Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: Fixed a UAF issue in nfqnlnfhookDrop when opsinit fails. When the opsinit function is called to initialize the network, but ops-init fails, data is released. However, the pointer ptr in net-gen becomes invalid. In this...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftables: Clean up the hook list when the offload flag check fails Resuspend the hook list so that nftchainreleasehook has a chance to release the hooks. BUG: Memory leak Unreferenced object 0xffff88810180b100 size...

Astra Linux – Vulnerability in linux-astra-modules-5.4, linux-astra-modules-5.10

The vulnerability of the parsechooksetxattr function in the Linux kernel-module astra-modules is related to the lack of checking for the returned value. Exploiting this vulnerability allows a perpetrator to cause a service failure...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: serial: imx: Add the missing .thawnoirq hook The following warning is observed when using non-console UART instances during system hibernation: 37.371969 ------------ Cut here --- 37.376599 uart3rootclk already disabled 37.380810...

PT-2026-91223

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters "alior product...

MAL-2026-16154 Malicious code in pino-ulid (npm)

The npm package pino-ulid is named like a ULID generator, but it is a remote-access trojan. On install, its package.json postinstall script runs node dist/node/utils.js after checking the dist files exist with existsSync. dist/node/utils.js writes a PID lock file, sets up persistence on Windows...

Malicious code in pino-ulid (npm)

The npm package pino-ulid is named like a ULID generator, but it is a remote-access trojan. On install, its package.json postinstall script runs node dist/node/utils.js after checking the dist files exist with existsSync. dist/node/utils.js writes a PID lock file, sets up persistence on Windows...

CVE-2026-15892

The mcumgr SMP settings-management group handlers settingsmgmtread, settingsmgmtwrite, and settingsmgmtdelete in subsys/mgmt/mcumgr/grp/settingsmgmt/src/settingsmgmt.c allocate a keyname buffer and, for read, a data buffer via kmalloc when CONFIGMCUMGRGRPSETTINGSBUFFERTYPEHEAP is enabled, relying...

CVE-2026-15892 Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service

The mcumgr SMP settings-management group handlers settingsmgmtread, settingsmgmtwrite, and settingsmgmtdelete in subsys/mgmt/mcumgr/grp/settingsmgmt/src/settingsmgmt.c allocate a keyname buffer and, for read, a data buffer via kmalloc when CONFIGMCUMGRGRPSETTINGSBUFFERTYPEHEAP is enabled, relying...

EUVD-2026-77133

The mcumgr SMP settings-management group handlers settingsmgmtread, settingsmgmtwrite, and settingsmgmtdelete in subsys/mgmt/mcumgr/grp/settingsmgmt/src/settingsmgmt.c allocate a keyname buffer and, for read, a data buffer via kmalloc when CONFIGMCUMGRGRPSETTINGSBUFFERTYPEHEAP is enabled, relying...

CVE-2026-15892 Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service

The mcumgr SMP settings-management group handlers settingsmgmtread, settingsmgmtwrite, and settingsmgmtdelete in subsys/mgmt/mcumgr/grp/settingsmgmt/src/settingsmgmt.c allocate a keyname buffer and, for read, a data buffer via kmalloc when CONFIGMCUMGRGRPSETTINGSBUFFERTYPEHEAP is enabled, relying...

CVE-2026-15892 Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service

The mcumgr SMP settings-management group handlers settingsmgmtread, settingsmgmtwrite, and settingsmgmtdelete in subsys/mgmt/mcumgr/grp/settingsmgmt/src/settingsmgmt.c allocate a keyname buffer and, for read, a data buffer via kmalloc when CONFIGMCUMGRGRPSETTINGSBUFFERTYPEHEAP is enabled, relying...

CVE-2026-15892

CVE-2026-15892 is a heap memory leak in Zephyr Project RTOS 's mcumgr settings-management handlers (settings_mgmt_read(), settings_mgmt_write(), settings_mgmt_delete()). When CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP and CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK are both enabled, an early return o...

PT-2026-90984

Name of the Vulnerable Software and Affected Versions mcumgr affected versions not specified Description A memory leak occurs in the SMP settings-management group handlers settings mgmt read, settings mgmt write, and settings mgmt delete within subsys/mgmt/mcumgr/grp/settings mgmt/src/settings...

MAL-2026-16140 Malicious code in tracker-cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...

DEBIAN-CVE-2026-89762

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...

AZL-100791 CVE-2026-89762 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...

CVE-2026-89762

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...

CVE-2026-89762

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...

CVE-2026-89762 apparmor: fix cred UAF caused by begin_current_label_crit_section()

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...