Astra Linux – Vulnerability in Chromium

In Google Chrome on the Chrome OS, the use of “after free” in Tablet Mode before version 102.0.5005.61 allowed a remote attacker who convinced a user to engage in certain user interactions to potentially exploit heap corruption through those interactions...

Astra Linux – Vulnerability in Chromium

Before version 98.0.4758.80, using “after free” in Reader Mode in Google Chrome allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption through a crafted HTML page...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: fixed a transaction abort during file creation due to name hash collisions. If we attempt to create several files with names that result in the same hash, we must package them in the same directory item, and there is a...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in several Ansible modules, where parameters containing credentials, such as “secrets,” were logged in plain text on managed nodes, and were also made visible on the controller node when run in verbose mode. These parameters were not protected by the “nolog” feature. An...

CVE-2026-38924

In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a...

Vulnerability in Cosminexus Component Container

Overview Cosminexus Service Coordinator, which uses the SOAP communication infrastructure of Cosminexus Component Container, contains an XXE XML External Entity vulnerability in user-defined reception services SOAP reception services or SOAP adapters operating in SOAP 1.1 mode. Impact Regarding t...

CVE-2026-38924

CVE-2026-38924 affects Oraios AI Serena prior to 1.0.0 , where the MCP server in HTTP mode binds its listen address to 0.0.0.0 (all interfaces) rather than 127.0.0.1. The supplier acknowledged this as a "potential security hazard," though documentation at the time recommended running Serena in a ...

CVE-2026-38924

In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a...

PT-2026-91835

The backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowed classes restriction. Any code path that could write to a widget. session key with attacker-controlled bytes could trigger PHP object injection the next time the...

EUVD-2026-77175

In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a...

CVE-2026-85921: Double Free

Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

PT-2026-91277

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safe mode is enabled. The Laravel session store was exposed to Twig with unrestricte...

PT-2026-91030

In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a...

CVE-2026-38924

In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a...

CVE-2026-38924

In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a...

Amazon Linux 2023 : bouncycastle, bouncycastle-javadoc, bouncycastle-mail (ALAS2023-2026-2153)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2153 advisory. In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross- nonce AEAD forgery. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

EUVD-2026-76925

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...

PT-2026-91278

Name of the Vulnerable Software and Affected Versions October CMS versions prior to 3.7.17 October CMS versions prior to 4.2.21 Description The backend SessionMaker trait stores widget session state using base64serialize... and processes it with the unserialize function without an allowed classes...

CVE-2026-90651

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...

CVE-2026-90651

Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...