Astra Linux – vulnerability in Samba

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker capable of...

Astra Linux – vulnerability in Apache2

Out-of-bounds read vulnerability in Apache HTTP Server with modheaders and modmime and multiple response languages. This issue affects Apache HTTP Server: versions 2.4.0 through 2.4.67...

Astra Linux – vulnerability in libhttp-date-perl

HTTP::Date versions prior to 6.08 for Perl allow CPU exhaustion due to polynomial regex backtracking in parsedate. parsedate matches the date string against a series of alternative regex patterns, with str2time delegating to it. Several of these patterns feature unbounded quantifiers placed side ...

Astra Linux – vulnerability in libsoup3

A flaw in libsoup’s handling of HTTP headers allows multiple Host: headers within a request; the last occurrence is returned for server-side processing. Common front proxies typically honor the first Host: header, so this inconsistency can lead to vhost confusion—a proxy may route a request to on...

Astra Linux – vulnerability in python3.11

CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host...

Astra Linux – vulnerability in Apache2

The improper privilege management vulnerability in Apache HTTP Server 2.4.67 and earlier allows local .htaccess authors to read files using the privileges of the httpd user. This issue affects Apache HTTP Server versions 2.4.67 and earlier. Users are advised to upgrade to version 2.4.68, which...

Astra Linux – vulnerability in Apache2

Use After Free vulnerability in Apache HTTP Server with modldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue...

Astra Linux – vulnerability in Apache2

Heap-based Buffer Overflow vulnerability in modproxyajp of Apache HTTP Server. If modproxyajp connects to a malicious AJP server, that server can send a malicious AJP message back to modproxyajp, causing it to write 4 attacker-controlled bytes after the end of a heap-based buffer. This issue...

Astra Linux – vulnerability in Apache2

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie This issue affects Apache HTTP Server: versions 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue...

CVE-2026-112077

A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function rcorecmdstrpipe in the library libr/core/rtrhttp.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the attack ...

Multiple vulnerabilities in IBM Java SDK affect AIX

IBM SECURITY ADVISORY First Issued: Mon Oct 19 04:45:00 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/javaoct2026advisory.asc Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX...

CVE-2026-112077

The radareorg radare2 framework (versions 6.2.0/6.2.2 ) contains a protection mechanism failure in the HTTP Sandbox Policy Handler . Specifically, the r_core_cmd_str_pipe function in libr/core/rtr_http.inc.c allows for remote exploitation with high complexity, although the exploitability is consi...

CVE-2026-112077 radareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanism

A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function rcorecmdstrpipe in the library libr/core/rtrhttp.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the attack ...

CVE-2026-112077

A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function rcorecmdstrpipe in the library libr/core/rtrhttp.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the attack ...

CVE-2026-112077 radareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanism

A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function rcorecmdstrpipe in the library libr/core/rtrhttp.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the attack ...

EUVD-2026-104060

A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function rcorecmdstrpipe in the library libr/core/rtrhttp.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the attack ...

CVE-2026-112077 radareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanism

A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function rcorecmdstrpipe in the library libr/core/rtrhttp.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the attack ...

CVE-2026-102503

Missing Authentication for Critical Function CWE-306 and Missing Authorization CWE-862 in the /libp2p-http ingress server StartIngressServer in cmd/sam-node/node.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass...

CVE-2026-102503 Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)

Missing Authentication for Critical Function CWE-306 and Missing Authorization CWE-862 in the /libp2p-http ingress server StartIngressServer in cmd/sam-node/node.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass...

CVE-2026-102503 Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)

Missing Authentication for Critical Function CWE-306 and Missing Authorization CWE-862 in the /libp2p-http ingress server StartIngressServer in cmd/sam-node/node.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass...