Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Reject out-of-bounds values in sndsocputvolsw Currently, we do not validate whether the values being set fall within the range we have advertised to user space as valid; if they do, we reject any out-of-range values...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumacltcam: Fix stack corruption When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn, each ACL points to a...

Astra Linux – Vulnerability in libde265

There is an incorrect access control vulnerability in libde265 v1.0.8 due to a SEGV in slice.cc...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dyndbg: fix old BUGON in control parser Fix a BUGON from 2009. Even if it looks “unreachable” I really didn’t check, let’s remove it by calling prerr and returning -EINVAL instead...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2-cb in ip6errgenicmpv6unreach The Sashiko AI review observed: In ip6errgenicmpv6unreach, the skb is an outer IPv4 ICMP error packet where its cb contains an IPv4 inetskbparm. When skb is cloned into skb2 and...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCBAIORW before the conversion of struct aiokiocb. The first argument of kiocbset Cancelfn may point to a struct kiocb that is not embedded within struct aiokiocb. With the current code, depending on the compiler,...

Astra Linux - Vulnerability in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix for possible memory corruption The Init Control Block is dereferenced incorrectly. Dereference the ICB correctly...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mtdchar: fix integer overflow in read/write ioctls The “req.start” and “req.len” variables are u64 values provided by the user at the beginning of the function. We mask off the high 32 bits of “req.len” so that it is capped at...

CVE-2026-9703

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API /loki/api/v1/rules, allowing...

CVE-2026-95180

An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in DefaultWebClient...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

DEBIAN-CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-75505 EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the...

CVE-2026-75505 EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the...

CVE-2026-75505

The open-source customer relationship management application EspoCRM contains an access control bypass in its mass-update functionality. Prior to version 10.0.2 , an authenticated user possessing mass-update permissions can provide a known attachment identifier to the processor. The system duplic...

CVE-2026-75505 EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082 Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...

CVE-2026-108082

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split parsed header values with a pattern whose token alternative also matched whitespace, followed by a ?!\s lookbehind. A run of...