Astra Linux – Vulnerability in ncurses

ncurses before version 6.4, as of 20230408, when used by a setuid application, allowed local users to cause security-related memory corruption through malformed data in a terminfo database file located in $HOME/.terminfo, or accessible via the TERMINFO or TERM environment variables...

firefox: Site isolation issue in the Networking: Cookies component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking: Cookies component...

CVE-2026-70463

An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain...

The vulnerability of the Audio/Video component in the Firefox web browser and the Thunderbird email client allows attackers to access confidential data and influence its integrity.

The vulnerability of the Audio/Video component in the Firefox web browser and the Thunderbird email client is related to dependencies on unspecified behaviors for each type of implementation. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data and affect...

CVE-2026-6827 justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities

justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling. When custom policies preserve foreign namespaces SVG/MathML, dangerous content such as HTML integration points SVG , MathML and mutation-XSS parser-differential payloads could...

ROOT-OS-DEBIAN-11-CVE-2026-63846 CVE-2026-63846 in linux - Patched by Root

Root has patched CVE-2026-63846 in the linux package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-31787 CVE-2026-31787 in linux - Patched by Root

Root has patched CVE-2026-31787 in the linux package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2025-38693 CVE-2025-38693 in linux - Patched by Root

Root has patched CVE-2025-38693 in the linux package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2023-53661 CVE-2023-53661 in linux - Patched by Root

Root has patched CVE-2023-53661 in the linux package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-31754 CVE-2026-31754 in linux - Patched by Root

Root has patched CVE-2026-31754 in the linux package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-46198 CVE-2026-46198 in linux - Patched by Root

Root has patched CVE-2026-46198 in the linux package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-43386 CVE-2026-43386 in linux - Patched by Root

Root has patched CVE-2026-43386 in the linux package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-52942 CVE-2026-52942 in linux - Patched by Root

Root has patched CVE-2026-52942 in the linux package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-53289 CVE-2026-53289 in linux - Patched by Root

Root has patched CVE-2026-53289 in the linux package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2025-39863 CVE-2025-39863 in linux - Patched by Root

Root has patched CVE-2025-39863 in the linux package for Root:Debian:11. Multiple fixed versions available...

CVE-2026-41845

CVE-2026-41845...

CVE-2026-2996

The Advanced Product Fields Product Addons for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validatecartdata' function. This makes it possible for unauthenticated attackers to bypass...

CVE-2026-47895

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed...

CVE-2026-33047

Combodo iTop (a web-based IT service management tool) is affected by a permission bypass in versions prior to 3.2.3 . A user without write permissions can lock an object, which may disrupt other users' ability to modify that object. The CVSS 3.1 score is 4.3 (MEDIUM) , reflecting a low availabili...

CVE-2026-48769

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches th...