CVE-2026-53524

A flaw was found in WeeChat. An authenticated user of the relay module's WebSocket functionality can send a small compressed frame that, when decompressed, expands to a significantly larger size. This "decompression bomb" can exhaust all available server memory, leading to a Denial of Service DoS...

Security Bulletin: Langflow is affected by weaknesses in secret handling and sensitive configuration access

Summary Langflow includes features for secret protection, environment access, and runtime configuration of workflow components. Weaknesses in cryptographic key handling, exposure of process environment values, and insufficient restriction of sensitive runtime configuration fields could allow...

Security Bulletin: Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Summary Langflow OSS supports Agentic Assistant generated components and user-supplied custom Python components for workflow development. Weaknesses in code security scanning, runtime validation, custom component execution paths, and trusted code enforcement could allow authenticated users to...

kernel: dlm: validate length in dlm_search_rsb_tree

A flaw was found in the Linux kernel's Distributed Lock Manager dlm module. An attacker could send specially crafted network messages with an oversized length parameter to the dlmdumprsbname function. This lack of validation can lead to an out-of-bounds write in the dlmsearchrsbtree function,...

CVE-2026-74603

A flaw was found in the Linux kernel's ptp: ocp module. This vulnerability occurs because the EEPROM board ID, a fixed-size field, is not guaranteed to be null-terminated. When this ID is processed as a C string, it may lead to an over-read beyond its intended memory boundary. This memory...

CVE-2026-68765

A flaw was found in hashcat. Attackers can exploit a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module by providing an oversized ninth hash field token. The module processes input up to 600 hexadecimal characters into a fixed 256-byte buffer without proper length validation...

Important: Red Hat Security Advisory: python3.14 security update

An update for python3.14 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

nanoid: nanoid: Denial of Service via negative size input in non-secure module functions

A flaw was found in nanoid Nano ID, a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a negative size input to the customAlphabet or nanoid functions within the library's non-secure module. When a...

CVE-2026-74727

A flaw was found in the Linux kernel's ovpn module. A race condition can occur when an OpenVPN ovpn peer is removed concurrently while the system attempts to rehash it. This can lead to the peer being re-inserted into internal tables after it has been logically removed, creating a Use-After-Free...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: f2fs: A fix was made to prevent race conditions during the fsyncentryslab access by multiple f2fs filesystem instances. As reported by syzbot, there is a use-after-free issue during f2fs recovery: A use-after-free occurs when...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: cifs: Fixed an issue where credits were not updated upon failure in cifsissueread. Fixed an issue where the credits value was not updated during a failed execution of cifsissueread, so that retrying the subreq would not...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: rxrpc: Fixed a potential infinite loop in rxrpcrecvmsg. Also, fixed the wait in rxrpcrecvmsg by checking the OOB queue...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: alloctag: Fixed a use-after-free in /proc/allocinfo after module unloading. The allocinfostart function only reinitializes the codetag iterator at position 0. For subsequent reads positions 0, it reuses the cached iterator state...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: liveupdate: Fixed issues in luofileunpreservefiles and luofilefinish. In luofileunpreservefiles and luofilefinish, the calls to moduleput and xaerase were reordered to ensure that the file handling module remains pinned while...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xen: Speed up grant-table reclaim When a grant entry is still in use by the remote domain, Linux must put it on a deferred list. Normally, this list is very short, because the PV network and block protocols expect the backend to...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed a UAF Use-After-Free issue caused by a race between btftrygetmodule and loadmodule. While working on code to populate the BTF IDs for modules during their initialization, I noticed that by the time the initialization...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: ipa: Hash tables are only reset when supported. Last year, the code that manages GSI channel transactions switched from using spinlock-protected linked lists to using indexes in the ring buffer used for a channel. Recently,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, for the dsa interface, in the mxl862xx module, there was a issue where the DSA ports were freed after they had been used. Upon a MDIO CRC error, the mxl862xxcrcerrworkfn function iterates through the DSA por...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net:sfc: Fixed issues with non-freezed interrupts in legacy IRQ mode. The SFC driver can be configured using modparam to work with MSI-X, MSI, or legacy IRQ interrupts. In the latter case, the interrupt wasn’t properly released...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ntfs: Freeing volume-wide resources upon a fillsuper failure The erroutnow path in ntfsfillsuper only frees the volume struct via kfreevol. Several resources owned by the volume are left behind upon each mount failure: -...