Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fixed a race condition in SNDCTLDSPSYNC There is a small race condition in the sndpcmosssync function, which is called from OSS PCM SNDCTLDSPSYNC ioctl. Specifically, the function calls sndpcmossmakeready first, a...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - tcp: tcpmakesynack can now be called from process context. - tcprtxsynack can now be called in process context, as explained in 0a375c822497 "tcp: tcprtxsynack can be called from process context". - tcprtxsynack may call...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via incomplete cleanup of uploaded files when a request is aborted before the storage engine assigns a file path. When an upload is aborted mid-flight, the finishAbort function in make-middleware.js snapshots only...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the appendField call in make-middleware.js when processing multipart form field names. An attacker submitting a malformed or invalid field name in a multipart upload request causes an unhandled exception that...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the appendField call in make-middleware.js when processing multipart form field names. An attacker can send a request containing an invalid field name that causes appendField to throw an uncaught exception,...

GO-2026-6122 GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS in github.com/gopacket/gopacket

GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation 104-byte UDP datagram - up to 16 GiB make - unauthenticated remote DoS in github.com/gopacket/gopacket...

CVE-2026-66485

GNU cpio is affected by an uncontrolled memory allocation in make_path (src/makepath.c) that uses alloca based on the length of argpath, derived from an archive-controlled pathname during extraction. A crafted cpio archive with a long nested pathname can trigger unbounded stack allocation, causin...

CVE-2026-66485

GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a...

CVE-2026-19373

A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to...

EUVD-2026-53188

The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/. This is due to the plugin's...

CVE-2026-67199

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...

CVE-2026-67199 Perspective 5.0.0 DoS via Loop Expression Evaluation

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...

CVE-2026-67199

CVE-2026-67199 affects Perspective 5.0.0. The vulnerability arises from evaluating an expression in a TableMakeViewReq message that can contain unbounded for/while loop constructs. An attacker can embed an arbitrarily large iteration count in a single expression column evaluated per table row, ca...

CVE-2026-67198

Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with ...

EUVD-2026-52692

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval with only...

CVE-2026-67195

CVE-2026-67195 describes a remote code execution in Perspective 5.0.0 via an eval() expression injection in the PolarsVirtualServer backend. The vulnerability occurs when client-supplied input is passed directly to Python’s eval() with almost no sandboxing (builtins cleared). Attackers can traver...

CVE-2026-64611

A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially...

PT-2026-63799

Name of the Vulnerable Software and Affected Versions libcupsfilters affected versions not specified Description A flaw in the cfIEEE1284NormalizeMakeModel function allows a network-adjacent attacker to cause a denial of service. The issue occurs when the function processes a printer-advertised...

MAL-2026-10991 Malicious code in make-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e6560048133cc76a9e325b02b2719f89d59c500d09409bb10b6f4afb14401 On import devhelper, the package's init.py starts a daemon thread that runs decryptor.decryptandrun: it fetches an AES-GCM key from the hardcoded...

Malicious code in make-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e6560048133cc76a9e325b02b2719f89d59c500d09409bb10b6f4afb14401 On import devhelper, the package's init.py starts a daemon thread that runs decryptor.decryptandrun: it fetches an AES-GCM key from the hardcoded...