Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: solo6x10: Check for out-of-bounds chipid access. Clang with CONFIGUBSANSHIFT=y noticed a condition where a signed type e.g., the literal 1 is treated as an int might be shifted beyond 32 bits. As a result, instrumentation...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1, and Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: usbnet: Fixed the issue involving the use of smpprocessorid in preemptible code. Syzbot reported the following warning: BUG: Using smpprocessorid in preemptible 00000000 code: dhcpcd/2879. Caller: usbnetskbreturn+0x74/0x490,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: exfat: The allocation bitmap’s cluster allocation bits need to be validated. The syzbot exploit created an exfat image with cluster bits not set for the allocation bitmap. The exfat-fs module reads and uses the allocation bitmap...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ethtool: Do not perform operations on net devices that are not yet registered. There is a short period between when a net device starts to be unregistered and when it is actually removed from the list of available devices. During...

ROOT-APP-MAVEN-CVE-2024-52007 CVE-2024-52007 in ca.uhn.hapi.fhir:org.hl7.fhir.utilities - Patched by Root

Root has patched CVE-2024-52007 in the ca.uhn.hapi.fhir:org.hl7.fhir.utilities package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-55471 CVE-2026-55471 in ca.uhn.hapi.fhir:org.hl7.fhir.utilities - Patched by Root

Root has patched CVE-2026-55471 in the ca.uhn.hapi.fhir:org.hl7.fhir.utilities package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-34361 CVE-2026-34361 in ca.uhn.hapi.fhir:org.hl7.fhir.validation - Patched by Root

Root has patched CVE-2026-34361 in the ca.uhn.hapi.fhir:org.hl7.fhir.validation package for Root:Maven. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-68154 CVE-2025-68154 in systeminformation - Patched by Root

Root has patched CVE-2025-68154 in the systeminformation package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44724 CVE-2026-44724 in systeminformation - Patched by Root

Root has patched CVE-2026-44724 in the systeminformation package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-9910 CVE-2025-9910 in jsondiffpatch - Patched by Root

Root has patched CVE-2025-9910 in the jsondiffpatch package for Root:npm. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2019-17571 CVE-2019-17571 in log4j:log4j - Patched by Root

Root has patched CVE-2019-17571 in the log4j:log4j package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2023-26464 CVE-2023-26464 in log4j:log4j - Patched by Root

Root has patched CVE-2023-26464 in the log4j:log4j package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-23302 CVE-2022-23302 in log4j:log4j - Patched by Root

Root has patched CVE-2022-23302 in the log4j:log4j package for Root:Maven. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-49980 CVE-2026-49980 in github.com/rclone/rclone - Patched by Root

Root has patched CVE-2026-49980 in the github.com/rclone/rclone package for Root:Go. Multiple fixed versions available...

CVE-2026-104893: Allocation of Resources Without Limits or Throttling

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

PT-2026-106034

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description Two endpoint families fail to verify that nested resource identifiers belong to the workspace and project specified in the URL. An authenticated user can read or modify estimates from another workspace...

CVE-2026-105633: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

PT-2026-106021

Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/workspace slug/projects/project id/members/member pk/ to change another user's project role. The role-update logic block...

PT-2026-106080

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue id in the URL but omits it from the database query. A project member can use an issue id they control in the URL while targeting another user's attachment by its pk UUID. Because...

CVE-2026-104966: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...