Astra Linux – vulnerability in node-minimatch

Minimatch is a minimal matching utility designed to convert glob expressions into JavaScript RegExp objects. Versions 10.2.0 and earlier are vulnerable to Regular Expression Denial of Service ReDoS when a glob pattern contains multiple consecutive wildcards followed by a literal character that do...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL deref in cifscomposemountoptions The optional @ref parameter might contain a NULL nodename; therefore, prevent dereferencing it in cifscomposemountoptions. Addresses-Coverage: 1476408 “Explicit null dereference...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: Avoid cycles in the h-tree A maliciously corrupted filesystem can contain cycles in the h-tree stored inside a directory. This can easily lead to the kernel corrupting tree nodes that have already been verified during...

CVE-2026-109449

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property access...

CVE-2026-109449

The symfony/expression-language component is vulnerable to a Denial of Service (DoS) attack due to unbounded nesting in its expression parser. Specifically, expressions containing tens of thousands of nested unary operators, array literals, binary operators, or property accesses can cause the PHP...

CVE-2026-109449 Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property access...

CVE-2026-109449

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property access...

SUSE CVE-2026-98415

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setupcpuhpandcpuidle parses the device tree node for the interrupt generation block via ofparsephandle and decrements its reference count using ofnodepu...

CVE-2026-98390

A flaw was found in the Linux kernel. When running in certain virtualized environments, an unexpected hardware topology reported by the hypervisor can cause the AMD node initialization logic to calculate a divisor of zero. This condition triggers an unhandled divide-by-zero error during system...

Malicious code in @flexmr/ui (npm)

@flexmr/[email protected] runs node beacon.js preinstall, node beacon.js install, and node beacon.js postinstall during installation. These lifecycle scripts send the package name, lifecycle event, a fixed token, and host identity details to 177.7.60.239:48080 and encode the hostname in a DNS query und...

CLEANSTART-2026-YH75013 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node

CVE-2026-85525 affects multiple packages. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node. See references for individual vulnerability details...

CLEANSTART-2026-VH65256 node-tar is a tar archive manipulation library for Node

CVE-2026-59871 affects multiple packages. node-tar is a tar archive manipulation library for Node. See references for individual vulnerability details...

CLEANSTART-2026-XE70573 node-tar is a tar archive manipulation library for Node

CVE-2026-59875 affects multiple packages. node-tar is a tar archive manipulation library for Node. See references for individual vulnerability details...

CLEANSTART-2026-QG39895 undici's WebSocket client crashes the whole Node

CVE-2026-19534 affects multiple packages. undici's WebSocket client crashes the whole Node. See references for individual vulnerability details...

CLEANSTART-2026-KX94176 node-tar is a tar archive manipulation library for Node

CVE-2026-59873 affects multiple packages. node-tar is a tar archive manipulation library for Node. See references for individual vulnerability details...

CLEANSTART-2026-FT30855 node-tar is a tar archive manipulation library for Node

CVE-2026-73566 affects multiple packages. node-tar is a tar archive manipulation library for Node. See references for individual vulnerability details...

CLEANSTART-2026-RB55722 node-tar is a tar archive manipulation library for Node

CVE-2026-59874 affects multiple packages. node-tar is a tar archive manipulation library for Node. See references for individual vulnerability details...

CLEANSTART-2026-AO11552 node-tar is a full-featured Tar for Node

Security vulnerability affects the renovate package. node-tar is a full-featured Tar for Node...

EUVD-2026-101728

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an...

EUVD-2026-101733

n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to...