Astra Linux – Vulnerability in Firefox and Thunderbird

A website could have obscured the fullscreen notification by using a dropdown select input element. This could have caused user confusion and potentially led to spoofing attacks. This vulnerability affects Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8...

Astra Linux – Vulnerability in Firefox

The z-order of browser windows can be manipulated to hide the fullscreen notifications. This could potentially be used to carry out a spoofing attack. This vulnerability has been fixed in Firefox 135 and Thunderbird 135...

Astra Linux – Vulnerability in Thunderbird, Firefox

A website could have obscured the full-screen notification by using the file open dialog. This could have caused confusion among users and potentially led to spoofing attacks. This vulnerability affects Firefox 116, Firefox ESR 115.2, and Thunderbird 115.2...

Astra Linux – Vulnerability in Thunderbird, Firefox

A website could have obscured the full-screen notification by using a URL that was processed by an external program, such as a mailto URL. This could have caused confusion among users and potentially led to spoofing attacks. This vulnerability affects Firefox 116, Firefox ESR 115.2, and Thunderbi...

Astra Linux – Vulnerability in Firefox

The fullscreen notification is prematurely hidden when the user quickly requests fullscreen again. This vulnerability could have been exploited to carry out a spoofing attack. This issue has been fixed in Firefox 135 and Thunderbird 135...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: iwlwifi: mvm – Do not read beyond the mfuart notification. In the event that the firmware sends a notification claiming to have more data than it actually does, we will read beyond the allocated space for the notification. ...

Astra Linux – Vulnerability in Firefox

Selected options might obscure the full-screen notification dialog box. This could be exploited by a malicious site to carry out a spoofing attack. This vulnerability affects Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1...

PT-2026-80872

CVE-2025-37654 Patch https://t.co/87BYrglZYN Vulnerability Notification: https://t.co/xhLrNnfyrO...

PT-2026-80906

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

PT-2026-80825

Name of the Vulnerable Software and Affected Versions Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions prior to 1.7.2 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions...

CVE-2026-74711

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute to a struct sensordeviceattribute:...

CVE-2026-74711

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute to a struct sensordeviceattribute:...

CVE-2026-74711

A type confusion vulnerability in the Linux kernel's hwmon/pmbus driver (drivers/hwmon/pmbus/pmbus_core.c) arises in pmbus_notify(), which unconditionally casts every attribute in data->group.attrs to struct sensor_device_attribute. When the attribute is actually a struct pmbus_samples_reg, th...

CVE-2026-74711 hwmon: (pmbus) Fix type confusion in notification logic

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute to a struct sensordeviceattribute:...

Linux Distros Unpatched Vulnerability : CVE-2026-74711

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: pmbus Fix type confusion in notification logic Sashiko reports: At the start of the loop in pmbusnotify, the code unconditionally casts every attribute ...

CVE-2026-63466

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...

CVE-2026-35163 OctoPrint: XSS in Suppressed Command Notifications

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML...

EUVD-2026-64042

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...

CVE-2026-63466

Unleash (open-source feature management platform) is affected by a global Mustache.escape override in versions prior to 8.0.3 . The FeatureEventFormatterMd.format function in feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering templates. Because this ass...

CVE-2026-63466 Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...