CLSA-2026-1789416166 TuxCare security update for org.springframework (12 CVEs)

TuxCare rebuilt 21 org.springframework packages to address 12 CVEs. Fixed in 4.3.4.RELEASE-tuxcare.5...

CVE-2026-57577

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a...

EUVD-2026-77700

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and...

CVE-2026-57578

DotVVM (open-source MVVM framework for .NET web applications) contains a missing-authorization flaw in its AuthorizeActionFilter prior to versions 4.2.11, 4.3.15, and 5.0.0-preview09-final. The filter's explicit implementations of ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilt...

CVE-2026-57578 DotVVM: Missing authorization in AuthorizeActionFilter

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and...

CVE-2026-57578 DotVVM: Missing authorization in AuthorizeActionFilter

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and...

CVE-2026-57578 DotVVM: Missing authorization in AuthorizeActionFilter

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorization because its explicit ICommandActionFilter.OnCommandExecutingAsync, IViewModelActionFilter.OnViewModelCreatedAsync, and...

CVE-2026-57581 DotVVM: Unrestricted file upload

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the...

Framework

🔒 Pentest Framework !Pythonhttps://img.shields.io/badge/Py...

Astra Linux – Vulnerability in ffmpeg5

It was discovered that FFmpeg versions n5.1 to n6.1 contain an Off-by-one Error vulnerability in the libavfilter/avfshowspectrum.c file. This vulnerability allows attackers to cause a Denial of Service DoS attack through crafted inputs...

Astra Linux – Vulnerability in ffmpeg5

A vulnerability, classified as critical, was discovered in FFmpeg up to version 5.1.5. This vulnerability affects the fillaudiodata function in the file /libswresample/swresample.c. The vulnerability leads to a heap-based buffer overflow. The attack can be initiated remotely. This issue was fixed...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: For the clk subsystem, in the qcom module, there is a issue where gcc-sm6350 uses parentmap for two clocks that actually doesn’t exist. If a clkrcg2 has a parent, it should also have the parentmap property defined. Otherwise, a...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, Rack::QueryParser parsed query strings and application/x-www-form-urlencoded bodies into Ruby data structures without imposing any limit on the number of parameters. This allowed attackers to send requests...

Astra Linux – Vulnerability in ffmpeg

A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2, specifically in the libavcodec/getbits.h file, during the process of writing .mov files. This vulnerability may lead to memory corruption and other potential issues...

Astra Linux – Vulnerability in ffmpeg

Buffer overflow vulnerability in FFmpeg 4.2, located in the convolutiony10bit section of libavfilter/vfvmafmotion.c, which could allow a remote malicious user to cause a Denial of Service attack...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework. Prior to version 29.3.1, a security vulnerability was detected that allowed for bypassing the privilege validation process during Docker plugin installation. Due to an error in the daemon’s privilege comparison logic, the daemon might incorrectly accept...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: USB: Gadget: pxa25xudc: fixed a memory leak that occurred when using debugfslookup. When calling debugfslookup, the result must be processed by calling dput; otherwise, a memory leak will occur over time. To simplify things, simp...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ntbnetdev: Use devkfreeskbany in interrupt context. TX/RX callback handlers ntbnetdevtxhandler, ntbnetdevrxhandler can be called in interrupt context via the DMA framework after the respective DMA operations are completed...

Astra Linux – Vulnerability in ffmpeg

A denial-of-service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodecalloccontext3 in options.c...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: The mcbausb driver fails to populate the ndochangemtu function, allowing for a buffer overflow. Sending a PFPACKET message allows bypassing the CAN driver’s logic and directly reaching the xmit function of the CAN driver. The onl...