Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Tracing: A memory leak was fixed in testgensynthcmd and testemptysynthevent. In testgensynthcmd, the buffer is freed only in the “fail” path. Therefore, the buffer may be leaked when there is no failure. Adding kfreebuf preven...

Astra Linux – Vulnerability in Golang 1.19, Golang 1.23

Creating a malicious file using cmd/go can result in writing to a file controlled by an attacker, with partial control over the file’s content. The cgo pkg-config: directive in a Go source file provides command-line arguments that are passed to the Go pkg-config command. An attacker can provide a...

Astra Linux – Vulnerability in Qemu

An information disclosure vulnerability was discovered in the virtio vhost-user GPU device vhost-user-gpu of QEMU in versions up to and including 6.0. The flaw resides in the virglcmdgetcapsetinfo function in contrib/vhost-user-gpu/virgl.c, and can occur due to the reading of uninitialized memory...

Astra Linux – Vulnerability in Linux, Linux 5.10

A memory leak flaw was discovered in the Linux kernel’s ccprunaesgcmcmd function, which allows an attacker to cause a denial of service. This vulnerability is similar to the older CVE-2019-18808. The greatest threat posed by this vulnerability is to system availability...

CVE-2026-47701: Exposure of Sensitive Information to an Unauthorized Actor

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as...

PT-2026-90202

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the IPMI message handler. The ipmi destroy user function can free a cmd rcvr while a reader still holds a pointer to it because the synchronize rcu barri...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the authentication process when the --auth-proxy option is enabled without also setting --auth-key. An attacker can gain unauthorized access by supplying any access key ID and signing...

CVE-2026-88017

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

CVE-2026-88045: Memory Allocation with Excessive Size Value

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

CVE-2026-88017: Exposure of Data Element to Wrong Session

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

CVE-2026-88017: Exposure of Data Element to Wrong Session

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

Linux Distros Unpatched Vulnerability : CVE-2026-80811

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept...

CVE-2026-80811

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept across recycling through ctx-cmdcache. On two paths nothing frees it a...

CVE-2026-80811 io_uring/cmd: fix iovec leak when the async cmd is not recycled

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept across recycling through ctx-cmdcache. On two paths nothing frees it a...

CVE-2026-80811

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept across recycling through ctx-cmdcache. On two paths nothing frees it a...

CVE-2026-80811 io_uring/cmd: fix iovec leak when the async cmd is not recycled

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept across recycling through ctx-cmdcache. On two paths nothing frees it a...

CVE-2026-80811

CVE-2026-80811 is a memory leak in the Linux kernel's io_uring/cmd subsystem. An io_async_cmd carries an iovec array that is allocated when the vector must grow and retained across recycling via ctx->cmd_cache. On two code paths, the iovec is never freed: io_req_uring_cleanup() only clears the...

CVE-2026-85674 aider 0.86.2 Remote Code Execution via .aider.conf.yml

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

CVE-2026-85674 aider 0.86.2 Remote Code Execution via .aider.conf.yml

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

EUVD-2026-71130

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...