2900 matches found
AlmaLinux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.6:CLSA-2026:1792146840)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792146840 advisory. - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrit...
CentOS Linux 8 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS-STREAM8:CLSA-2026:1792164102)
The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1792164102 advisory. - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with...
AlmaLinux 9.2 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.2:CLSA-2026:1792170794)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792170794 advisory. - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrit...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Do not leak some plane state. Apparently, no one noticed that the mdp5 plane states are being leaked quite severely. This issue was addressed since we introduced the planestate-commit refcount mechanism a few years...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Do not check if plane-state-fb == state-fb Currently, when using non-blocking commits, the following kernel warnings can be observed: 110.908514 ------------ Cut here ------------ 110.908529 refcountt: Underflow; Use aft...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerabilities have been resolved: drm/stm: Avoid use-after-free issues with crtc and plane The function ltdcload calls the functions drmcrtcinitwithplanes, drmuniversalplaneinit, and drmencoderinit. These functions should not be called with parameters allocate...
Astra Linux – Vulnerability in ffmpeg5
The Ffmpeg v.N113007-g8d24a28d06 contains a buffer overflow vulnerability that allows a local attacker to execute arbitrary code through libavutil/imgutils.c:353:9 in the imagecopyplane function...
SUSE CVE-2026-93479
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...
SUSE CVE-2026-97629
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...
UBUNTU-CVE-2026-15176
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the $requestfilename variable...
UBUNTU-CVE-2026-101019
Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...
UBUNTU-CVE-2026-97629
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...
CVE-2026-97629
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...
CVE-2026-102980
Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the U...
CVE-2026-102986
Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...
CVE-2026-102985
Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partialupdate places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's isactive field, including deactivating a project...
CVE-2026-102980 Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope
Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the U...
CVE-2026-102980
The open-source project management tool Plane is vulnerable to a Cross-Project Page Content Disclosure prior to version 1.4.0 . The root cause is located in apps/api/plane/app/views/page/version.py, where PageVersionEndpoint fails to scope lookups by the project_id from the URL. Because ProjectPa...
CVE-2026-102980 Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope
Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the U...
EUVD-2026-101617
Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the projectid from the URL. ProjectPagePermission likewise derives the caller's role from the U...