EUVD-2026-77635

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of...

CVE-2026-55072 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of...

EUVD-2026-77483

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

Astra Linux – Vulnerability in Node-Elliptic

The Elliptic package 6.5.7 for Node.js, in its ECDSA implementation, does not correctly verify valid signatures when the hash contains at least four leading 0 bytes, and when the order of the elliptic curve’s base point is smaller than the hash, due to an truncateToN anomaly. This results in vali...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: sched: schcake: Fixed the logic for accounting bulk flows in order to ensure host fairness. In schcake, we keep track of the number of active bulk flows per host. This is done when running in the dst/src host fairness mode, which...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: crypto: algifhash – fixed the double-free in hashaccept. If the accept2 function is called on the algifhash socket type with the MSGMORE flag set, and the cryptoahashimport fails, sk2 is freed. However, it is also freed in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - net: bonding: Fixed a NULL dereference in bonddebugrlbhashshow. - rlbclearslave intentionally keeps RLB hash-table entries on the rxhashtblusedhead list with the slave set to NULL when no replacement slave is available...

Astra Linux – Vulnerability in Parsec

The vulnerability of the hashinitialize function in the PARSEC security subsystem is related to the assignment of a null pointer. Exploiting this vulnerability allows an attacker to cause a service failure...

Astra Linux – Vulnerability in the 389-DS-base

A flaw was discovered in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then any password will successfully match during authentication, instead of being inactive. This flaw allows an attacker to successfully authenticate as a user whose password h...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: conntrack: Hash resizes and cleanup operations need to be executed serially. Syzbot was able to trigger the following warning 1. No reprofounded issues were detected by Syzbot yet, but I was able to trigger a simila...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: powerpc/64s/slb: Fixed the issue where multiple hits occurred during SLB preloading. On systems that use the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer. This...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbedit: fix divide-by-zero in tcfskbedithash Commit 38a6f0865796 “net: sched: support hash selecting tx queue” added support for SKBEDITFTXQSKBHASH. The inclusive range size is computed as follows: mappingmod =...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/xen-netback: This issue prevents a Use-after-Free UAF condition in xenvifFlushHash. During the listforeachentryrcu iteration, when calling xenvifFlushHash, kfreercu does not exist within the rcu read critical section...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15, and Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure that the limit on the timer ID search loop is valid. The posixtimeradd function attempts to allocate a posix timer ID by starting from the cached ID stored after the last successful allocation. This is done b...

Astra Linux – Vulnerability in Linux

In the IPv4 implementation in the Linux kernel before 5.12.4, the net/ipv4/route.c file has an information leak because the hash table is very small...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, railwindowfree dereferenced a freed xfAppWindow pointer during HashTableFree cleanup. This was due to xfrailwindowcommon calling freeappWindow in case of title allocation failures, without first removing the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: ipset: Fixed issues related to region locking in hash types. The region locking mechanism introduced in v5.6-rc4 included three macros for handling region locks: ahashbucketstart, ahashbucketend which return the sta...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: selinux: Fixed a NULL pointer dereferencing issue when hashtab allocation fails. When the allocation of the hash table slot array fails in hashtabinit, h-size is initialized with a non-zero value, but the h-htable pointer is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ftrace: The function responsible for reading filter files now allocates and copies the hash value required for this purpose. Currently, the functions setftracefilter and setftracenotrace simply add a pointer to the global tracer...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fixed data races related to sysctlfibmultipathhashpolicy. When reading sysctlfibmultipathhashpolicy, it can be changed concurrently. Therefore, we need to add READONCE to its readers...