Astra Linux – Vulnerability in binutils

It has been discovered that GNU Binutils prior to version 2.40 contains a vulnerability involving excessive memory consumption, caused by the loadseparatedebugfiles function in dwarf2.c. An attacker could provide a crafted ELF file and trigger a DNS attack...

Astra Linux – Vulnerability in unbound

A vulnerability in caching resolvers called “Rebirthday Attack” has been discovered in resolvers that support EDNS Client Subnet ECS. Unbound is also vulnerable when compiled with ECS support, i.e., with the option --enable-subnet, and when configured to send ECS information along with queries to...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba’s DNS server. A authenticated user could exploit this flaw to cause damage to the RPC server. This RPC server, which also supports protocols other than dnsserver, will be restarted after a short delay. However, it is easy for an authenticated, non-administrative...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Keys: Fixed the issue of linking a duplicate key to a keyring’s assocarray. When making a DNS query within the kernel using dnsquery, the request code can, in rare cases, create a duplicate index key in the assocarray of the...

MAL-2026-14390 Malicious code in amundi-compare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bc0f77ca83947d2af9978911d3a4da11af6a6a4773268f662291180c27b6f38 [email protected] is published at an inflated version number consistent with dependency-confusion targeting of an internal package name. The...

MAL-2026-14391 Malicious code in fund-calculator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52c5f9f0536151a173aa211b9b5f2972e68aee3043132adccdb3695947b16672 Package declares a preinstall script node index.js that fires unconditionally on npm install. index.js reads installer-side identifiers via...

[SECURITY] [DLA 4751-1] designate security update

Debian LTS Advisory DLA-4751-1 [email protected] https://www.debian.org/lts/security/ Carlos Henrique Lima Melara August 23, 2026 https://wiki.debian.org/LTS Package : designate Version : 1:15.0.2-0+deb11u1 CVE ID : CVE-2026-71193 CVE-2026-71194 Debian Bug : 1144145 Two security...

FreeBSD : jackson-databind -- multiple vulnerabilities (0cb401f9-9f19-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0cb401f9-9f19-11f1-a655-3497f65b111b advisory. The Jackson project reports: PolymorphicTypeValidator needs to validate generic type parameter...

PT-2026-81010

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std. deserialize calls...

The vulnerability of the Unbound DNS server, related to deficiencies in the data source verification mechanism, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Unbound DNS server is related to deficiencies in the mechanism for verifying data sources. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Server-side Request Forgery (SSRF)

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the validatenetworkurl DNS resolution path in nltk/pathsec.py. An attacker can make urlopen reach restrict...

Duplicate Advisory: NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5wp5-5229-5g6q. This link is maintained to preserve external references. Original Description NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader...

GHSA-GF32-CMJH-8M9V Duplicate Advisory: NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5wp5-5229-5g6q. This link is maintained to preserve external references. Original Description NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader...

CVE-2026-63311

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

CVE-2026-63310

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...

PYSEC-2026-3729

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...

CVE-2026-63311

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

UBUNTU-CVE-2026-63311

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

CVE-2026-63310

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...

UBUNTU-CVE-2026-63310

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...