Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-tdes - fix DMA sync direction Before DMA output is consumed by the CPU, -dmaaddrout must be synced with dmasyncsingleforcpu instead of dmasyncsinglefordevice. Using the wrong direction can return stale cache data on...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Octeontx2-af: Add proper checks for fwdata The firmware populates the MAC address, link modes supported, advertised, and EEPROM data within a shared firmware structure; kernel access is performed via the MAC block CGX/RPM...

Astra Linux – vulnerability in linux-6.1, linux-6.12, amd64-microcode

A transient execution vulnerability in certain AMD processors may allow an attacker to infer data from previous stores, potentially leading to the leakage of privileged information...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Fix handling of host-controlled ‘quote’ buffer length Validate the host-controlled value quotebuf-outlen, which determines how many bytes of the quote are copied to guest userspace. In TDX environments with remot...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bonding: 3ad: Implement proper RCU rules for port-aggregator SyZBot identified a data race in bond3adgetactiveagginfo / bond3adstatemachinehandler 1, which suggests a lack of proper RCU implementation. Add rcu qualifiers to...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ext4: convert inline data to extents when truncate exceeds inline size A check has been added to ext4setattr to convert files from inline data storage to extent-based storage when truncate increases the file size beyond the inlin...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ipmi: Check event message buffer response for bad data The size of the event message buffer response data was checked later during processing; however, it should be checked immediately after the response is received. It appears...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlinkdata Since smb2checkmessage returns success without length validation for the symlink error response, in symlinkdata it is possible for iov-iovlen to be smaller than sizeofstruct...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Audit: fix incorrect inheritable capability in CAPSET records auditlogcapset records the effective capability set into the inheritable field due to a copy-paste error. Consequently, every CAPSET audit record reports cappi process...

Astra Linux – vulnerability in hplip

A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This vulnerability may allow privilege escalation and/or arbitrary code execution due to an integer overflow in the hpcups processing path when handling specially crafted print data...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on isopi fields in hcigetroute calls isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync call hcigetroute using isopisk-dst, isopisk-src, and isopisk-srctype without holding locksock. Thes...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Do not attempt to copy the CSR to userspace if the PSP command failed When retrieving the PEK CSR, do not attempt to copy the blob to userspace if the firmware command failed. If the failure was due to an invalid...

CVE-2026-111881

A flaw was found in FreeRDP. An integer underflow vulnerability exists in its bitmap image processing component due to an incorrect calculation when handling sub-byte images. A remote attacker acting as a malicious peer in a Remote Desktop Protocol RDP session can exploit this by supplying a...

WordPress FormFlow for GoHighLevel (GHL) plugin <= 1.0.0 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Ehab M.Kandah in WordPress Plugin FormFlow for GoHighLevel GHL versions = 1.0.0...

CVE-2026-89286 FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File

The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...

CVE-2026-89286

The FormFlow for GoHighLevel (GHL) WordPress plugin (versions through 1.0.0 ) is vulnerable to unauthenticated sensitive data disclosure. The application fails to restrict access to a log file stored within a publicly accessible uploads directory . An attacker can read this file to obtain connect...

CVE-2026-89286 FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File

The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...

Important: Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls

A flaw was found in OpenSSL. When applications directly call the low-level CRYPTOocb128encrypt or CRYPTOocb128decrypt functions with non-block-aligned lengths in a single call on hardware-accelerated builds, the trailing 1-15 bytes of a message may be exposed in cleartext. These exposed bytes are...

openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls

A flaw was found in OpenSSL. When applications directly call the low-level CRYPTOocb128encrypt or CRYPTOocb128decrypt functions with non-block-aligned lengths in a single call on hardware-accelerated builds, the trailing 1-15 bytes of a message may be exposed in cleartext. These exposed bytes are...