Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A denial-of-service issue was detected, possibly due to a recursive locking scenario, which led to a deadlock in the tableclear function in drivers/md/dm-ioctl.c within the Linux Kernel Device Mapper-Multipathing sub-component...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Disabled the unnecessary interrupt to avoid kernel panic. There is a hardware bug where the interrupt STMBUFHALF may be triggered after or when the interrupt is disabled. This may lead to unexpected kernel panic...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: exfat: Check if the cluster number is valid. Syzbot reported a slab-out-of-bounds read in exfatclearbitmap. This issue was triggered when the reproducer called truncute with a size of 0, resulting in the following error messag...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: memstick/msblock: A memory leak has been fixed. The erasedblocksbitmap is never freed. Since it is allocated at the same time as usedblocksbitmap, it is likely that it should also be freed at the same time. Add the correspondi...

PT-2026-91201

A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb clear parser of the file src/Compiler/semantics.c. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be...

PT-2026-91760

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A race condition occurs where a supplicant may remain in an authorized state even after a clear dot1x host all command is issued. A race condition is a situation...

CVE-2026-81907

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/deleteentries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation t...

EUVD-2026-76691

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/deleteentries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation t...

CVE-2026-81009

In the Linux kernel, the following vulnerability has been resolved: iouring/query: cap user size passed to copystructtouser iohandlequeryentry clamps hdr.size for the inbound copyfromuser but keeps the original user value as usize. copystructtouser uses that usize and, when it is larger than the...

PT-2026-90496

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description Cross-Site Request Forgery CSRF occurs in the Express Clear Entries function. The issue exists because the controller records a failed CSRF token check but does not enforce it, allowing...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107311)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107311 advisory. In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix possible access to freed memory in link clear After modifying the QP to the Error...

MariaDB 3.4.0 < 3.4.10

The version of MariaDB installed on the remote host is prior to 3.4.10. It is, therefore, affected by a vulnerability as referenced in the GHSA-fmq9-qjxj-qpf7 advisory. - Impact In the Zero-Configuration SSL protocol, the MariaDB client must refuse sending clear-text password over unverified TLS...

CVE-2026-80113 PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary Bit Clear via DirectIo64.sys IOCTL

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to clear arbitrary bits at any physical memory address due to missing validation of the...

CVE-2026-80113

PassMark PerformanceTest , BurnInTest , and OSForensics are affected by a local privilege escalation vulnerability in the DirectIo64.sys kernel driver. The root cause is a missing validation of the physical address parameter in an exposed IOCTL handler , allowing a local user to supply an arbitra...

CVE-2026-80113 PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary Bit Clear via DirectIo64.sys IOCTL

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to clear arbitrary bits at any physical memory address due to missing validation of the...

CVE-2026-80893

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork copyhugetlbpagerange clears the uffd-wp bit of migration and hwpoison entries with hugepteclearuffdwp, which operates on the present-PTE bit position. Swap entri...

CVE-2026-80893 mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork copyhugetlbpagerange clears the uffd-wp bit of migration and hwpoison entries with hugepteclearuffdwp, which operates on the present-PTE bit position. Swap entri...

Malicious code in clear-turquoise-partridge (npm)

Source: amazon-inspector d70ecd26213b24bb4effe4b5f690dd44f5fdf0728a70ad62804fa23e4e99e3c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in clear-crimson-leech (npm)

Source: amazon-inspector 0f57d5836e71984395d838b1da38fb7d3df74ce16584ef7769b10537ec0000f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in clear-amethyst-kite (npm)

Source: amazon-inspector edb4ce55da3da3afd5d9d868d43e2f72599d0c773087acd1ea171a4873667467 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...