webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information

A flaw was found in WebKitGTK. Processing maliciously crafted web content can disclose sensitive user information due to a path handling issue that was addressed with improved validation...

webkitgtk: webkitgtk: Visiting a website may leak sensitive data

A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...

SUSE CVE-2026-19200

The Velociraptor verify VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker...

The vulnerability of the f81604_read_int_callback() function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver allows a hacker to trigger a service failure.

The vulnerability of the f81604readintcallback function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the functions xt_check_match() and xt_check_target() in the net/netfilter/x_tables.c module of the netfilter kernel of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the functions xtcheckmatch and xtchecktarget in the net/netfilter/xtables.c module of the netfilter component of the Linux operating system is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the fib6_nh_init() function in the net/ipv6/route.c module of the IPv6 protocol implementation in the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the fib6nhinit function in the net/ipv6/route.c module of the Linux operating system’s IPv6 kernel implementation is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the loongson gpio_init_irqchip() function in the drivers/gpio/gpio-loongson-64bit.c driver of the Linux operating system’s GPIO kernel module allows a attacker to cause a service failure.

The vulnerability of the loongsongpioinitirqchip function in the drivers/gpio/gpio-loongson-64bit.c file of the Linux kernel’s GPIO driver is related to the use of a pointer. Exploiting this vulnerability could allow an attacker to cause a system failure...

PT-2026-81490

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able to enumerate installed apps...

The vulnerability of the bonddebug_rlb_hash_show() function in the drivers/net/bonding/bonddebugfs.c file of the Linux kernel-based network device driver allows a hacker to cause a system failure.

The vulnerability of the bonddebugrlbhashshow function in the drivers/net/bonding/bonddebugfs.c file of the Linux kernel network device driver is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability in the vdpa_nl_policy structure of the drivers/vdpa/vdpa.c module of the vDPA device driver for the Linux operating system allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the vdpanlpolicy structure in the drivers/vdpa/vdpa.c file of the vDPA device driver for the Linux operating system is related to incorrect assumptions regarding the organization of data or memory. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the rose_connect() function in the net/rose/af_rose.c module, which is part of the networking functions in the Linux kernel, allows a hacker to cause a service failure.

The vulnerability of the roseconnect function in the net/rose/afrose.c module, which implements networking functions for the Linux operating system’s kernel, is related to the use of pointers. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

DEBIAN-CVE-2026-56135

In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function buildinheritedid in libntfs-3g/security.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a crafted...

DEBIAN-CVE-2026-56136

In NTFS-3G through 2026.2.25, an out-of-bounds read exists in ntfsirnill in libntfs-3g/index.c that allows an attacker to read possibly confidential information in an ntfs-3g process by crafting a malicious NTFS image. This read operation is triggered by creation of a file with a crafted name...

ROOT-OS-DEBIAN-13-CVE-2026-49337 CVE-2026-49337 in libde265 - Patched by Root

Root has patched CVE-2026-49337 in the libde265 package for Root:Debian:13. Multiple fixed versions available...

Astra Linux – Vulnerability in Chromium

The incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. Chromium security severity: High...

Astra Linux – Vulnerability in mbedtls

A issue was discovered in Arm Mbed TLS prior to version 2.23.0. Due to a side channel in modular exponentiation, an RSA private key used in a secure enclave could be disclosed...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: cifs: Fixed a use-after-free in rdata-readintopages. When the network status is unstable, a use-after-free may occur when reading data from the server. BUG: KASAN: Use-after-free in readpagesfillpages+0x14c/0x7e0 Call Trace:...

Astra Linux – Vulnerability in Golang-1.19

The net/http HTTP/1.1 client mishandled the situation where a server responds to a request with an “Expect: 100-continue” header with a non-informational 200 or higher status. This mishandling could leave a client connection in an invalid state, causing the next request sent on that connection to...

Astra Linux – Vulnerability in Golang 1.19, Golang 1.23

The matching of hosts against proxy patterns may improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to “.example.com”, a request to “::1%25.example.com:80” will be incorrectly matched and not be proxied...

Astra Linux – Vulnerability in libssh

A flaw was discovered in libssh, where a malicious SFTP SSH File Transfer Protocol server can exploit this by sending a malformed ‘longname’ field within an SSHFXPNAME message during a file listing operation. This missing null check can lead to reading beyond the allocated memory on the heap. Thi...