712 matches found
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: dm raid: fixed the address sanitizer warning in raidstatus. This warning occurs when using a kernel with address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsirai...
Astra Linux – Vulnerability in Puma
Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, Puma exhibited incorrect behavior when parsing chunked transfer encoding bodies, allowing HTTP request smuggling. The fixed versions limit the size of chunk extensions. Without this limitation, an...
Astra Linux – Vulnerability in Node-Elliptic
The verify function in lib/elliptic/eddsa/index.js within the Elliptic package, as of version 6.5.6 for Node.js, omits the validation of the condition “sig.S.gtesig.eddsa.curve.n || sig.S.isNeg”...
ROOT-OS-UBUNTU-2404-CVE-2025-40156 CVE-2025-40156 in linux - Patched by Root
Root has patched CVE-2025-40156 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...
CVE-2026-65569
Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...
CVE-2026-66711 WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...
CVE-2026-66711
Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...
WordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerability
SQL Injection vulnerability discovered by dzeusking in WordPress Plugin WP Job Portal versions = 2.5.6...
CVE-2026-17656 vulnerabilities
Vulnerabilities for packages: chromium...
CLSA-2026-1779238047 TuxCare security update for 24 packages (1 CVE)
TuxCare rebuilt 24 packages to address 1 CVE. Fixed in 5.5.6.Final-tuxcare.1...
Amazon Linux 2023 : python3-tornado (ALAS2023-2026-2016)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2016 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving...
Arbitrary Code Injection
Overview sentence-transformers is a State-of-the-Art Text Embeddings Affected versions of this package are vulnerable to Arbitrary Code Injection through the importmoduleclass function in sentencetransformers/util/misc.py due to a logic flaw that allows the security guard to be bypassed if a loca...
Anthropic’s Opus 5 Is Better at Resisting Prompt Injection
The chart is interesting. On the IPI benchmark, Opus 5 improved over Opus 4.8, reducing the probability of an attacker succeeding within 15 attempts from 5.5% to 2.0%, and from 0.5% to 0.2% on 1 attempt. It also improved on Sonnet 5 5.9% at k=15 and Mythos 5 2.6%, making it the most robust model...
EUVD-2026-51519
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...
K000162463: PostgreSQL vulnerability CVE-2026-6478
Security Advisory Description Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current...
CVE-2026-66442 WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in YayPricing = 3.5.6 versions...
EUVD-2026-49246
Subscriber Broken Access Control in YayPricing = 3.5.6 versions...
CVE-2026-65606
creationtimestamp| type| source ---|---|--- 2026-07-23 15:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrd43i7i3i2a...
CVE-2026-65512
Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...