpuavx512/init.py fetchnative downloads an xz-compressed binary from https://files.catbox.moe/ ffoa50.xz in 1.9.0 to 1.9.3, 0oreqo.xz in 1.9.4, vwfr94.xz in 1.9.5, 3l3x0v.xz in 1.9.6, weu5u2.xz in...

SAP Supply Chain Management Unvalidated Data Input DoS

The vulnerability of SAP Supply Chain Management’s supply management software is related to unverified data inputs used as conditions for executing loops. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Malicious code in ipmacjs (npm)

Source: checkmarx ab84a2353b9369f7696a6a8689cc3a152925fb4b13bcc3eff073e721b55aadff Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering tactics --- Credit: OpenSSF source...

JGD

⚡ JGD JavaGadgetDigger — Solving the Last Mile of Deseria...

Exploit for CVE-2026-65615

JFrog Artifactory Pre-authenticated RCE Full Attack Chain CVE...

azurelinux v3.0.20260909-3.0

Azure Linux 4 An open-source Linux distribution built and optimized forAzure, with sources derived from Fedora Linux. Azure Linux provides a secured, reliable operating system for virtual machines, containers, and bare-metal platforms. Azure Linux is built on a robust open-source foundation from...