Astra Linux – Vulnerability in Lasso

There is a denial-of-service vulnerability in the lassonodeinitfrommessagewithformat functionality of Entr’ouvert Lasso 2.5.1. A specially crafted SAML response can lead to memory depletion, resulting in a denial-of-service attack. An attacker can send a malformed SAML response to exploit this...

CVE-2026-65981

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker...

CVE-2026-64426

A flaw was found in the Linux kernel's iouring/nop component. A local user could exploit this by submitting a specially crafted no-operation NOP request. This could lead to a file reference not being properly released, resulting in a memory leak. Over time, this memory leak could impact system...

CVE-2026-56240

Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the planvalid calculation that allows organizations with exhausted or expired usage credit grants to bypass billing gates. Attackers can exploit the divergence between the plugin hot-path planvalid expression and the...

EUVD-2026-43169

Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the planvalid calculation that allows organizations with exhausted or expired usage credit grants to bypass billing gates. Attackers can exploit the divergence between the plugin hot-path planvalid expression and the...

CVE-2026-56240

Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the planvalid calculation that allows organizations with exhausted or expired usage credit grants to bypass billing gates. Attackers can exploit the divergence between the plugin hot-path planvalid expression and the...

PT-2026-57427

Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan valid calculation that allows organizations with exhausted or expired usage credit grants to bypass billing gates. Attackers can exploit the divergence between the plugin hot-path plan valid expression and th...

Linux Distros Unpatched Vulnerability : CVE-2026-42546

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology...

EUVD-2026-41910

OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.3.0 and prior to version 4.11.0, a resource leak exists in OP-TEE’s shared memory cleanup logic because the functio...

CVE-2026-45947

A flaw was found in the Linux kernel's AMD GPU display drm/amdgpu component. This vulnerability involves a memory leak within the amdgpuacpienumeratexcc function. When certain errors occur during the initialization process, the system fails to properly release allocated memory. This oversight can...

Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. Python is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak as part of its deployment. This bulletin identifies the fixes...

CVE-2026-31645

A flaw was found in the Linux kernel's lan966x network driver. This vulnerability, a page pool leak, occurs when certain error paths in the lan966xfdmarxalloc and lan966xfdmainit functions fail to properly destroy allocated page pools. This oversight can lead to a gradual depletion of system memo...

ROS-20260408-73-0015

A vulnerability in the fs component of the Linux operating system kernel is related to file descriptor depletion. Exploitation of the vulnerability allows an attacker to cause a denial of service...

Navidrome 安全漏洞

Navidrome is an open-source web-based music collection server and streaming service developed by Navidrome. It allows users to listen to their music collections from any browser or mobile device. Versions of Navidrome prior to 0.60.0 contained a security vulnerability that occurred when attemptin...

PT-2026-6437

Summary Authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL /share/img/. When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth...

ROS-20260128-73-0013

A vulnerability in the drivers/usb/gadget/function/uaudio.c module of the Linux operating system kernel is related to file descriptor depletion. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

pypdf security vulnerability

pypdf is an open-source, free Python library developed by py-pdf. It allows for splitting, merging, cropping, and converting pages within PDF files. Prior to version 6.6.2, pypdf had a security vulnerability due to an infinite loop, which could lead to resource consumption when processing special...

Allocation of Resources Without Limits or Throttling

Overview github.com/coredns/coredns/core/dnsserver is a package that implements all the interfaces from Caddy, so that CoreDNS can be a servertype plugin. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of resource-limiting...

CVE-2025-66838

In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upload files at an unrestricted rate. An attacker can exploit this behavior to rapidly upload a large volume of files, potentially leading to resource exhaustio...

CVE-2025-66357

CHOCO TEI WATCHER mini IB-MCT001 contains an issue with improper check for unusual or exceptional conditions. When the Video Download feature is in a specific communication state, the product's resources may be consumed abnormally...