CLSA-2026-1792291423 TuxCare security update for @babel/helper-create-regexp-features-plugin (2 CVEs)

TuxCare rebuilt @babel/helper-create-regexp-features-plugin to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792291421 TuxCare security update for @babel/helper-create-regexp-features-plugin (1 CVE)

TuxCare rebuilt @babel/helper-create-regexp-features-plugin to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CLSA-2026-1792291422 TuxCare security update for @babel/helper-create-regexp-features-plugin (1 CVE)

TuxCare rebuilt @babel/helper-create-regexp-features-plugin to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: x86/kvm: The teardown of PV features also occurs during boot-up. Various PV features Async PF, PV EOI, steal time work through memory shared with the hypervisor. When we resume from hibernation, we must properly teardown all...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: veth: The GRO flag is cleared when XDP is disabled, even when the device is disabled. The NETIFFGRO flag is set automatically when XDP is enabled, because both features use the same NAPI mechanism. The logic for clearing the...

vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features

Affected- Ecosystem / package: pip / vllm- Affected versions: vLLM ≤ 0.25.1 confirmed on 0.25.1, commit 752a3a504485. The lower bound predates 0.25.1; maintainers can confirm how far back the scale-out transport path reaches. SummaryvLLM's disaggregated scale-out transport splits a multimodal...

extrude

extrude Analiza binarios en busca de características de seguridad faltantes, divulgación de información y más. 🚧 Extrude se encuentra en las primeras etapas de desarrollo y actualmente solo admite binarios ELF y MachO. Los binarios PE Windows serán compatibles pronto. Uso Usage: extrude flags fil...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac: Fixed the handling of Data Path Parity Errors for DMA channels. The commit 56e58d6c8a56 „net: stmmac: Implement Safety Features in XGMAC core“ checks for safety errors, but leaves Data Path Parity Errors for...

Astra Linux – Vulnerability in Chromium

Script injection in accessibility features of Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML through a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: enetc: Deny offloading of tc-based TSN features on VF interfaces TSN features on the ENETC taprio, cbs, gate, police are configured through a combination of command BD ring messages and port registers: enetcportrd,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ixgbevf: added the missing negotiatefeatures operation to the Hyper-V ops table. The commit a7075f501bd3 “ixgbevf: fixed mailbox API compatibility by negotiating supported features” added the.negotiatefeatures callback to...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: BPF: Do not allow BPF test infra to emit invalid GSO types to the stack. Yinhao et al. reported that their fuzzer tool was able to trigger the skbwarnbadoffload function from netifskbfeatures - gsofeaturescheck. When a BPF progra...

Security Is More Than a Library Call: How Security Features Live in Code

Implementing security features---functionalities that protect sensitive data or prevent malicious actions by attackers---is important for ensuring the security and integrity of software systems. Correctly implementing access control, cryptography, or other security features is challenging as they...

PT-2026-106264

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.30.0 Description In the disaggregated scale-out path, the /inference/v1/generate endpoint fails to validate and rebind caller-supplied multimodal state against the active model's renderer contract. This allows an...

org.apache.activemq:artemis-features (>=2.31.1, <=2.33.0) potentially affected by CVE-2026-101292 via org.apache.activemq:artemis-core-client-osgi (>=2.31.1, <=2.33.0)

org.apache.activemq:artemis-core-client-osgi MAVEN version =2.31.1, =2.31.1, =2.33.0 Source cves: CVE-2026-101292 Source advisory: MEND:CVE-2026-101292...

org.apache.activemq:artemis-features (>=2.31.1, <=2.33.0) potentially affected by CVE-2026-101292 via org.apache.activemq:artemis-jms-client-osgi (>=2.31.1, <=2.33.0)

org.apache.activemq:artemis-jms-client-osgi MAVEN version =2.31.1, =2.31.1, =2.33.0 Source cves: CVE-2026-101292 Source advisory: MEND:CVE-2026-101292...

CVE-2026-97868

A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEditor.jsx of the component Note Editor. The manipulation leads to cross site scripting. The attack may be initiated remotely. Th...

PT-2026-98872

Name of the Vulnerable Software and Affected Versions sheshbabu zen versions prior to 1.5.1 Description A remote cross-site scripting issue exists in the Note Editor component within the dangerouslySetInnerHTML function of the features/notes/NotesEditor.jsx file. Cross-site scripting is a techniq...

CVE-2026-76910

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...

CVE-2026-77425

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifyin...