Astra Linux – Vulnerability in gnutls28

A flaw was discovered in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier URI or Service SRV Subject Alternative Names SANs. This could cause the certificate validation process to incorrectly fall ba...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains a heap-buffer-overflow vulnerability through the use of putqpel00fallback16 in the fallback-motion.cc file. This vulnerability allows attackers to cause a Denial of Service DoS attack by using a specially crafted video file...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed a data race around sysctltcpecnfallback. When reading sysctltcpecnfallback, it can be changed concurrently. Therefore, we need to add READONCE to its reader function...

Astra Linux – Vulnerability in libde265

Libde265 v1.0.4 contains a stack buffer overflow in the putqpelfallback function, which can be exploited through a specially crafted file...

CVE-2026-90707

Open5GS up to 2.7.x is affected by a use after free vulnerability in the Old AMF Discovery Fallback component, specifically in the function amf_nnrf_try_old_amf_discovery_fallback (file src/amf/nnrf-handler.c). Manipulation of the discovery_option argument triggers the flaw. The attack is remote ...

CVE-2026-87910

A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...

CVE-2026-90707: Use After Free

A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amfnnrftryoldamfdiscoveryfallback of the file src/amf/nnrf-handler.c of the component Old AMF Discovery Fallback. The manipulation of the argument discoveryoption results in use after free. The attack may be...

PT-2026-91265

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magic links.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

PT-2026-91396

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOME USERNAME and $ESPHOME PASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and...

Linux Distros Unpatched Vulnerability : CVE-2026-80945

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics error, decompress retries through the software fallback, which writes...

Linux Distros Unpatched Vulnerability : CVE-2026-89483

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme: zero the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload however many ranges...

CVE-2026-80945

A flaw was found in the Linux kernel's cryptography module, specifically within the Intel Analytics Accelerator IAA driver. When a hardware error occurs during data decompression, the system attempts to use a software-based fallback. However, due to improper handling of memory buffers during this...

GHSA-2J95-GQXF-V3VG Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

Vulnerability ZooKeeperReplicationConfig.secret silently substitutes the hard-coded constant "ch4n63m3" leetspeak for "change me" whenever the operator omits replication.secret. The same secret is wired into both the client-facing SASL context and the quorum/learner SASL contexts of the embedded...

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

Vulnerability ZooKeeperReplicationConfig.secret silently substitutes the hard-coded constant "ch4n63m3" leetspeak for "change me" whenever the operator omits replication.secret. The same secret is wired into both the client-facing SASL context and the quorum/learner SASL contexts of the embedded...

CVE-2026-89724

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeofstruct fwhtcframehdr...

DEBIAN-CVE-2026-89483

In the Linux kernel, the following vulnerability has been resolved: nvme: zero the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload however many ranges the command declares, because some devices ignore the 'Number of...

DEBIAN-CVE-2026-81010

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: honor taskwork cancellation iowaitidcb may run through the fallback taskwork path when taskworkadd can no longer queue work to the originating task. The fallback runs from a kworker and iouring marks such task wor...

UBUNTU-CVE-2026-81010

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: honor taskwork cancellation iowaitidcb may run through the fallback taskwork path when taskworkadd can no longer queue work to the originating task. The fallback runs from a kworker and iouring marks such task wor...

UBUNTU-CVE-2026-80945

In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics error, decompress retries through the software fallback, which writes req-dst with the CPU while it is still mapped DMAFROMDEVICE. With SWIOTL...

CVE-2026-80945

In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics error, decompress retries through the software fallback, which writes req-dst with the CPU while it is still mapped DMAFROMDEVICE. With SWIOTL...