Astra Linux – Vulnerability in Firefox

JIT compilation errors in the JavaScript: WebAssembly component. This vulnerability has been fixed in Firefox 152 and Thunderbird 152...

EUVD-2026-53375

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...

ROS-20260805-73-0007

The vulnerability of the cpumapupdateelem function in Linux kernel is related to memory release errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260805-73-0002

The vulnerability of the f2fsremount function in the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

Skia Graphic Library DoS

The vulnerability of the Skia graphic library used by Google Chrome and Microsoft Edge is related to errors in HTTP requests processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ANGLE Component Confidential Data Access

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors in handling HTTP requests. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data through a specially created HTML page...

Skia Graphic Library DoS

The vulnerability of the Skia graphic library used by Google Chrome and Microsoft Edge is related to errors in HTTP requests processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260805-73-0010

The vulnerability of the Linux operating system’s kernel is related to errors during resource release. Exploiting this vulnerability can allow an attacker to cause service failures...

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Summarypkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported theoutcome of decrypting a RecipientInfo's encryptedKey in severaldistinguishable ways, one of which disclosed the exact length recovered from theRSA operation. The same distinction was also observable by timing. Anapplicatio...

PYSEC-2026-3552 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Summary pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An...

ROS-20260804-73-0010

The vulnerability of the inode.c component in the Linux operating system’s kernel is related to synchronization errors when using shared resources. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures...

ROS-20260804-73-0032

The vulnerability of the padatareorder function in the kernel/padata.c module of the Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

EUVD-2026-52446

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...

CVE-2026-66296

The CVE-2026-66296 issue concerns oaskit: a reflected XSS vulnerability in the default HTML error handler. The root cause is that Oaskit.ErrorHandler.Default.format_reason/4 and Oaskit.ErrorHandler.Default.reason_to_html/1 render request-validation failures as HTML when the Accept header includes...

EUVD-2026-52407

Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

CVE-2026-69092 Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint

Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to...

ROS-20260803-73-0026

The vulnerability of the dsaswitchshutdown function in the net/dsa/dsa2.c module, which supports Linux kernel with distributed architecture switches, is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260803-73-0020

The vulnerability in the fs/dlm/lock.c module of the Linux operating system’s locking manager, which involves pointer dereferencing errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

Google Chrome Downloads Spear Phishing

The vulnerability of the Downloads component in the Google Chrome browser is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spear-phishing attacks...