RHEL 9 : leapp-repository (RHSA-2026:67609)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67609 advisory. Repositories for leapp Security Fixes: leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scanmysql runs mysqld --validate- config ...

PT-2026-92195

pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of pdfforge PDF Architect. An attacker must first obtain the ability to...

CVE-2026-54559 PocketSphinx: Buffer overflows in language and acoustic model loading code

PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in src/lm/ngrammodeltrie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format headers, and the acoustic-model loaders in src/mdef.c and src/util/bio.c use sscanf with unbounded...

CVE-2026-54559

PocketSphinx (a lightweight speech recognizer, including its Python bindings) versions 5prealpha through 5.1.0 are affected by buffer overflow vulnerabilities in its model-loading code. The trie language-model loaders in src/lm/ngram_model_trie.c fail to validate boundary conditions in ARPA, DMP,...

CVE-2026-54559 PocketSphinx: Buffer overflows in language and acoustic model loading code

PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in src/lm/ngrammodeltrie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format headers, and the acoustic-model loaders in src/mdef.c and src/util/bio.c use sscanf with unbounded...

CVE-2026-55832 Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled externaldata location from an ONNX model through onnx/src/tensor.rs getexternalresources and joins the value to the model...

CVE-2026-90949

A flaw was found in GIMP's PSP Paint Shop Pro file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting...

Astra Linux – Vulnerability in curl

This flaw allows an attacker to insert cookies into a running program using libcurl, provided that certain conditions are met. Libcurl performs transfers. In its API, an application creates “easy handles”—individual handles used for single transfers. Libcurl provides a function called...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Remove the user-triggered WARN message emitted by nestedsvmloadcr3. Remove the WARN message generated by svmsetnestedstate in nestedsvmloadcr3 failure cases. This message can be easily triggered from userspace by...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in sndsocremovepcmruntime The function sndsocremovepcmruntime might be called with rtd == NULL, which will lead to a null pointer derefrence. This issue was reproduced when topology loading was...

Astra Linux – Vulnerability in zsh

In Zsh before version 5.8, attackers who were able to execute commands could regain privileges lost due to the --no-PRIVILEGED option. Zsh failed to overwrite the saved user ID, so the original privileges could be restored by executing MODULEPATH=/dir/with/module zmodload with a module that calls...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: comedi: medaq: Fixed the potential overflow of the firmware buffer. The function me2600xilinxdownload loads the firmware requested by requestfirmware. It is possible for this process to overflow the source buffer due to the...

Astra Linux – Vulnerability in Firefox

If an attacker loads a font using FontFace on a background worker, a use-after-free might occur, resulting in a potentially exploitable crash. This vulnerability affects Firefox versions earlier than 107...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: carl9170 – added a proper sanity check for endpoints. Syzkaller reports that a warning was triggered due to the presence of an incorrect endpoint type during the URB processing stage. Although a check was performed for a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: AppArmor: Fixed the issue where an unprivileged local user could perform privileged policy management. An unprivileged local user can load, replace, and remove policies by opening the AppArmor interfaces. This can be achieved...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Always wait for both attempts at firmware loading. In rtwwaitfirmwarecompletion, always wait for both regular and wowlan firmware loading attempts. Otherwise, if rtwusbintfinit fails in rtwusbprobe, rtwusbdisconnect...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: libertas – fixed a warning in the usbtxblock function. The function usbtxblock submits cardp-txurb without ensuring that any previous transmissions on this URB have been completed. If a second call occurs while the URB is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: comedi: me4000: Fix potential overrun of the firmware buffer The function requestfirmware requests the firmware that needs to be downloaded. It is possible for this process to exceed the source buffer’s capacity due to reliance o...

CVE-2026-90955 MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state...

CVE-2026-90955 MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load

Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. The shell is designed to run actions as a supplied MISP user ID. However, the legacy SysLogLogable behavior stored that identity in behavior-instance state...