Astra Linux – Vulnerability in xmltooling

Shibboleth XMLTooling before version 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allowed SSRF through a specially crafted KeyInfo element. This issue has been fixed, for example, in Shibboleth Service Provider 3.4.1.3 on Windows...

Astra Linux - уязвимость в linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fixed an issue where incomplete state saving occurred in rxerequester. If a send packet is dropped by the IP layer in rxerequester, the call to rxexmitpacket may fail with an error code -EAGAIN. To recover, the state of...

Astra Linux - уязвимость в linux-5.10

In the Linux kernel, the following vulnerability has been resolved: Platform/x86: hp-bioscfg: Fixed out-of-bounds array access issues during ACPI package parsing. The hppopulateelementsfrompackage functions in the hp-bioscfg driver contain vulnerabilities related to out-of-bounds array access...

freerdp: FreeRDP heap-buffer-overflow

A heap based buffer overflow flaw has been discovered in FreeRDP. In affected versions RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow in ndrreaduint8Array...

CVE-2026-46725

The extension passes an attacker-controlled cookie directly to PHP's unserialize without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation...

CVE-2026-46725 Remote Code Execution in extension "Content Element Selector" (ceselector)

The extension passes an attacker-controlled cookie directly to PHP's unserialize without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation...

CVE-2026-46725

The CVE-2026-46725 vulnerability affects the TYPO3 extension Content Element Selector (ceselector). The issue arises when an attacker-controlled cookie is passed directly to PHP unserialize() without safe input handling, enabling PHP Object Injection that can lead to Remote Code Execution on the ...

CVE-2026-46725

The extension passes an attacker-controlled cookie directly to PHP's unserialize without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation...

CVE-2026-46725 Remote Code Execution in extension "Content Element Selector" (ceselector)

The extension passes an attacker-controlled cookie directly to PHP's unserialize without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation...

kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()

In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcureadlocktraceheld in bpfmaplookuppercpuelem bpfmaplookuppercpuelem helper is also available for sleepable bpf program. When BPF JIT is disabled or under 32-bit host, bpfmaplookuppercpuelem will not be inlined. Using...

TYPO3 Extension Content Element Selector 代码问题漏洞

TYPO3 Extension Content Element Selector is an open-source extension for TYPO3 that allows users to select content elements. This extension has a code vulnerability that stems from the extension directly passing cookies controlled by the attacker to the PHP’s unserialize function without proper...

PT-2026-41886

Name of the Vulnerable Software and Affected Versions Qt Qt Framework Unix affected versions not specified Description An Uncontrolled Search Path Element issue in the OpenSSL TLS backend of Qt Network qtbase allows a local attacker to load a rogue CA certificate as a trusted system authority. Th...

Malicious code in @antv/g6-element (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3987 Malicious code in @antv/g6-element (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@antv/f6 (>=0.0.3 <=0.0.19), fhrons-mobile (>=1.1.2-5.2 <=1.2.4-beta.5) +2 more potentially affected by unknown CVE via @antv/f6-element (=0.0.1)

@antv/f6-element NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f6-element and may be impacted: - @antv/f6 =0.0.3, =1.1.2-5.2, =2.0.1, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6ELEMENT-16755017...

@antv/f6 (>=0.0.3 <=0.0.19), fhrons-mobile (>=1.1.2-5.2 <=1.2.4-beta.5) +2 more potentially affected by unknown CVE via @antv/f6-element (=0.0.1)

@antv/f6-element NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f6-element and may be impacted: - @antv/f6 =0.0.3, =1.1.2-5.2, =2.0.1, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6ELEMENT-16754848...

@antv/g6 (>=4.1.0 <=4.1.16), @antv/g6-pc (>=0.0.1 <=0.1.3) +5 more potentially affected by unknown CVE via @antv/g6-element (>=0.0.1 <=0.0.9)

@antv/g6-element NPM version =0.0.1, =4.1.0, =0.0.1, =2.0.0, =2.0.6, =0.0.1, =0.0.1, =0.0.3 - motif-jupyter =0.0.1-beta.5 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVG6ELEMENT-16755033...

@antv/g6 (>=4.1.0 <=4.1.16), @antv/g6-pc (>=0.0.1 <=0.1.3) +5 more potentially affected by unknown CVE via @antv/g6-element (>=0.0.1 <=0.0.9)

@antv/g6-element NPM version =0.0.1, =4.1.0, =0.0.1, =2.0.0, =2.0.6, =0.0.1, =0.0.1, =0.0.3 - motif-jupyter =0.0.1-beta.5 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVG6ELEMENT-16754863...

@antv/f6 (>=0.0.2 <=0.0.19), @antv/f6-element (=0.0.1) +4 more potentially affected by unknown CVE via @antv/f6-core (=0.0.2)

@antv/f6-core NPM version =0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @antv/f6-core and may be impacted: - @antv/f6 =0.0.2, =1.0.0, =1.1.2-5.2, =2.0.1, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: SNYK:JS-ANTVF6CORE-16754479...

CVE-2026-8740

A flaw has been found in Sanluan PublicCMS 5.202506.d. The impacted element is the function execute of the file publiccms-core/src/main/java/com/publiccms/views/directive/tools/TemplateResultDirective.java of the component templateResult API. This manipulation of the argument templateContent caus...