7516 matches found
Astra Linux – Vulnerability in docker.io-app
BuildKit is a toolkit for converting source code into build artifacts in an efficient, expressive, and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could exploit a feature that removes empty files created for the mountpoints, causing the file to be removed from...
Astra Linux – Vulnerability in Squid
A buffer overflow was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers were vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations were sent to a...
PT-2026-91255
A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf node get name of the file scenegraph/base scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit has been disclosed to the public and m...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in JsonLoader.fromURL, which fetches any URL without validation, and to memory amplification through JacksonUtils.newMapper, which enables WRITEBIGDECIMALASPLAIN so a BigDecimal serializes via...
ROOT-OS-UBUNTU-2404-CVE-2026-45860 CVE-2026-45860 in linux - Patched by Root
Root has patched CVE-2026-45860 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2404-CVE-2025-39679 CVE-2025-39679 in linux - Patched by Root
Root has patched CVE-2025-39679 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2204-CVE-2025-36423 CVE-2025-36423 in linux - Patched by Root
Root has patched CVE-2025-36423 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...
AZL-99347 CVE-2026-83605 affecting package python-tensorboard 2.16.2-6
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...
EUVD-2026-44688
Cloudreve WebDAV /dav has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root...
Astra Linux – Vulnerability in Twisted
Twisted is an event-based framework for internet applications, compatible with Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, potentially leading to information disclosure. This vulnerability has been fixed in 24.7.0rc1...
Astra Linux – Vulnerability in cups
OpenPrinting CUPS is an open-source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.17, a network-attached attacker could send a crafted SNMP response to the CUPS SNMP backend, causing an out-of-bounds read of up to 176 bytes beyond the stack buffer. The leak...
Astra Linux – Vulnerability in mbedtls
In Arm Mbed TLS before version 2.19.0, and Arm Mbed Crypto before version 2.0.0, when deterministic ECDSA is enabled, an RNG with insufficient entropy is used for blinding. This may allow an attacker to recover a private key through side-channel attacks if a victim signs the same message multiple...
Astra Linux – Vulnerability in Firefox
Bypass of the same-origin policy in the Networking: JAR component. This vulnerability has been fixed in Firefox 151 and Thunderbird 151...
Astra Linux – Vulnerability in gst-plugins-base1.0
GStreamer is a library for constructing graphs of media-handling components. A OOB-write vulnerability has been identified in the gstssaparse.c file’s gstssaparseremoveoverridecodes function. This function is responsible for parsing and removing SSA SubStation Alpha style override codes, which ar...
Astra Linux – Vulnerability in OpenSSL
To decrypt SM2 encrypted data, an application is expected to call the API function EVPPKEYdecrypt. Typically, an application will call this function twice. The first time, upon entry, the “out” parameter can be NULL, and upon exit, the “outlen” parameter contains the buffer size required to hold...
Astra Linux – Vulnerability in Firefox
Memory safety bugs exist in Firefox 148.0.2. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox 148.0.2...
ROOT-APP-PYPI-CVE-2026-34515 CVE-2026-34515 in aiohttp - Patched by Root
Root has patched CVE-2026-34515 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
EUVD-2026-60696
Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
CVE-2026-74958
CVE-2026-74958 is an information disclosure vulnerability in the WebRTC component of Mozilla Firefox and Thunderbird. The CVSS 3.1 score is 7.5 (HIGH) , with a network attack vector requiring no privileges or user interaction, and a high impact on confidentiality. CISA SSVC assesses exploitation ...
