Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: Radiotap: Reject Radiotap with unknown bits The Radiotap parser is currently only used with the radiotap namespace not with vendor namespaces. However, if the undefined field 18 is used, the alignment/size of the data is al...

Astra Linux – Vulnerability in WebKit2GTK

This issue was addressed through improved state management. This issue is fixed in Safari 18.6, iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, and watchOS 11.6. Processing maliciously crafted web content may disclose sensitive user information...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved user interface. This issue has been fixed in Safari 18 and macOS Sequoia 15. Visiting a malicious website may result in address bar spoofing...

Astra Linux – Vulnerability in Linux, Linux 5.10

An improper update of the reference count vulnerability in the net/sched component of the Linux kernel allows a local attacker to escalate privileges to root. This issue affects Linux Kernel versions prior to 5.18, as well as version 4.14 and later versions...

Astra Linux – Vulnerability in Linux 5.15

A issue was discovered in ksmbd within the Linux kernel versions 5.15 through 5.18, prior to 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the non-padding case of smb2write...

Astra Linux – Vulnerability in PostgresSQL 11

Improper validation of the “oidvector” type in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out the possibility of attacks where confidential information is included in the disclosed bytes, but such attacks seem unlikely. Versions of PostgreSQL pri...

Nightmare-Windows-0-day-exp

Windows Zero-Day Exploit Collection !Research Use Onlyhtt...

CVE-2026-52878

CVE-2026-52878 affects Klever-Go (versions 1.7.14–1.7.17). A nil RawData sub-message in protobuf Transaction triggers a nil-pointer panic when txVersionChecker.CheckTxVersion dereferences tx.RawData.Version without a nil check, causing a crash in the libp2p pubsub/the node process. The crash prop...

CVE-2026-64637

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account...

CVE-2026-64636

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database...

ROOT-APP-MAVEN-CVE-2026-5598 CVE-2026-5598 in org.bouncycastle:bcprov-jdk18on - Patched by Root

Root has patched CVE-2026-5598 in the org.bouncycastle:bcprov-jdk18on package for Root:Maven. Multiple fixed versions available...

CVE-2026-65574

Unauthenticated PHP Object Injection in Abogado = 1.18 versions...

CLSA-2026-1782435548 TuxCare security update for @angular (15 CVEs)

TuxCare rebuilt 18 @angular packages to address 15 CVEs. Fixed in 5.2.11-tuxcare.8...

CLSA-2026-1781571279 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 18 @angular packages to address 1 CVE. Fixed in 5.2.7-tuxcare.2...

CLSA-2026-1781571275 TuxCare security update for express (2 CVEs)

TuxCare rebuilt express to address 2 CVEs. Fixed in 4.18.1-tuxcare.1...

CLSA-2026-1775521864 TuxCare security update for 18 packages (1 CVE)

TuxCare rebuilt 18 packages to address 1 CVE. Fixed in 1.19.3-tuxcare.1...

CLSA-2026-1775176142 TuxCare security update for @angular (2 CVEs)

TuxCare rebuilt 18 @angular packages to address 2 CVEs. Fixed in 5.2.11-tuxcare.4...

CLSA-2025-1756253007 TuxCare security update for 38 packages (18 CVEs)

TuxCare rebuilt 38 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1...

SUSE CVE-2026-53666

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...

CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...