Astra Linux – Vulnerability in dpkg

In dpkg, the Debian package management system, versions prior to 1.21.8, 1.20.10, 1.19.8, and 1.18.26 are vulnerable to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include debian.tar, the in-place extraction process may...

Astra Linux – Vulnerability in Chromium

In versions of Google Chrome on Android prior to 101.0.4951.41, the security interface in the Downloads section allowed a remote attacker to spoof the APK download dialog box through a crafted HTML page...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26, and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase method. This vulnerability occurs when the $sourceReference parameter is appended to a shell command without proper escaping...

Astra Linux – Vulnerability in edk2

EDK2’s Network Package is vulnerable to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of confidentiality...

Astra Linux – Vulnerability in rpm

A flaw was discovered in RPM’s signature check functionality when reading a package file. This flaw allows an attacker who can persuade a victim to install a seemingly verifiable package, whose signature header was modified, to cause corruption of the RPM database and execute malicious code. The...

CLSA-2026-1789384355 TuxCare security update for 204 packages (1 CVE)

TuxCare rebuilt 204 packages to address 1 CVE. Fixed in 2.28.0-tuxcare.1...

@aliceo2/bookkeeping (>=1.19.0, <=1.20.0), @beyondnet/evolith-cli (>=1.2.0, <=1.3.2) +68 more potentially affected by CVE-2026-88932 via multer (>=2.2.0, <=2.3.0)

multer NPM version =2.2.0, =1.19.0, =1.2.0, =1.2.0, =2026.7.0, =5.7.5, =11.1.29-depup.0, =0.1.0, =0.1.0, =11.0.62, =1.2.34, =12.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2026-88932 Source advisory: SNYK:JS-MULTER-19785644...

ROOT-APP-NPM-CVE-2026-44489 CVE-2026-44489 in axios - Patched by Root

Root has patched CVE-2026-44489 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-63376 CVE-2026-63376 in toml - Patched by Root

Root has patched CVE-2026-63376 in the toml package for Root:npm. Multiple fixed versions available...

CLSA-2026-1789379074 TuxCare security update for io.netty (22 CVEs)

TuxCare rebuilt 46 io.netty packages to address 22 CVEs. Fixed in 4.1.79.Final-tuxcare.4...

CLSA-2026-1789377089 TuxCare security update for org.springframework (4 CVEs)

TuxCare rebuilt 23 org.springframework packages to address 4 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.5...

ROOT-APP-NPM-CVE-2026-42040 CVE-2026-42040 in axios - Patched by Root

Root has patched CVE-2026-42040 in the axios package for Root:npm. Multiple fixed versions available...

CLSA-2026-1789376303 TuxCare security update for 4 packages (1 CVE)

TuxCare rebuilt 4 packages to address 1 CVE. Fixed in 3.2.11-tuxcare.5...

CLSA-2026-1789369685 TuxCare security update for org.springframework.graphql (1 CVE)

TuxCare rebuilt 2 org.springframework.graphql packages to address 1 CVE. Fixed in 1.2.9-tuxcare.6...

CLSA-2026-1789368896 TuxCare security update for 2 packages (1 CVE)

TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 2.22.4.post9+tuxcare...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

[SECURITY] Fedora 45 Update: rust-hickory-net-0.26.2-1.fc45

Hickory-net is a safe and secure low-level DNS library. This is the foundational DNS protocol library used by the other higher-level Hickory DNS crates...

Malicious code in faiss-cpu-avx512 (PyPI)

[email protected] through 1.9.7 on PyPI impersonates faiss-cpu and ships no FAISS code: faisscpuavx512/init.py fetchnative downloads an xz-compressed binary from https://files.catbox.moe/ ffoa50.xz in 1.9.0 to 1.9.3, 0oreqo.xz in 1.9.4, vwfr94.xz in 1.9.5, 3l3x0v.xz in 1.9.6, weu5u2.xz in...

CVE-2026-89021: Improper Link Resolution Before File Access

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit...