PT-2026-93764

Name of the Vulnerable Software and Affected Versions @fastify/auth versions 5.0.0 through 5.1.0 Description This plugin composes multiple authentication and authorization strategies into a single route guard. An issue exists when strategies are composed using the relation "or" option combined wi...

CVE-2026-81899 Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboard

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group...

CVE-2026-81899

Concrete CMS versions 9.0.0 through 9.5.2 are affected by a stored cross-site scripting (XSS) vulnerability in the group folder name handling. The add and edit group-folder handlers stored submitted folder names without sanitizing HTML, and the group search grid returned them without output encod...

Security Bulletin: IBM watsonx Code Assistant On Prem product impacted by Vulnerability Found in runtime-7.26.10.tgz

Summary A vulnerability CVE-2025-27789 has been identified in the Babel runtime package @babel/runtime version 7.26.10 and earlier, which impacts the IBM watsonx Code Assistant On Prem Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel is a compiler for writing next generation...

CVE-2026-81899: Improper Neutralization of Input During Web Page Generation

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

A flaw was discovered in the filelockinit function in the fs/locks.c file within the Linux kernel. This issue can lead to host memory exhaustion, as memcg does not limit the number of POSIX file locks that can be created...

Astra Linux – Vulnerability in Zabbix

A authenticated user with API access e.g., a user with the default User role can be added to any group e.g., Zabbix Administrators. Specifically, a user with access to the user.update API endpoint can be added to any group, except for groups that are disabled or have restricted GUI access...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Class: Fixed a possible memory leak in classregister. If classaddgroups returns an error, the cp-subsys needs to be unregistered, and the cp needs to be freed. We cannot call ksetunregister here, because the cls will be freed in...

Astra Linux – Vulnerability in Chromium

In Google Chrome on Linux and ChromeOS before version 92.0.4515.107, an attacker who convinced a user to install a malicious extension could perform an out-of-bounds memory write by using a crafted HTML page. This vulnerability allowed the attacker to execute such an operation...

Astra Linux – Vulnerability in Chromium

Before version 100.0.4896.88, using tab groups in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: afnetlink: Fixed an out-of-bounds shift in the group mask calculation When a netlink message is received, netlinkrecvmsg fills in the address of the sender. One of the fields is the 32-bit bitfield nlgroups, which carries the...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: blk-iolatency: Fixed imbalances in the number of in-flight IO operations and issues with hanging during offline conditions. iolatency needs to track the number of in-flight IO operations per cgroup. Since this tracking can be...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fixed a double-free in arfscreategroups. When the memory allocated by kvzalloc fails, arfscreategroups will free ft-g and return an error. However, arfscreatetable, the only function calling arfscreategroups, will hold...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: bridge: switchdev: Skip MDB replays of deferred events on offload Before this change, the generation of the list of MDB events to replay competed with the creation of new group memberhips, either through the IGMP/MLD snoopin...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: qgroup: Fixed a leak in the qgroup prealloc resource reservation during subvolume operations. The creation of subvolumes, snapshots, and deletion of subvolumes all utilize btrfssubvolumereservemetadata to reserve metada...

Astra Linux – Vulnerability in docker.io

Moby is an open-source project created by Docker to enable software containerization. A bug was discovered in Moby Docker Engine where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates the supplementary group permissions, they may be abl...

Astra Linux – Vulnerability in Chromium

The use of tab groups for after-free operations in Google Chrome before version 148.0.7778.168 allowed a remote attacker to execute arbitrary code through malicious network traffic. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

Before version 91.0.4472.77, using “After Free” in TabGroups in Google Chrome allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisipcie: Fixed out-of-bound access when a valid event group is used. The perf tool allows users to create event groups using the cmd 1. However, the driver does not check whether the array index is out of bounds wh...

Astra Linux – Vulnerability in Linux, Linux 5.10

A use-after-free read flaw was discovered in the sockgetsockopt function in net/core/sock.c, due to race conditions involving SOPEERCRED and SOPEERGROUPS functions when used with listen and connect in the Linux kernel. In this flaw, an attacker with user privileges could potentially crash the...