Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: i3c: Added a NULL pointer check in i3cmasterqueueibi The I3C master driver may receive an IBI from a target device that has not been probed yet. In such cases, the master calls i3cmasterqueueibi to queue an IBI work task, leading...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: crypto: ccp – Fixed null pointer dereference in sevplatformshutdownlocked. The SEV platform device can be shut down with a null pspmaster, for example, by using DEBUGTESTDRIVERREMOVE. This issue was identified using KASAN:...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: anysee: fixed the null-ptr-deref in anyseemasterxfer. In anyseemasterxfer, msg is controlled by the user. When msgi.buf is null and msgi.len is zero, previous checks on msgi.buf will still be performed. Malicious data will...

Astra Linux – Vulnerability in LibreOffice

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted using a single master key provided by the user. There was a flaw in LibreOffice where the master key was poorly encoded, resulting in a reduction in its entro...

Astra Linux – Vulnerability in Thunderbird

OpenPGP secret keys that were imported using Thunderbird versions 78.8.1 up to 78.10.1 were stored unencrypted on the user’s local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automaticall...

apollo-sdk (>=0.1.1, <=0.1.6), bell-nozzle-master (1.0.8) +5 more potentially affected by CVE-2026-15307 via django (4.1.2)

django PYPI version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - apollo-sdk =0.1.1, =3.11.6, =0.61.0, =0.62.0 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

CVE-2026-79898

Fortra BoKS Manager contains a command injection vulnerability in the crlserver component. An authenticated user with permission to add CRL URLs via BCC , the WSI REST or SOAP API , or the cacrl command-line interface can trigger shell command substitution. This allows the attacker to execute com...

AlmaLinux 9.2 [TuxCare] Security Update: redis / redis-devel / redis-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778845249)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778845249 advisory. - Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can...

Rocky Linux 9.6 [TuxCare] Security Update: redis / redis-devel / redis-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778616298)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778616298 advisory. - Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can...

Rocky Linux 9 [CIQ] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (crlsa-2023_0304)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230304 advisory. libreoffice: Macro URL arbitrary script execution CVE-2022-3140 libreoffice: Execution of Untrusted Macros Due to Improper Certificate Validation...

CVE-2026-97289

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6...

CVE-2026-97289 WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6...

EUVD-2026-89930

Unauthenticated Cross Site Scripting XSS in Quiz And Survey Master = 11.2.6 versions...

CVE-2026-97289

The Quiz And Survey Master plugin for WordPress versions

WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin Quiz And Survey Master versions = 11.2.6...

CVE-2026-97289: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Quiz And Survey Master = 11.2.6 versions...

PT-2026-103262

Name of the Vulnerable Software and Affected Versions Quiz And Survey Master versions prior to 11.2.7 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update Quiz And...

CVE-2026-97515

A flaw was found in the Linux kernel's I3C Improved Inter-Integrated Circuit master driver. On affected hardware, when a target device on the bus holds the data line low, the controller triggers an interrupt feedback loop during recovery attempts. This issue creates an interrupt storm that can...

CVE-2026-98140

A flaw was found in the Linux kernel's NTFS file system. A local user could trigger this vulnerability during error handling in Master File Table MFT write operations, where temporary kernel memory mappings fail to be released properly. Because these local memory mappings require strict ordering,...

CVE-2026-93283

A flaw was found in the Linux kernel's I3C Improved Inter-Integrated Circuit master subsystem. This issue can result in a Denial of Service DoS caused by a system crash. When device registration fails, the driver frees the device object but fails to clear internal pointers referencing the freed...