Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: “spufs”: fixed a leak related to the failure of spufsnewfile. This issue is triggered from spufsfilldir, and the caller of that function will call spufsrmdir in case of failure. This action removes everything we’ve managed to...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: scsi: smartpqi: Fixed a memory leak in pqireportphysluns The pqireportphysluns function fails to release the rpllist buffer when encountering an unsupported data format or when the allocation for rpl16bytewwidlist fails. These...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fixed a reference count leak in dmardevscopeinit. The function foreachpcidev is implemented by pcigetdevice. The comment accompanying pcigetdevice states that it will increase the reference count of the returned pcide...

Astra Linux – Vulnerability in curl

When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3, or SMTP scheme, curl may incorrectly pass the bearer token to the new target host...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: fix ofiomap memory leak Matching reports: drivers/clk/mediatek/clk-mtk.c:583 mtkclksimpleprobe warning: ‘base’ from ofiomap is not released on lines: 496. This issue was also found in linux-next. In...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Thermal: int340x: fixed a memory leak in int3400notify The following memory leaks are likely to occur on my TigerLake platform: Unreferenced object: 0xffff927c8b91dbc0 size 32 Details: comm “kworker/0:2”, pid 112, jiffies...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: NFC: st21nfca – A memory leak was fixed in the device probe, and the phy-pendingskb variable was properly freed after allocation. However, it was forgotten to be freed during the error handling and removal processes, resulting in...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: usb: host: xhci: Fixed a potential memory leak in xhciallocstreaminfo The xhciallocstreaminfo function allocates a stream context array for streaminfo-streamctxarray using xhciallocstreamctx. When an error occurs, the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/ipv6: release expired exception dst cached in socket The Dst objects are leaked in ip6negativeadvice, when this function is executed for an expired IPv6 route located in the exception table. There are several conditions that...

CVE-2025-24071_PoC

CVE-2025-24071PoC CVE-2025-24071: 通过RAR/ZIP提取和.library-ms文件导致的NTLM哈希泄露 当从.rar存档中提取.library-ms文件时，Windows Explorer会自动发起SMB身份验证请求，导致NTLM哈希泄露。用户无需打开或执行该文件——只需提取就足以触发泄露。 博客文章: https://cti.monster/blog/2025/03/18/CVE-2025-24071.html 用法 root@kitploit: python poc.py enter file name: your file name enter...

NanoMQ-Memory-Leak-Research

CVE-2026-36590：EMQ NanoMQ v0.24.9 中的拒绝服务漏洞 本仓库包含 CVE-2026-36590 的公开公告和技术分析，这是一项影响 EMQ NanoMQ v0.24.9 的拒绝服务漏洞。 审核说明 本仓库公开旨在为 CVE 审核提供可访问的技术参考。CVE-2026-36590 的最终分类将由 CVE 团队或相关 CNA 决定。 NanoMQ 团队对该问题提出异议，并认为其与配置相关。本仓库侧重于技术证据，包括复现材料、ASAN 结果、运行时日志和源码分析。 公告信息 CVE ID：CVE-2026-36590 厂商/项目：EMQ / NanoMQ...

CVE-2025-44203

CVE-2025-44203：HotelDruid 3.0.0 / 3.0.7 敏感信息泄露与拒绝服务 摘要 HotelDruid 3.0.0 和 3.0.7 在 creadb.php 设置端点上存在一个竞争条件，该端点在设置完成前可被访问。它有两种影响，均源于同一次掉入的竞争：敏感信息泄露（通过详细的 SQL 错误消息）和拒绝服务。 通过一次性发送大量 POST 请求，攻击者可触发竞争条件并从响应中读取敏感数据，包括管理员用户名、密码哈希和盐值。如果在 Debian 软件包配置期间选择的密码较弱，则可通过词表离线恢复。...

CVE-2026-2991

KiviCare = 4.1.2 - 身份验证绕过 CVE-2026-2991 PoC 📜 描述 CVE-2026-2991 是 KiviCare – Clinic & Patient Management System EHR WordPress 插件中的一个身份验证绕过漏洞，影响所有版本直至并包括 4.1.2 。 该插件在 /wp-json/kivicare/v1/auth/patient/social-login 暴露了一个公开的 REST 端点，用于通过社交登录对用户进行身份验证。patientSocialLogin...

Security update for strongswan

This update for strongswan fixes the following issues: CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7 Containers bsc1276534. CVE-2026-78126: NULL-Pointer Dereference When Handling...

SUSE-SU-2026:4152-1 Security update for strongswan

This update for strongswan fixes the following issues: - CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. - CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7 Containers bsc1276534. - CVE-2026-78126: NULL-Pointer Dereference When Handling...

SUSE-SU-2026:4147-1 Security update for strongswan

This update for strongswan fixes the following issues: - CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. - CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7 Containers bsc1276534. - CVE-2026-78126: NULL-Pointer Dereference When Handling...

Security update for strongswan

This update for strongswan fixes the following issues: CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7 Containers bsc1276534. CVE-2026-78126: NULL-Pointer Dereference When Handling...

SUSE-SU-2026:4146-1 Security update for strongswan

This update for strongswan fixes the following issues: - CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. - CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7 Containers bsc1276534. - CVE-2026-78126: NULL-Pointer Dereference When Handling...

Security update for strongswan

This update for strongswan fixes the following issues: CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7 Containers bsc1276534. CVE-2026-78126: NULL-Pointer Dereference When Handling...

Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users

A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service. The extension, named "Twitch Enhanced Viewer | JeetBot," lists HISHIMIRO/jeetbot.cc as its developer and has the following...