Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-47 and 7.1.2-22, a missing check in the MNG encoder allowed the possibility of reading more images than the list limit allowed, resulting in excessive resource usage. This issue...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Before versions 7.1.2-15 and 6.9.13-40, when a PCD file did not contain a valid Sync marker, the DecodeImage function would get stuck in an infinite loop while searching for the Sync marker. This caused...

Astra Linux – Vulnerability in Tomcat9

A missing critical step in the authentication process in Apache Tomcat’s vulnerability allows attackers to authenticate without providing the correct password. This issue affects Apache Tomcat versions ranging from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: Missing check for virtio Two missing checks in virtionethdrtoskb allowed syzbot to crash kernels again. 1. After the skbsegment function, the buffer may become non-linear nrfrags != 0. However, since the SKBTXSHAREDFRAG...

Astra Linux – Vulnerability in Chromium

Missing authorization in the FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and utilized social engineering to obtain sensitive information through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and utilized social engineering to potentially obtain sensitive information through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Thermal: int340x: Added a NULL check for adev. Not all devices have an ACPI companion fwnode; therefore, adev may be NULL. This is similar to the change made in commit cd2fd6eab480 “platform/x86: int3472: Check for adev == NULL”....

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: For the clk subsystem, in the qcom module, there is a issue where gcc-sm6350 uses parentmap for two clocks that actually doesn’t exist. If a clkrcg2 has a parent, it should also have the parentmap property defined. Otherwise, a...

Astra Linux – Vulnerability in Chromium

Missing authorization in the FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Missing authorization in the Sensor component of Google Chrome prior to version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive information through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Missing authorization in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leverage social engineering to obtain sensitive information through UI interaction. Chromium security severity: Medium...

CVE-2026-39783

The WP SYNTEX Polylang plugin (versions n/a through 3.8.7 ) is vulnerable to a Missing Authorization vulnerability (CWE-862 ). This flaw allows an attacker to Retrieve Embedded Sensitive Data . No specific exploit details or remediation steps are provided in the documents.

CVE-2026-39783 WordPress Polylang plugin <= 3.8.7 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7...

CVE-2026-39783 WordPress Polylang plugin <= 3.8.7 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7...

EUVD-2026-92424

Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7...

EUVD-2026-92423

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25...

CVE-2026-105307

A vulnerability exists in Casdoor up to version 3.161.1 involving the API Endpoint component. The issue resides in the ApiFilter function located within the routers/authz_filter.go file, where a manipulation can lead to missing authentication . This flaw allows for remote attacks. While an exploi...

CVE-2026-105307 Casdoor API Endpoint authz_filter.go ApiFilter missing authentication

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authzfilter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...

CVE-2026-105307 Casdoor API Endpoint authz_filter.go ApiFilter missing authentication

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authzfilter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...

EUVD-2026-92415

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authzfilter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...