Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check the bounds when allocating an eventnotificationslot. Valid event IDs range from 0 to KFDSIGNALEVENTLIMIT. The allocateeventnotificationslot function has an option to specify an event ID to allocate; this option ...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-6.1, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Fixed handling of HCIEVIOCAPAREQUEST. If we receive HCIEVIOCAPAREQUEST while HCIOPREADREMOTEEXTFEATURES has not yet been responded to, assume that the remote supports SSP. Otherwise, this event should not be...

CVE-2026-78177

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...

CISA: Logging Reference Architecture

The Cybersecurity and Infrastructure Security Agency CISA developed the Logging Reference Architecture LRA in alignment with Office of Management and Budget Memorandum M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, which w...

CVE-2026-78263: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.2.1 versions...

CVE-2026-78177: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...

The vulnerability of the btrfs_sync_file() function in the include/trace/events/btrfs.h module of the Linux kernel allows a malicious actor to access protected information or cause service failures.

The vulnerability of the btrfssyncfile function in the include/trace/events/btrfs.h module of the Linux kernel stem from improper disabling or release of resources. Exploiting this vulnerability could allow a malicious actor to gain access to protected information or cause service failures...

PT-2026-81056

Name of the Vulnerable Software and Affected Versions Event Tickets versions 5.29.2.1 and earlier Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update Event Tickets to...

CVE-2026-74793

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...

CVE-2026-74793

justhtml versions before 3.11.0 are affected by a cross-site scripting (XSS) vulnerability in the default sanitizer. The root cause is that event handler removal is bypassed in selectedcontent projections : an attacker can inject SVG or MathML elements carrying event handlers, which are then clon...

CVE-2026-74793 justhtml before 3.11.0 XSS via selectedcontent projection

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...

EUVD-2026-64656

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...

CVE-2026-74793 justhtml before 3.11.0 XSS via selectedcontent projection

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...

CVE-2026-74793 justhtml before 3.11.0 XSS via selectedcontent projection

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections. Attackers can inject SVG or MathML elements with event handlers that are cloned and reinserted into output without sanitization, enabling...

chainsaw v2.16.4

Rapidly Search and Hunt through Windows Forensic Artefacts Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows forensic artefacts such as Event Logs and the MFT file. Chainsaw offers a generic and fast method of searching through event logs for...

SUSE CVE-2026-74633

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL eventmod-match when foo has not been loaded. If a later write tries to remove a specific matc...

SUSE CVE-2026-74636

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between updateeventfields and, eventdefinefields The following sequence may leads race between eventdefinefields and updateeventfields: CPU0 loads module A CPU1 loads module B ===============================...

PT-2026-79773

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 3.11.0 Description A cross-site scripting issue exists where the default sanitizer fails to remove event handlers within selectedcontent projections. This allows attackers to inject SVG or MathML elements containing...

AZL-97269 CVE-2026-74683 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - sanitize event type index when fetching event masks The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdevgetmaskcnt and client evmasks array i...

CVE-2026-74633

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL eventmod-match when foo has not been loaded. If a later write tries to remove a specific matc...