Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: um: vector: Fixed a memory leak in vectorconfig. If the return value of the umlparsevectorifspec function is NULL, we should call kfreeparams to prevent the memory leak...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Disabling Intel PT virtualization guest/host mode is enabled by default under CONFIGBROKEN. This means that KVM’s ptmode module parameter is set to BROKEN by default, thereby disabling support for virtualizing Intel PT...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: MIPS: Octeon – Add PCIe link status check The standard PCIe configuration read-write interface is used to access the configuration space of peripheral PCIe devices in the mips processor. After the PCIe link becomes unavailable, i...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm: hugememory: use !CONFIG64BIT to relax huge page alignment on 32-bit machines Yves-Alexis Perez reported a commit 4ef9ad19e176 “mm: hugememory: don’t force huge page alignment on 32-bit machines” which did not work for x8632 1...

Astra Linux – Vulnerability in Git

Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. These untrusted parties could create the folder C:.git, which would be included in Git...

Astra Linux – Vulnerability in Firefox

If an attacker were able to alter specific about:config values for example, malware running on the user’s computer, the Devtools remote debugging feature might be enabled in a way that is unnoticed by the user. This would allow a remote attacker who can establish a direct network connection to th...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nbd: The defer config unlock in nbdgenlconnect has been fixed. There is one use-after-free warning when running NBDCMDCONNECT and NBDCLEARSOCK: nbdgenlconnect: nbdallocandinitconfig // configrefs=1 nbdstartdevice // configrefs...

Astra Linux – Vulnerability in ffmpeg, ffmpeg5

There is a NULL pointer dereference vulnerability in FFmpeg’s Firequalizer filter libavfilter/affirequalizer.c. This vulnerability arises due to a missing check on the return value of avmallocarray in the configinput function. An attacker could exploit this vulnerability by tricking a victim into...

Astra Linux – Vulnerability in SQLite3

In SQLite 3.49.0 before 3.49.1, certain argument values passed to sqlite3dbconfig in the C-language API can cause a denial of service application crash. A sznBig multiplication is not cast to a 64-bit integer, which can lead to incorrect memory allocations...

Astra Linux – Vulnerability in Apache2

“Use After Free” vulnerability in Apache HTTP Server with modldap, in per-directory configuration This issue affects Apache HTTP Server: from version 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes this issue...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: octeontx2-af: Workarounds for stalls caused by disabling sticky operations. It is known that the sticky mode of the NIX SQ manager can cause stalls when multiple SQs share an SMQ and transmit concurrently. Additionally, PSE ma...

CVE-2026-90919 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visualregister WebSocket endpoint that passes the first client frame directly to pickle.loads. Attackers can reach the Config Server port and send a malicious serialized payload with a...

CVE-2026-90919 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visualregister WebSocket endpoint that passes the first client frame directly to pickle.loads. Attackers can reach the Config Server port and send a malicious serialized payload with a...

CVE-2026-90919 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visualregister WebSocket endpoint that passes the first client frame directly to pickle.loads. Attackers can reach the Config Server port and send a malicious serialized payload with a...

CVE-2026-90919

LightLLM through 1.2.0 is vulnerable to unauthenticated remote code execution via the Config Server 's /visual_register WebSocket endpoint. The endpoint passes the first client frame directly to pickle.loads() , allowing an attacker who can reach the Config Server port to send a malicious seriali...

EUVD-2026-77429

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visualregister WebSocket endpoint that passes the first client frame directly to pickle.loads. Attackers can reach the Config Server port and send a malicious serialized payload with a...

CVE-2026-79700 Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 - The optinform addon read the CAPTCHA type, the expected answer and the enabled flag from the request rather than from the stored addon...

CVE-2026-79700

SP Page Builder Pro (Joomla extension by joomshaper.com , versions 5.1.4 – 6.9.0 ) contains an unauthenticated CAPTCHA bypass in the optin_form addon. The addon read the CAPTCHA type, expected answer, and enabled flag from the request rather than from the stored addon configuration. Because both ...

CVE-2026-79700 Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 - The optinform addon read the CAPTCHA type, the expected answer and the enabled flag from the request rather than from the stored addon...

EUVD-2026-77382

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 - The optinform addon read the CAPTCHA type, the expected answer and the enabled flag from the request rather than from the stored addon...