Astra Linux – Vulnerability in Consul

HashiCorp Consul and Consul Enterprise 1.10.1: The TXN.Apply endpoint allows for the registration of proxies for other services, enabling access to service traffic. This feature was fixed in versions 1.8.15, 1.9.9, and 1.10.2...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: Fix endpoint check The syzbot fuzzer detected a problem with the udlfb driver, caused by an endpoint that does not have the expected type. usb 1-1: Failed to read the EDID byte 0; result: -71. usb 1-1: Unable to...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Check endpoint numbers during parsing of Scarlett2 mixer interfaces The Scarlett2 mixer has a quirky behavior in the USB-audio driver; it may encounter a NULL dereference when a malformed USB descriptor is passed...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: usb: pegasus: enable basic endpoint checking The pegasusprobe function fills URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usbrcvbulkpipedev, 1 for RX data - usbsndbulkpipedev, 2 for TX...

Astra Linux – Vulnerability in Sogo

SOGo versions 5.12.7 and earlier contain a SQL injection vulnerability in the Access Control List management functionality. This vulnerability allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: usbnet: gl620a: fixed the endpoint checking in genelinkbind Syzbot reports a warning in usbsubmiturb triggered by inconsistencies between expected and actual endpoints in the gl620a driver. Since genelinkbind does not properly...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Prevention of use-after-free in erdmaacceptnewconn After the erdmacepputnewcep function is called, newcep will be freed. The subsequent dereferencing of newcep may lead to a Use-After-Free UAF issue. This issue has be...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fixed a flaw in existing endpoint checks Syzbot once again identified a flaw in USB endpoint checking. See 1. This time, the issue stems from a commit authored by me 2eabb655a968, “usb: atm: cxacru: fix endpoint...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: SCTP: Use callrcu to free endpoints This patch delays the endpoint freeing process by calling callrcu, in order to address another use-after-free issue in sctpsockdump: BUG: KASAN: Use-after-free in lockacquire+0x36d9/0x4c20...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Input: aiptek – properly checking the endpoint type Syzbot reported a warning in usbsubmiturb, which is caused by an incorrect endpoint type. There was a check for the number of endpoints, but not for the type of endpoints. The...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: usb: cdns3: fixed memory usage after freeing variables at cdns3gadgetepdisable … cdns3gadgetepfreerequest&privep-endpoint, &privreq-request; listdelinit&privreq-list; ‘privreq’ is actually freed after cdns3gadgetepfreerequest...

Astra Linux – Vulnerability in liblouis

A buffer overflow vulnerability has been discovered in Liblouis v.3.24.0. This vulnerability allows a remote attacker to cause a denial of service through the loulogFile function at the logginc.c endpoint...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: gadgetfs: epio – wait until IRQ finishes. After usbepqueue, if waitforcompletioninterruptible is interrupted, we need to wait until IRQ is completed. Otherwise, complete from epiocomplete can corrupt the stack...

Astra Linux – Vulnerability in Zabbix

The endpoint /zabbix.php?action=export.valuemaps is vulnerable to a Cross-Site Scripting attack due to the backurl parameter. This vulnerability arises from the reflection of user-provided data without proper HTML escaping or output encoding. As a result, a JavaScript payload may be injected into...

CVE-2026-90919

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visualregister WebSocket endpoint that passes the first client frame directly to pickle.loads. Attackers can reach the Config Server port and send a malicious serialized payload with a...

EUVD-2026-77435

Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email address. When the value entered belongs to a registered customer, the service returns the associated information email address...

CVE-2026-12258 Inadequate access control in the Hiperdino REST API

Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email address. When the value entered belongs to a registered customer, the service returns the associated information email address...

CVE-2026-12258 Inadequate access control in the Hiperdino REST API

Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email address. When the value entered belongs to a registered customer, the service returns the associated information email address...

CVE-2026-12258

CVE-2026-12258 is an information disclosure vulnerability in Hiperdino's REST v1.0 API . The public endpoint customer/check requires only a static bearer token for authentication, with no per-user credentials, rate limiting, or generic error handling. An attacker holding this token can submit tel...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: max9286: Fixed a memory leak in max9286v4l2register There is a memory leak when testing the media/i2c/max9286.c file using the bpf mock tool. kmemleak: 5 new suspected memory leaks see /sys/kernel/debug/kmemleak...