Уязвимость компонента Tracing браузера Google Chrome, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость компонента Tracing браузера Google Chrome связана с использованием памяти после её освобождения. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании с помощью специально созданной HTML-страницы...

The vulnerability in the Graphics component of Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows a hacker to cause a service failure.

The vulnerability of the Graphics component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

PYSEC-2026-247

picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load...

CVE-2025-71357

CVE-2025-71357 affects the Python package picklescan older than 0.0.30. The vulnerability arises from using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods, allowing attackers to embed code in pickle files that can execute remote commands when loaded by a victim. The connected so...

CVE-2025-71351 picklescan - Remote Code Execution via timeit.timeit() Detection Bypass

picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit in the reduce method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands, which evade picklescan detection and execute...

Authentication Bypass

github.com/googleapis/mcp-toolbox is vulnerable to Authentication Bypass. The vulnerability is due to improper validation of OAuth 2.0 token introspection responses, where the mandatory active field is not verified if omitted, which allows an attacker to bypass authentication by supplying an opaq...

kernel: wifi: mac80211: remove station if connection prep fails

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. When Multi-Link Operation MLO connection preparation fails, the system may not correctly remove the associated station. This can lead to a use-after-free or double-free vulnerability in the debugfs component, potentially causing...

CVE-2026-56080 Cap-go - Authentication Logic Flaw in Enforce Password Policy

Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin enables the policy and successfully changes their password to a compliant one, the backend does not update the password-compliance state. As a result, the backend continues to treat the account as...

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

Summary There is a medium severity vulnerability in Traefik's Kubernetes Ingress NGINX provider that causes affected routes to fail open. When an Ingress explicitly enables BasicAuth or DigestAuth through the supported nginx.ingress.kubernetes.io/auth-type and auth-secret annotations, but the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: btrfs: fixed an issue where a double-free operation occurred in the createspaceinfosubgroup function. When the kobjectinitandadd function fails, the call chain is as follows: createspaceinfosubgroup → btrfssysfsaddspaceinfotype →...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/mana: Fixed the cleanup in manaDestroywqobj within manaibcreateqprss. Sashiko pointed out that there are two bugs in the error unwinding process, both related to how the WQ table is unwound. Firstly, there is a double i--...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - riscv: kvm – fix a leak in vector context allocation When the second kzalloc call hostcontext.vector.datap fails in kvmriscvvcpuallocvectorcontext, the first allocation guestcontext.vector.datap is leaked. Release that...

Astra Linux – Vulnerability in Linux

A issue was discovered in the Linux kernel before version 5.8.10. The file virt/kvm/kvmmain.c contains a memory leak in kvmiobusunregisterdev due to a kmalloc failure, identified as CID-f65886606c2d...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Staging: rtl8723bs: osdep: Avoid NULL pointer dereferencing in rtwcbufalloc. The return value of kzallocflex is used without ensuring that the allocation succeeds, and the pointer is dereferenced unconditionally. Protect access t...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: platform/surface: aggregator: Add a missing call to ssamrequestsyncfree Although rare, ssamrequestsyncinit can fail. In that case, the request should be freed using ssamrequestsyncfree. Currently, the request is instead leaked. F...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: Skipping the “reserved bytes” warning after unmounting after a log cleanup failure. After the recent changes made by commit c2e39305299f01 “btrfs: clearing the extent buffer when writing fails” and its follow-up fix,...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921 – fixed a crash that occurred during startup failure. If the network interface card fails to start, it is possible that the “resetwork” task has already been scheduled. Ensure that this task is canceled so that a...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: cifs: A connection leak occurs when the tlink setup fails. If the tlink setup fails and connections are lost, then the refcnt leak occurs due to the cifsd kthread not exiting. Additionally, fscache information is also leaked...

CVE-2026-34192 GPU DDK - _MMU_AllocLevel error recovery paths leave dangling page table entries

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading to UAF of GPU page tables. The vulnerability allows physical memory allocated for MMU page tables to be used after being freed. This was caused by an error path that would not...

dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure

A flaw was found in .NET Framework. This protection mechanism failure allows an unauthorized attacker to execute arbitrary code locally. Successful exploitation of this vulnerability can lead to a complete compromise of the affected system...