CVE-2026-55236 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...

EUVD-2026-77583

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...

Directory Traversal

Overview org.apache.storm:storm-server is a distributed realtime computation system. Affected versions of this package are vulnerable to Directory Traversal via the topology.blobstore.map process. An attacker can cause arbitrary files or directories to be deleted and symlinks to be created outsid...

CVE-2026-82427

Description A topology's topology.blobstore.map lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both AsyncLocalizer and Container.createBlobstoreLinks, and the...

CVE-2026-82427

Apache Storm is vulnerable to a path traversal flaw in the Nimbus component. A submitter can provide a topology.blobstore.map containing unsanitized names with ../ segments. Because AsyncLocalizer and Container.createBlobstoreLinks fail to normalize these paths, a submitter can trigger the symlin...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fixed a reference leak in the GID entry when the createah operation fails. If the AH create request fails, the sgidattr should be released to avoid a reference leak during the release of the GID table...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/rxe: Fixed a NULLptrderef in rxeqpdocleanup, when socket creation fails. There is a NULLptrderef in the mount.cifs operation over RDMA: - BUG: KASAN: NULLptrderef in rxeqpdocleanup+0x2f3/0x360 rdmarxe - Reading of a 8-byt...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove the class from the active list before deleting it in etsqdiscchange. The vulnerability is a race condition between etsqdiscdequeue and etsqdiscchange. This causes a Use-After-Freeze UAF error on the...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ALSA: ymfpci: Created a card with the device-managed snddevmcardnew function. The sndcardymfpciremove function was removed in commit c6e6bb5eab74 “ALSA: ymfpci: Allocating resources using device-managed APIs”, but the call to...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tpm: tpmvtpmproxy: fixed a race condition in the creation of /dev/vtpmx. The /dev/vtpmx becomes visible before ‘workqueue’ is initialized, which can lead to memory corruption in the worst-case scenario. This issue is addressed by...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: arm64: mm: fixed the sanity check for VA-range Both createmappingnoalloc and updatemappingprot perform sanity checks on their ‘virt’ parameter. However, the check itself doesn’t make much sense. The condition used today seems ...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Network layer: Do not leave a dangling “sk” pointer when socket creation fails. It is possible to trigger a use-after-free by: - Attaching a “fentry” probe to sockrelease and the probe that calls bpfgetsocketcookie; - Running...

Astra Linux – Vulnerability in cups

CUPS is a standards-based, open-source printing system, and libppd can be used for supporting legacy PPD files. The ppdCreatePPDFromIPP2 function in libppd does not sanitize IPP attributes when creating the PPD buffer. When used in conjunction with other functions such as cfGetPrinterAttributes5,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: Fixed the issue where corrupted pointer deletion occurred in cases of region creation failures. In cases where region creation fails in ipcdevlinkcreateregion, the previously created regions are deleted using a...

Astra Linux – Vulnerability in symfony

Symfony/http-foundation is a module for the Symphony PHP framework that defines an object-oriented layer for handling HTTP requests. The Request class does not parse URIs containing special characters in the same way that browsers do. As a result, attackers can trick validators that rely on the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: f2fs: fixed the f2fsbugon when uninstalling the filesystem, specifically the call to f2fsevict inode. Creating large files during the checkpoint disabling period results in insufficient free segments. When writing back the root...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: brd: Automatic disk creation is deferred until module initialization succeeds. My colleague Wupeng identified the following issues during fault injection: BUG: Unable to handle page faults for address: fffffbfff809d073 PGD:...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/mlx5: The port select structure is cleared when attempting to create it. The port select structure is cleared in case of an error, so no stale values remain after the definers are destroyed. This is because the...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Destroying vGIC structures during failed vCPU creation If the function kvmarchvcpucreate fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl, but leave the vGIC vCPU structures...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm: Fixed a potential null-ptr-deref due to drmmmodeconfiginit. drmmmodeconfiginit will call drmmodecreatestandardproperties, and it does not check the return value. When drmmodecreatestandardproperties fails due to allocatio...