CVE-2026-86902

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8.8. An app may be able to access sensitive user data...

CVE-2026-54178

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to unauthorized access or information disclosure due to Jetty (CVE-2026-8384)

Summary Eclipse Jetty path traversal/path normalization vulnerability can allow crafted URIs containing semicolon path parameters and .. sequences to bypass path-based authorization checks in applications relying on Jetty's canonicalized paths. IBM Sterling Secure Proxy has addressed the applicab...

CVE-2026-7208

Yealink SIP-T33G IP phones running firmware 124.86.x.x (prior to 124.87.0.0 ) are affected by a race condition in the runtime diagnostic subsystem. An authenticated attacker can trigger a diagnostic operation such as traceroute or ping and concurrently invoke the file-deletion endpoint to remove ...

CVE-2026-7208 Yealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File Deletion

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can...

Astra Linux – Vulnerability in Apache2

Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL. This enables the attacker to execute code or disclose...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ionic: removed WARNON to prevent paniconwarn. Unnecessary early code development checks and the WARNON have been removed. The processes related to irq allocation and deallocation have also been cleaned up. This check shouldn’t ha...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: ASoC: mediatek: mt8173: Fixed a refcount leak in the mt8173rt5650rt5676devprobe function. The ofparsephandle function returns a node pointer with a refcount incremented. We should use ofnodeput on it when it is no longer neede...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: soc: ti: pm33xx: The refcount leak in am33xxpmprobe has been fixed. wkupm3ipcget takes a reference count, which should be released by wkupm3ipcput. Add the necessary refcount release in the error-prone paths...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: Watchdog: ts4800wdt: Fixed the refcount leak in ts4800wdtprobe. ofparsephandle returns a node pointer with a refcount incremented; we should use ofnodeput on it after processing. Add ofnodeput for all missing execution paths...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: ASoC: fsl: Fixed a reference count leak in imxsgtl5000probe. The function offindi2cdevicebynode takes a reference; in error-prone paths, we should call putdevice to release that reference, thereby avoiding a reference...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: The issue involves fixing a use-after-free condition in lazyopptables after delaying the probe. When the function devpmoppoffindiccpaths in allocateopptable returns -EPROBEDEFER, the opptable is freed again, and it waits until al...

Astra Linux – Vulnerability in node-tar

The npm package “tar” also known as node-tar in versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has an arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent the extraction of absolute file paths by converting absolute paths into relative...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: drm/omap: dss: Fixed refcount leak issues In dssinitports and dssuninitports, we should call ofnodeput for the reference returned by ofgraphgetportbyid in the fail path or when it is no longer needed...

Astra Linux – Vulnerability in Subversion

Apache Subversion SVN’s “authz” feature prevents the display of “copyfrom” paths that should be hidden according to configured path-based authorization rules. When a node is copied from a protected location, users with access to the copy can see the “copyfrom” path of the original node. This also...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ASoC: mediatek: mt8173-rt5650: Fixed a refcount leak in mt8173rt5650devprobe. ofparsephandle returns a node pointer with a refcount incremented; we should use ofnodeput on it when it is no longer needed. Fixed refcount leaks i...

Astra Linux – Vulnerability in freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol. Clients that use the /bpp:32 legacy GDI drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read vulnerabilities. Versions 3.5.0 and 2.11.6 address this issue. As a workaround, use modern...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: mmc: sdio: fixed possible resource leaks in some error paths If sdioaddfunc or sdioinitfunc fails, sdioremovefunc cannot release the resources, because the sdio function is not called in these cases, and thus neither ofnodeput...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: exynos-ppmu: Fixed a refcount leak in the ofgetdevfreqevents function. The ofgetchildbyname function returns a node pointer with a refcount incremented. We should use ofnodeput on this pointer after execution. This...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: mctp: It now takes ownership of the skb in mctplocaloutput. Currently, mctplocaloutput only takes ownership of the skb on a successful operation. In some cases where mctplocaloutput fails, we might leak the skb. Ownership of...