Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: printk: Fixed signed integer overflow when defining LOGBUFLENMAX. Shifting 1 31 on a 32-bit integer causes signed integer overflow, leading to undefined behavior. To prevent this, 1 was cast to u32 before the shift operation is...

ROOT-OS-UBUNTU-2404-CVE-2026-43213 CVE-2026-43213 in linux - Patched by Root

Root has patched CVE-2026-43213 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2025-37794 CVE-2025-37794 in linux - Patched by Root

Root has patched CVE-2025-37794 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

CLSA-2026-1783386136 TuxCare security update for 22 packages (1 CVE)

TuxCare rebuilt 22 packages to address 1 CVE. Fixed in 5.4.30.Final-tuxcare.2...

CLSA-2026-1782435541 TuxCare security update for commons-beanutils:commons-beanutils (1 CVE)

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.8.0-tuxcare.2...

CLSA-2026-1779151610 TuxCare security update for org.apache.xmlgraphics:xmlgraphics-commons (1 CVE)

TuxCare rebuilt org.apache.xmlgraphics:xmlgraphics-commons to address 1 CVE. Fixed in 2.1-tuxcare.1...

CLSA-2026-1779065208 TuxCare security update for 123 packages (1 CVE)

TuxCare rebuilt 123 packages to address 1 CVE. Fixed in 10.0.30.tuxcare0001...

Chromium: CVE-2026-17925 Inappropriate implementation in Cast

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CLEANSTART-2026-HZ36625 Security fixes in opentelemetry-collector-contrib-fips 0.142.0-r0

Package opentelemetry-collector-contrib-fips version 0.142.0-r0 fixes 1 vulnerabilities: ghsa-cfpf-hrx2-8rv6...

CLEANSTART-2026-MU24968 Security fixes in docker 20.10.18-r0

Package docker version 20.10.18-r0 fixes 1 vulnerabilities: CVE-2022-36109...

CVE-2026-14257

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...

CVE-2026-16374

CVE-2026-16374 is an information disclosure vulnerability within the Framework component of DevTools . This flaw affects Firefox , Firefox ESR , and Thunderbird . The vulnerability was addressed in Firefox 153 , Firefox ESR 140.13 , and Thunderbird 153/140.13 . No specific details regarding the r...

UBUNTU-CVE-2026-63898

In the Linux kernel, the following vulnerability has been resolved: USB: serial: mctu232: fix memory corruption with small endpoint The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increas...

EUVD-2026-45287

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLogN1 or WithSignedCertificateTimestampsN1 counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised...

CVE-2026-46638

Twig is a template language for PHP. Prior to 3.26.0, % sandbox %% include % can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity, allowing the cached template to use tags, filters, and functions that should have been denied by...

PT-2026-60039

Impact WsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. Patches The issue is fixed with version 4.3.4. Preconditions The practical impact depends on the deployment. The deployment...

CVE-2026-44696

OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's rich text markdown rendering pipeline uses Sanitize::Config::RELAXED:css for inline style sanitization. This configuration permits essentially all CSS properties in style attributes on permitted HTML...

CVE-2026-48721 Warp: Env-var prefixes can lead to denylisted command autoexecution

Warp is an agentic development environment. From 0.2025.10.08.08.12.stable00 until 0.2026.05.06.15.42.stable01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: kunit: fixed the reference count leak in kfreeatend The reference counting issue occurs during the normal execution of kfreeatend. When kunitallocandgetresource is called, the function fails to properly handle the returned resour...

CVE-2026-8391 Other issue in the JavaScript Engine component

Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11...