Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: kprobes: The posthandler of aggrprobe is cleared in the case where kprobe-on-ftrace is used. In unregisterkprobetop, if the currently unregistered probe has a posthandler, but other child probes of aggrprobe do not have a...

Astra Linux – Vulnerability in PHP 7.3, PHP 8.1

In PHP versions 8.1. before 8.1.30, and 8.2. before 8.2.24, as well as 8.3. before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could result in legitimate data not being processed. This could allow malicious attackers to control a portion of the submitted dat...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix out-of-bounds access to the dirty bitset when resizing dm-cache checks the dirty bits of the cache blocks to be dropped when shrinking the fast device, but an index bug in bitset iteration causes out-of-bounds acces...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: f2fs: fixed the issue of waiting for block writeback in the postread case. If the inode is compressed but not encrypted, the function f2fswaitonblockwriteback was not called properly, resulting in waiting for the GC-ed page...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerabilities have been resolved: scsi: Message: mptlan: Fixed a use-after-free bug in mptlanremove, due to a race condition. In mptlanprobe, mptregisterlandevice is called, which initializes the &priv-postbucketstask workqueue. A call to...

Astra Linux – Vulnerability in etcd

A cross-site request forgery flaw was discovered in etcd 3.3.1 and earlier. An attacker can create a website that attempts to send a POST request to the etcd server and modify a key. Adding a key is done using a PUT operation, so it seems theoretically safe but PUT operations cannot be performed...

CVE-2026-75975

creationtimestamp| type| source ---|---|--- 2026-08-24 10:03:28+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mtt2ghwjcc2b 2026-09-02 17:33:14+00:00| seen| https://gist.github.com/alon710/4dc17918da62d2577fc435c04c7ff596...

CVE-2026-75931

creationtimestamp| type| source ---|---|--- 2026-08-24 09:33:52+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mtsyrka2pk2b 2026-09-02 15:57:39+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mukcg4x6cn2r 2026-09-02 16:31:29+00:00| seen|...

CVE-2026-8173

creationtimestamp| type| source ---|---|--- 2026-08-24 08:23:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ge35ai4kaparv...

PT-2026-81052

Name of the Vulnerable Software and Affected Versions ACPT Pro - Custom Post Types Plugin for WordPress versions 2.0.63 and earlier Description PHP Object Injection occurs when an application deserializes untrusted data, allowing an attacker to manipulate the resulting object and potentially...

CVE-2026-77116

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-77003

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

EUVD-2026-64639

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-60084

creationtimestamp| type| source ---|---|--- 2026-08-22 23:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtpewsiesz2b...

CVE-2026-16877

creationtimestamp| type| source ---|---|--- 2026-08-22 21:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtpaaz4cwg2b...

CVE-2026-16901

creationtimestamp| type| source ---|---|--- 2026-08-22 20:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtp4vpvtqo2c...

CVE-2026-4561

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

EUVD-2026-64299

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-4561 MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-4561

The MC4WP: Mailchimp for WordPress plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 4.12.0 . The flaw resides in the form response message post meta fields (e.g., text_subscribed, text_error), caused by insufficient input sa...