Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: Use dst in this direction when pushing the IPIP header. When pushing the IPIP header, the route of the other direction is used to calculate the headroom. Instead, use the route in this direction. Accessing t...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ntfs: Validating the values of the resident $INDEXROOT field during lookups. The values of the $INDEXROOT field carry index header fields that are consumed by callers after a lookup. Some callers already validate certain parts...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of the numdests header Before accessing the numdests field of the struct batadvtvlvmcasttracker, it was attempted to check whether there is enough space in the network header. However, instead of...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath12k: A memory leak has been fixed in ath12kwifi7dprxhverifytkipmic. In ath12kwifi7dprxhverifytkipmic, the call to ath12kdprxchecknwifihdrlenvalid may return false when the NWIFI header length is invalid. This causes the...

Improper Authentication

Keycloak is vulnerable to Improper Authentication. The vulnerability is due to improper validation of client authentication assertions, which allows an attacker with valid client credentials to supply a fake unsigned assertion header and bypass policies requiring signed JWT authentication...

stealth_call

Cos'è? Libreria header-only per Windows x64 che consente di invocare qualsiasi syscall NT senza toccare gli import di ntdll, senza lasciare stringhe nel binario e senza i soliti campanelli d'allarme che fanno impazzire gli EDR. Niente CRT. Niente STL. Niente IAT. L'intero progetto compila a circa...

CVE-2026-78329: Improper Input Validation

Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint defaulted its headerFilterStrategy field to the base HttpHeaderFilterStrategy and pushed...

CVE-2026-59230: Improper Input Validation

Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-mail component ships a MimeMultipart data format that can unmarshal a MIME multipart message. When it is configured...

PT-2026-81035

Name of the Vulnerable Software and Affected Versions CakePHP versions prior to 4.5.12 CakePHP versions prior to 4.6.5 CakePHP versions prior to 5.1.8 CakePHP versions prior to 5.2.14 CakePHP versions prior to 5.3.7 Description Custom mail headers added via the setHeaders or addHeaders functions ...

PT-2026-80915

Name of the Vulnerable Software and Affected Versions Apache Camel versions 2.17.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.x Description Improper input validation in the camel-mail component's MimeMultipart data format allows a sender t...

CVE-2026-71300: Improper Input Validation

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...

PT-2026-80930

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.11.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.9 Description Improper input validation in the Apache Camel Undertow component occurs because the UndertowEndpoin...

PT-2026-80928

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.9 Description Improper input validation in the Apache Camel Atmosphere Websocket component allows for header...

PT-2026-80927

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode t...

CVE-2026-77634: Improper Neutralization of CRLF Sequences

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

PT-2026-80883

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter and access token cookie, which are reflected into...

PT-2026-80954

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...

PT-2026-81165

Name of the Vulnerable Software and Affected Versions Events Manager – Calendar, Bookings, Tickets, and more! versions prior to 7.4.0.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting XSS. This occurs when t...

PT-2026-85160

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg http next multipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and...

libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of HTTP/2 HPACK path header. The issue results from the lack of proper...