Astra Linux – Vulnerability in Linux 5.10, Linux

In rndisqueryoid in drivers/net/wireless/rndiswlan.c within the Linux kernel, from version 6.1.5 onwards, there is an integer overflow in a mathematical operation...

Astra Linux – Vulnerability in nss

The NSS code used for checking PKCS1 v1.5 was leaking information useful for launching Bleichenbacher-style attacks. Both the overall correctness of the padding and the length of the encrypted message were exposed through timing side-channels. By sending a large number of ciphertexts selected by...

CLSA-2026-1781657689 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 22 org.springframework packages to address 1 CVE. Fixed in 5.1.5.RELEASE-tuxcare.3...

PYSEC-2026-3607 proot-distro has a Container Isolation Bypass via Crafted Restore Archive

Affected Component - Package: proot-distro - Affected command: restore - Attack surface: Host-side Termux CLI processing a user-supplied backup archive - Vulnerability type: Container Isolation Bypass / Cross-Container Read and Write --- Affected Versions | Component | Version | |---|---| |...

CVE-2026-69247

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...

OPENSUSE-SU-2026:21487-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.57. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Oth...

UNIX Symbolic Link (Symlink) Following

Overview proot-distro is a PRoot-Distro is a lightweight rootless Linux container management utility built around proot. Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in the prootdistro/commands/install.py function and the equivalent process in...

CVE-2015-8778

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:46+00:00| seen| Telegram/nEfx4bkJlcldrL4ooYbVX-cKtKfFWPCKK6-GEAcf7FF 2026-07-30 00:02:02+00:00| seen| Telegram/nEfx4bkJlcldrL4ooYbVX-cKtKfFWPCKK6-GEAcf7FF 2026-08-01 15:00:04+00:00| seen|...

CVE-2026-66063 goshs has a Path Traversal issue

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This...

EUVD-2026-49228

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

PT-2026-63929

Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...

CVE-2026-44584

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified statu...

CVE-2026-47198 Paymenter: URL parameter injection bypasses paid plan limits at checkout

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because...

CVE-2026-63744 SurrealDB before 3.1.5 SSRF via JWKS URL Redirect

SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to...

CVE-2026-62764

Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but low-privileged user without system permissions may issue a remote command to gracefully shutdown system components compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver,...

CVE-2026-48795

AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.proto.polluted and constructor.prototype still caused lodash .set via @poppinss/utils to create...

CVE-2026-48795 Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser

AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.proto.polluted and constructor.prototype still caused lodash .set via @poppinss/utils to create...

EUVD-2026-43347

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Netrr Author Box WP Lens author-box-for-divi allows Stored XSS.This issue affects Author Box WP Lens: from n/a through = 2.1.5...

K000162183: Spring web services vulnerability CVE-2026-40996

Security Advisory Description Wss4jSecurityInterceptor defaulted allowRSA15KeyTransportAlgorithm to true, overriding Apache WSS4J's safer default for validation RequestData. Inbound WS-Security decryption could therefore accept RSA PKCS1 v1.5 rsa-15 encrypted key material unless operators...

CVE-2026-12924

Eventin WordPress plugin (WP Event Solution) ≤ 4.1.15 is vulnerable to Stored Cross‑Site Scripting via the etn_faq_content parameter due to insufficient input sanitization and output escaping. Exploitation requires contributor‑level authentication or higher, enabling injection of scripts that exe...