Astra Linux – Vulnerability in Thunderbird, Firefox

By confusing the browser, the fullscreen notification could have been delayed or suppressed, leading to potential user confusion or spoofing attacks. This vulnerability affects Firefox versions earlier than 108...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: codel: The check sch-q.qlen was removed before the call to qdisctreereducebacklog. After making all -qlennotify calls idempotent, it is now safe to remove the check for qlen!=0 from both fqcodeldequeue and codelqdiscdequeue...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: switchdev: Converting the blocking notification chain to a raw one A blocking notification chain uses a read-write semaphore to protect the integrity of the chain. The semaphore is acquired for writing when adding/removing...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 6.17, and 7.0 contain AppArmor patches that incorrectly cause a sleep state when holding a spinlock in notification handling code. This bug can be triggered by an unprivileged local user, and can lead to kernel panic or deadlock situations...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1, Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: TLS: Fixed a race condition between the async notify and socket close operations. The thread that submitted the request the one that called recvmsg/sendmsg may exit as soon as the async crypto handler’s complete function is...

Astra Linux – Vulnerability in Firefox and Thunderbird

When resizing a popup after requesting fullscreen access, the popup does not display the fullscreen notification. This vulnerability affects Firefox 98, Firefox ESR 91.7, and Thunderbird 91.7...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 has an improper neutralization of line delimiters, which is relevant in non-default configurations that enable Delivery Status Notification DSN. Certain uses of ORCPT= can cause a new line to be inserted into a spool header file, thereby indirectly allowing unauthenticated...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - In the net:sched section, there is a fix for the order of qlen adjustment. - Changes to sch-q.qlen related to qdisctreereducebacklog need to occur before a call to that function. Otherwise, it may fail to notify the parent...

Astra Linux – Vulnerability in Linux 5.10

Ubuntu Linux 6.8, 6.17, and 7.0 contain AppArmor SAUCE patches that may potentially incorrectly calculate the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. This bug can be triggered by an unprivileged local user, and it can result in invali...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: Fixed a use-after-free in updatesuperwork when racing with unmount. The commit b98535d09179 “ext4: fix bugon in startthishandle during umount filesystem” moved ext4unregistersysfs before flushing ssbupdwork to prevent new...

EUVD-2026-77439

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

CVE-2026-78318 Apache Syncope: Unauthenticated reflected XSS in Console and Enduser

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

Astra Linux – Vulnerability in Firefox and Thunderbird

A website could have obscured the fullscreen notification by using a dropdown select input element. This could have caused user confusion and potentially led to spoofing attacks. This vulnerability affects Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8...

Astra Linux – Vulnerability in Thunderbird, Firefox

A website could have obscured the full-screen notification by using a URL that was processed by an external program, such as a mailto URL. This could have caused confusion among users and potentially led to spoofing attacks. This vulnerability affects Firefox 116, Firefox ESR 115.2, and Thunderbi...

PT-2026-91249

Name of the Vulnerable Software and Affected Versions a2aproject a2a-python versions prior to 1.1.4 Description A server-side request forgery issue exists in the Push Notification Sender component. The problem occurs within the dispatch notification function located in the src/a2a/server/tasks/ba...

CVE-2026-90790: Server-Side Request Forgery (SSRF)

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

CVE-2026-90782

S2OPC through 1.7.3 contains a null pointer dereference in msgsubscriptionpublishbsallocnotificationmessageitems where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions wit...

CVE-2026-90782

S2OPC through 1.7.3 contains a null pointer dereference in the function msg_subscription_publish_bs__alloc_notification_message_items(). The root cause is that a failed heap allocation for a DataChangeNotification is overwritten by a subsequent successful allocation for an EventNotificationList ,...

CVE-2026-90782 S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()

S2OPC through 1.7.3 contains a null pointer dereference in msgsubscriptionpublishbsallocnotificationmessageitems where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions wit...

CVE-2026-90782 S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()

S2OPC through 1.7.3 contains a null pointer dereference in msgsubscriptionpublishbsallocnotificationmessageitems where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions wit...