Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: tty: ngsm: Do not block the input queue by waiting for the MSC response. Currently, the gsmqueue function processes incoming frames. When opening a DLC channel, it calls gsmdlciopen, which in turn calls gsmmodemupdate. If the bas...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception in the TLS module when a TLS server is configured with pskCallback or ALPNCallback. A remote attacker can crash or exhaust resources of a TLS server by sending input that causes the callback to throw an error...

[SECURITY] Fedora 42 Update: NetworkManager-l2tp-1.52.0-1.fc42

This package contains software for integrating L2TP and L2TP over IPsec VPN support with the NetworkManager...

[SECURITY] Fedora 43 Update: NetworkManager-l2tp-1.52.0-1.fc43

This package contains software for integrating L2TP and L2TP over IPsec VPN support with the NetworkManager...

MiracleLinux 9 : nginx-1.20.1-22.el9.ML.1 (AXSA:2025-10304:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10304:01 advisory. nginx: TLS Session Resumption Vulnerability CVE-2025-23419 Tenable has extracted the preceding description block directly from the MiracleLinux security...

PT-2026-2801

Name of the Vulnerable Software and Affected Versions go-ethereum geth versions prior to 1.16.8 Description go-ethereum geth is a golang implementation of the Ethereum protocol. A specially crafted message can force a vulnerable node to shutdown or crash, resulting in a denial-of-service conditio...

MiracleLinux 9 : httpd-2.4.62-4.el9_6.4 (AXSA:2025-10819:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10819:07 advisory. httpd: insufficient escaping of user-supplied data in modssl CVE-2024-47252 httpd: modssl: access control bypass by trusted clients is possible usi...

RHEL 9 : kernel (RHSA-2026:0457)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0457 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: SCTP...

CVE-2026-22250

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0...

CVE-2026-22250

CVE-2026-22250 affects the Weblate command-line client wlc . Prior to version 1.17.0, SSL verification could be skipped for certain crafted URLs, potentially allowing an attacker to access sensitive resources. Ubuntu USN-7981-1 summarizes the issue and notes an update is available; remediation is...

Improper Certificate Validation

Overview wlc is an A command-line utility for Weblate, translation tool with tight version control integration Affected versions of this package are vulnerable to Improper Certificate Validation in the SSL verification process. An attacker can intercept sensitive information by crafting malicious...

CVE-2025-71063

Errands before 46.2.10 does not verify TLS certificates for CalDAV servers...

EUVD-2026-1930

Errands before 46.2.10 does not verify TLS certificates for CalDAV servers...

CVE-2025-71063

The issue concerns Errands (pre-46.2.10) failing to verify TLS certificates when communicating with CalDAV servers, a trust-management vulnerability. Root cause: TLS certificate validation is omitted for CalDAV server connections, enabling exposure to misissued or invalid certificates. Impact det...

CVE-2025-71063

Errands before 46.2.10 does not verify TLS certificates for CalDAV servers...

layer-client (0.3.6), odahu-flow-mlflow-runner (1.4.0rc1) potentially affected by CVE-2025-14279 via mlflow (1.12.0)

mlflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.6 - odahu-flow-mlflow-runner 1.4.0rc1 Source cves: CVE-2025-14279 Source advisory: OSV:GHSA-PGQP-8H46-6X4J...

layer-client (0.3.5), sapsan (>=0.1.1, <=0.2.7) potentially affected by CVE-2025-14279 via mlflow (1.11.0)

mlflow PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.5 - sapsan =0.1.1, =0.2.7 Source cves: CVE-2025-14279 Source advisory: OSV:GHSA-PGQP-8H46-6X4J...

backwardcompatibilityml (>=1.4.0, <=1.4.2), layer-client (>=0.3.7b1, <=0.3.9) potentially affected by CVE-2025-14279 via mlflow (1.12.1)

mlflow PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - backwardcompatibilityml =1.4.0, =0.3.7b1, =0.3.9 Source cves: CVE-2025-14279 Source advisory: OSV:GHSA-PGQP-8H46-6X4J...

golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS

A flaw in golang.org/x/crypto/ssh/agent causes the SSH agent client to panic when a peer responds with the generic SSHAGENTSUCCESS 0x06 message to requests expecting typed replies e.g., List, Sign. The unmarshal layer produces an unexpected message type, which the client code does not handle,...

XSS in Chat Message Leads to Account Tackover

Description The vulnerability resides in the data persistence layer of the application. The fromdict method in the AppLollmsMessage class acts as a "sink" for raw data. It retrieves the content value from an input dictionary and assigns it directly to the object without any form of sanitization o...