Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: scsi: Message: mptlan: Fixed a use-after-free bug in mptlanremove, due to a race condition. In mptlanprobe, mptregisterlandevice is called, which initializes the &priv-postbucketstask workqueue. A call to...

Astra Linux – Vulnerability in Firefox

When a user opened the Web Extensions context menu, the Web Extension could access the post-redirect URL of the clicked element. If the Web Extension did not have the necessary WebRequest permissions for the hosts involved in the redirection, this would constitute a same-origin violation, allowin...

Astra Linux – Vulnerability in Python-Django

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Permissions for inline model instances were not validated when submitting forged POST data in GenericInlineModelAdmin. Earlier, unsupported Django versions such as 5.0.x, 4.1.x, and 3.2.x were not evaluated and...

CVE-2026-90895

creationtimestamp| type| source ---|---|--- 2026-09-14 10:35:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gnucz5ojyf4fj...

WordPress MDJM Event Management plugin < 1.7.8.5 - Unauthenticated Arbitrary Post Deletion vulnerability

Unauthenticated Arbitrary Post Deletion vulnerability discovered by Enrico Marcolini Dottor Marc, Claudio Marchesini Dottor Marc in WordPress Plugin Mobile DJ Manager versions 1.7.8.5...

CVE-2026-90692

creationtimestamp| type| source ---|---|--- 2026-09-14 08:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvhndce6h72w 2026-09-14 08:07:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvhnq6sty52f...

CVE-2026-89711

creationtimestamp| type| source ---|---|--- 2026-09-14 07:00:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvhjzafa762p 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20261002...

CVE-2026-89709

creationtimestamp| type| source ---|---|--- 2026-09-14 07:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvhjyyvchj23...

CVE-2026-90618

creationtimestamp| type| source ---|---|--- 2026-09-14 04:18:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/e5xqgx62uyt2x...

CVE-2026-74933

creationtimestamp| type| source ---|---|--- 2026-09-14 04:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvh7xgp6nf2b...

CVE-2026-88802

creationtimestamp| type| source ---|---|--- 2026-09-14 04:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvh7wy357f2s...

CVE-2026-16693

creationtimestamp| type| source ---|---|--- 2026-09-14 01:20:04+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117266763143792683 2026-09-14 01:20:20+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvgwygqgus2x...

CVE-2026-90603

creationtimestamp| type| source ---|---|--- 2026-09-14 00:25:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ghodfwgv6plhu...

CVE-2026-15891

creationtimestamp| type| source ---|---|--- 2026-09-14 00:00:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvgsixcvrl23 2026-09-14 04:40:09+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mvhc4pj35523...

CVE-2026-91199: Server-Side Request Forgery (SSRF)

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-57119: Improper Limitation of a Pathname to a Restricted Directory

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agentfile path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files...

CVE-2026-57124: Improper Neutralization of Special Elements used in an OS Command

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...

CVE-2026-91146: Improper Neutralization of Input During Web Page Generation

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

VulnCheck KEV: CVE-2026-23536

A security issue was discovered in the Feast Feature Server's /read-document endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to...

CVE-2026-86348: Incorrect Type Conversion or Cast

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...