Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: nfsd: Do not replace a page in the rqpages array if it is a continuation of the last page. The splice read function calls nfsdspliceactor to place the pages containing file data into the svcrqst-rqpages array. However, it is...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: VDUSE: Avoid leaking information to userspace. The bouncing of memory pages does not necessarily require page alignment; therefore, current VDUSE may still leak kernel information by mapping bounce pages to userspace. Allocate...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: fs/proc/taskmmu: No warnings are displayed when encountering non-migration PMD entries. The patch series “mm/hmm: A fix and a selftest”, version 3. Patch 1 fixes a stale warning that existed before, when only migration softleaf...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: EROFs: Avoid linking hooked chains to prevent loops in deduplicated compressed images. After subjecting EROFS to heavy stress using several images that included a handcrafted image with repeated patterns for over 46 days, I...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid repeated requests to allocate WC pages. Applications can request multiple WC pages for the same ucontext. Currently, only 1 WC page per ucontext is supported. Add a lock to avoid concurrent access, and implemen...

CVE-2026-74632

A flaw was found in the Linux kernel's memory management mm/hugememory. A race condition can occur between a memory shrinker and a concurrent page fault when handling huge zero pages. This race can lead to the hugezeropfn being incorrectly set, causing the huge zero page to be misidentified as an...

CVE-2026-55468: Improper Handling of Insufficient Permissions or Privileges

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-78185: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/custedit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used...

EUVD-2026-64607

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

CVE-2026-0551: Deserialization of Untrusted Data

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

CVE-2026-0551 PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

CVE-2026-0551

PPWP – Password Protect Pages (WordPress plugin) is vulnerable to PHP Object Injection in all versions up to and including 1.9.18 . The flaw stems from deserialization of untrusted input via the post_protection_roles parameter, exploitable by any authenticated user with Contributor-level access o...

CVE-2026-74634

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

Malicious Package

Overview lumen-pages-community is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-79721

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A locally exploitable issue exists in the amdxdna insert pages function. The vm flags mod function sets VM MIXEDMAP and clears VM PFNMAP. If an unprivileged userspace process maps a...

Malicious code in lumen-pages-community (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7c1d6b7b99791f7bbd5999021f109bef569a6c681eda0bb6196b459b12a3808 [email protected] declares a postinstall hook node dc.js that runs automatically on npm install. dc.js collects the installer's hostname,...

MAL-2026-14356 Malicious code in lumen-pages-community (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7c1d6b7b99791f7bbd5999021f109bef569a6c681eda0bb6196b459b12a3808 [email protected] declares a postinstall hook node dc.js that runs automatically on npm install. dc.js collects the installer's hostname,...

CVE-2026-31803

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3...

Krawl v2.3.0

Krawl A modern, customizable web honeypot server designed to detect and track malicious activity from attackers and web crawlers through deceptive web pages, fake credentials, and canary tokens. Table of Contents Demo What is Krawl? Krawl Dashboard Deployment Modes Krawl Banlist Quickstart Docker...

CVE-2026-30819

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting XSS vulnerability in its dashboard revert functionality with the parameter dashboardid in /pages/ajax.render.php. This issue has been fixed in version 3.2.3...