Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: WireGuard: netlink: Access the device through ctx instead of peer. The previous commit fixed a bug that resulted in a NULL peer-device being dereferenced. In terms of performance, it is actually easier and faster to obtain the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - Misc: ocxl: fixed a possible refcount leak in afuioctl. - eventfdctxput needs to be called to update the refcount obtained through eventfdctxfdget when ocxlirqsethandler fails...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: coresight: cti: Fixed a hang that occurred in ctidisablehw and ctienablehw. These functions are called from an atomic context, so they should not use runtime PM, as this can result in a sleep when communicating with the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mac80211: fixed the issue of locking in the ieee80211startap error path. We need to hold the local-mtx to release the channel context; this is even encoded in the lockdepassertheld function. Fix this issue...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Media: si470x: Fixed a use-after-free in si470xintincallback Syzbot reported a use-after-free in si470xintincallback 1. This indicates that urb-context, which contains the struct si470xdevice object, is freed when...

Astra Linux – Vulnerability in Golang-1.19

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution...

Astra Linux – Vulnerability in imagemagick

A NULL pointer dereference flaw was discovered in ImageMagick in versions prior to 7.0.10-31, in the ReadSVGImage function in coders/svg.c. This issue arises from not checking the return value from libxml2’s xmlCreatePushParserCtxt function and directly using that value, resulting in a crash and...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: rcv: process: Fixed kernel gp leakage childregs represents the registers that are active for the new thread in the user context. For a kernel thread, childregs-gp is never used, as the kernel’s gp value is not touched by the...

CVE-2026-79701 Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0 - In the ajaxcontact, optinform and formbuilder addons, the result returned by the CAPTCHA plugin's...

EUVD-2026-77426

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 6.9.0 - In the ajaxcontact, optinform and formbuilder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was...

CVE-2026-85196

Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla 20.0.0, Users Anywhere extension for Joomla 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is use...

EUVD-2026-77214

Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla 20.0.0, Users Anywhere extension for Joomla 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is use...

PT-2026-91105

Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla 20.0.0, Users Anywhere extension for Joomla 2.1.0 - Articles Anywhere Pro and Users Anywhere Pro return values from request-input data tags without making them safe for the context in which the tag is use...

Linux Kernel eMPIA USB Device Driver Race Condition Code Execution Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of em28xxv4l2 structures. The issue results from the lack of prope...

PT-2026-91457

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description An authenticated attacker can access the MCP server context of another user. This issue occurs due to improper cache key isolation within the MCP Tools component. Recommendations Updat...

PT-2026-91743

Name of the Vulnerable Software and Affected Versions Activiti versions prior to 7.1.0.M7 Description Failure to validate hash-brace deferred expressions in process variables allows attackers to bypass expression filtering. By injecting expressions starting with , an attacker can store these...

PT-2026-91161

Name of the Vulnerable Software and Affected Versions Bifrost HTTP transport versions prior to 2.1.0 Description Bifrost allows the registration of MCP clients through its management API, where a stdio client consists of a command and arguments. The software starts the program in the gateway...

Linux Kernel NTFS3 Journal Heap-based Buffer Overflow Code Execution Vulnerability

This vulnerability allows local attackers to execute arbitrary code on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of...

PT-2026-91166

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 6.9.0 - In the ajax contact, optin form and form builder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was...

Linux Kernel Crypto Subsystem Use-After-Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...