CVE-2026-17113 Cri-o: cri-o: unvalidated image env var causes daemon crash

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

CVE-2026-17113 Cri-o: cri-o: unvalidated image env var causes daemon crash

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

CVE-2026-16782

CVE-2026-16782 is an Out-of-Bounds Read vulnerability in Autodesk 3ds Max triggered when parsing a maliciously crafted SVG file . A successful exploit can lead to a crash, reading of sensitive data, or arbitrary code execution in the context of the current process. The NVD assigns a CVSS 3.1 scor...

google-poc

Para reproduzir o CVE-2025-13425, basta seguir os passos abaixo: Passo 1: Clone o código fonte fresco do osv-scalibr: root@kitploit: $ git clone https://github.com/google/osv-scalibr Passo 2: Remova o código mencionado no commit de correção...

CVE-2026-56684

A flaw was found in Valkey. An authenticated client can trigger a CLIENT KILL command while the tlsProcessPendingData function iterates a pending list. This action causes connTLSClose to delete the iterator's cached next node, leading to a use-after-free vulnerability. This flaw, when Transport...

CVE-2026-76879

A flaw in Wireshark's C12.22 protocol dissector allows remote attackers to trigger a Denial of Service DoS. By sending a specially crafted network packet or capture file, an attacker can crash the application, disrupting network analysis capabilities. Mitigation Avoid analyzing capture files or...

CVE-2021-26690---Apache-mod_session

Patch diffing per CVE-2021-26690 - Apache modsession Questa vulnerabilità è un dereferenziamento di puntatore nullo all'interno del modulo modsession di Apache. Causerà un denial of service per i processi figli di httpd di Apache. Utilizzando un ciclo ripetitivo, ogni worker di Apache si bloccher...

CVE-2026-74643

A flaw was found in the Linux kernel's DAMONSAMPLEMTIER module. A local user can trigger a division-by-zero error in the damosquotascore function by providing zero values for the node0memusedbp or node0memfreebp parameters when enabling the module. This vulnerability leads to a kernel crash,...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: hfs: fixed the missing hfsbnodeget function in hfsbnodecreate. Syzbot discovered a kernel bug in hfsbnodeput: Kernel bug at fs/hfs/bnode.c:466! Invalid opcode: 0000 1 PREEMPT SMP KASAN CPU: 0 PID: 3634 Comm: kworker/u4:5 Not...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ata: satadwc460ex: Fixed a crash that occurred due to out-of-bounds writing. The driver utilizes the “tag” values from various arrays provided by libata. Since the mentioned patch increased ATATAGINTERNAL to 32, the value of...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: mmc: atmel-mci: fixed the return value check in mmcaddhost The mmcaddhost function may return an error. If we ignore its return value, it will cause two issues: 1. The memory allocated in mmcallochost may be leaked. 2. In the...

Astra Linux – Vulnerability in WebKit2GTK

The issue was addressed through improved checks. This issue is fixed in Safari 18.2, iOS 18.2, iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, and watchOS 11.2. Processing maliciously crafted web content may lead to an unexpected process crash...

Astra Linux – Vulnerability in Dbus

A issue was discovered in D-Bus before 1.12.24, 1.13.x, and 1.14.x, before 1.14.4, and 1.15.x, before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: iio: Magnetometer: rm3100 – added a boundary check for the value read from RM3100REGTMRC. Recently, we encountered a kernel crash in the function rm3100commonprobe, caused by out-of-bound access to the array rm3100samprates due t...

Astra Linux – Vulnerability in WebKit2GTK

This issue has been resolved through improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash...

Astra Linux – Vulnerability in Wireshark

In Wireshark versions 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. This issue was addressed in the epan/dissectors/packet-tcp.c file by changing the handling of the invalid 0xFFFF checksum...

Astra Linux - Vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix a race condition in kprobe initialization causing a NULL pointer dereference There is a critical race condition in kprobe initialization that can lead to a NULL pointer dereference and a kernel crash. 1135630.084782...

Astra Linux – Vulnerability in Firefox

The incorrect use of the '' method could lead to a “user-after-poison” situation and potentially cause a exploitable crash. This vulnerability affects Firefox versions earlier than 85...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - ice: xsk: disabling TXQ interrupts before flushing hardware settings. - iceqpdis attempts to stop a given queue pair that is a target of xsk pool attach/detach. One of the steps involved disabling interrupts on these queues...

Astra Linux – Vulnerability in WebKit2GTK

A flaw was discovered in WebKitGTK and WPE WebKit. This vulnerability allows for an out-of-bounds read and integer underflow, resulting in a UIProcess crash DoS through a crafted payload sent to the GLib remote inspector server...