Astra Linux – Vulnerability in Firefox and Thunderbird

A missing delay in popup notifications could have allowed an attacker to trick a user into granting permissions. This vulnerability affects Firefox 113, Firefox ESR 102.11, and Thunderbird 102.11...

Astra Linux – Vulnerability in curl

An integer overflow vulnerability exists in the tooloperate.c file of curl 7.65.2, which can be exploited by using a large value as the retry delay. NOTE: Many reports indicate that this does not have a direct security impact on the curl user. However, it may in theory cause a denial of service t...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: phy: Fix for accessing an empty array when the phygetinternaldelay function is called, provided that the driver calls phygetinternaldelay without defining delayvalues, and rx-internal-delay-ps or tx-internal-delay-ps is...

Astra Linux – Vulnerability in cups

OpenPrinting CUPS is an open-source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connected to cupsd but sent very slow messages—for example, only one byte per second—could delay cupsd as a whole, rendering it unusable for other clients...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: blk-iocost: Avoid out-of-bounds shifts. UBSAN encounters undefined behavior in blk-iocost, where sometimes iocg-delay is shifted right by a number that is too large, resulting in undefined behavior on some architectures. 186.5565...

Astra Linux – Vulnerability in Firefox and Thunderbird

A missing delay in the timing of the pointer lock mechanism could have allowed a malicious page to trick users into granting permissions. This vulnerability affects Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9...

Astra Linux – Vulnerability in Firefox and Thunderbird

A bug in the calculation of popup notification delays could have allowed an attacker to trick a user into granting permissions. This vulnerability affects Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Wait unconditionally after issuing the ENDXFER command. Currently, for all controller IP/versions except DWC3usb3 = 310a, a 1ms wait is required unconditionally for the completion of ENDXFER when the IOC is not set. Th...

Astra Linux – Vulnerability in Firefox and Thunderbird

It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. This vulnerability affects Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4.1...

Testing race conditions with memory access tracing and stack-based delay injection

Posted by Jann Horn Many security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative effect to appear. This creates challenges for several use cases: Confirming bug candidates that have been discovered manually or through static...

deadair v0.8.0

deadair checks whether enabled SIEM detections still have the telemetry they need. It reports missing or stale data, ingest delays, and schema mismatches. Runs locally · Read-only · No agent · No telemetry upload Read the technical write-up · Featured in Detection Engineering Weekly · Featured in...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: openssh (UTSA-2026-104823)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104823 advisory. sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. Tenable has extracted the preceding description block directly from the Unity Lin...

PT-2026-81979

Finally!!! They've finally issued us CVE-2026-75289. The CVE process is incredibly inefficient; it took over a month to get the official vulnerability number. https://t.co/3BkPNoGmxM...

CVE-2026-4559

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-4559

The Image Photo Gallery Final Tiles Grid plugin for WordPress (all versions up to and including 3.6.12 ) is vulnerable to Stored Cross-Site Scripting via the delay shortcode attribute. The root cause is insufficient input sanitization and output escaping, allowing authenticated attackers with Con...

EUVD-2026-64297

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-4559: Improper Neutralization of Input During Web Page Generation

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

PT-2026-79551

Name of the Vulnerable Software and Affected Versions Image Photo Gallery Final Tiles Grid versions prior to 3.6.13 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is...

OESA-2026-3432 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service resource consumption from excessive authentication attempts because MaxAuthTries was mishandled for GSSAPIAuthentication.CVE-2026-60000 sshd in...

OESA-2026-3428 openssh security update

An open source implementation of SSH protocol version 2 Security Fixes: sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.CVE-2026-59995 scp in OpenSSH before 10.4 may place a file in the...