Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Block layer: Do not delete a queue kobject before its child kobjects are deleted. Kobjects are not supposed to be deleted before their child kobjects are deleted. Apparently, this is usually harmless; however, a warning will be...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: ipv4: Handled attempts to delete multipath routes when the fibinfo contains a reference to nh. Gwangun Jung reported a buffer-overflow vulnerability in fibnhmatch: fibnhmatch+0xf98/0x1130;...

Astra Linux – Vulnerability in Zabbix

A non-administrator user account on the Zabbix frontend, with the default User role, or any other role that grants API access, can exploit this vulnerability. There is an SQL injection vulnerability in the CUser class within the addRelatedObjects function. This function is called from the CUser.g...

Astra Linux – Vulnerability in json-smart

Json-smart is a performance-oriented JSON processor library. When encountering a ‘’ or ‘’ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limitations regarding the nesting of such arrays or objects. Since the parsi...

Astra Linux – Vulnerability in PostgresSQL 11

A flaw was discovered in PostgreSQL. There is an issue where insufficient efforts are made to ensure safe operation when a privileged user is managing objects of another user. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pgamcheck commands activate relevant...

Astra Linux – Vulnerability in wpa

A issue was discovered in Ubuntu wpasupplicant, resulting in the loading of arbitrary shared objects. This allows a local unprivileged attacker to escalate privileges to the user that wpasupplicant runs as usually root. Membership in the netdev group or access to the dbus interface of wpasupplica...

Astra Linux – Vulnerability in Thunderbird

When receiving an HTML email that contained an iframesrcdoc attribute to define the inner HTML document, remote objects specified in the nested document—such as images or videos—were not blocked. Instead, the network was accessed, the objects were loaded, and displayed. This vulnerability affects...

Astra Linux – Vulnerability in Samba

A vulnerability related to information leaks was discovered in Samba’s LDAP server. Due to missing access control checks, a authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store...

Astra Linux – Vulnerability in PostgresSQL 11

A vulnerability was discovered in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the...

Exploit for CVE-2026-38526

Nexus — Local Privilege Escalation PoC Gitea template-sync...

CVE-2023-29377

An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA objects and a file path to File OPC UA objects...

Linux Kernel QFQ Plus Scheduler Use-After-Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of qfqclas...

CVE-2023-29377

An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA objects and a file path to File OPC UA objects...

CVE-2026-55072: Improper Input Validation

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of...

CVE-2026-18069: Time-of-check Time-of-use (TOCTOU) Race Condition

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use TOCTOU race condition...

PT-2026-91398

Name of the Vulnerable Software and Affected Versions PyMuPDF versions prior to 1.28.3 Description A path traversal issue exists in the extract objects function within src/ main .py. The software constructs output filenames by joining a document-controlled BaseFont name to a user-supplied output...

PT-2026-91265

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magic links.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

Linux Kernel FUSE Subsystem Race Condition Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of fusereq...

Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. Furthermore, only systems with KSMBD enabled are vulnerable. The specific flaw exists within the handling of dirfp...

Linux Kernel OpenvSwitch Race Condition Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of dpmeter...