Astra Linux – Vulnerability in curl

When performing HTTPS transfers, libcurl may incorrectly use the read callback CURLOPTREADFUNCTION to request data to be sent, even when the CURLOPTPOSTFIELDS option has been set. This occurs if the same handle was previously used to issue a PUT request that utilized that callback. This flaw may...

Astra Linux – Vulnerability in libmicrohttpd

GNU libmicrohttpd before version 0.9.76 allowed remote Denial of Service attacks due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHDcreatepostprocessor method. This allowed attackers to remotely send a malicious HTTP POST packet that included one or more '\0' byte...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: sched/fair: Fixed an error in reweightentity. Syzbot detected a GPF in reweightentity. This issue has been fixed in commit 4ef0c5c6b5ba “kernel/sched: Fixed the issue where schedfork accesses an invalid schedtaskgroup”. There ...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: scsi: Message: mptlan: Fixed a use-after-free bug in mptlanremove, due to a race condition. In mptlanprobe, mptregisterlandevice is called, which initializes the &priv-postbucketstask workqueue. A call to...

Astra Linux – Vulnerability in Python-Django

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Permissions for inline model instances were not validated when submitting forged POST data in GenericInlineModelAdmin. Earlier, unsupported Django versions such as 5.0.x, 4.1.x, and 3.2.x were not evaluated and...

CVE-2026-90895

creationtimestamp| type| source ---|---|--- 2026-09-14 10:35:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gnucz5ojyf4fj...

WordPress MDJM Event Management plugin < 1.7.8.5 - Unauthenticated Arbitrary Post Deletion vulnerability

Unauthenticated Arbitrary Post Deletion vulnerability discovered by Enrico Marcolini Dottor Marc, Claudio Marchesini Dottor Marc in WordPress Plugin Mobile DJ Manager versions 1.7.8.5...

CVE-2026-90692

creationtimestamp| type| source ---|---|--- 2026-09-14 08:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvhndce6h72w 2026-09-14 08:07:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvhnq6sty52f...

CVE-2026-89711

creationtimestamp| type| source ---|---|--- 2026-09-14 07:00:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvhjzafa762p 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20261002...

CVE-2026-89709

creationtimestamp| type| source ---|---|--- 2026-09-14 07:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvhjyyvchj23...

CVE-2026-90618

creationtimestamp| type| source ---|---|--- 2026-09-14 04:18:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/e5xqgx62uyt2x...

CVE-2026-74933

creationtimestamp| type| source ---|---|--- 2026-09-14 04:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvh7xgp6nf2b...

CVE-2026-88802

creationtimestamp| type| source ---|---|--- 2026-09-14 04:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvh7wy357f2s...

CVE-2026-16693

creationtimestamp| type| source ---|---|--- 2026-09-14 01:20:04+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117266763143792683 2026-09-14 01:20:20+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvgwygqgus2x...

CVE-2026-90603

creationtimestamp| type| source ---|---|--- 2026-09-14 00:25:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ghodfwgv6plhu...

CVE-2026-15891

creationtimestamp| type| source ---|---|--- 2026-09-14 00:00:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvgsixcvrl23 2026-09-14 04:40:09+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mvhc4pj35523...

CVE-2026-91199: Server-Side Request Forgery (SSRF)

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-55236: Improper Authorization

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...

CVE-2026-91146: Improper Neutralization of Input During Web Page Generation

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

VulnCheck KEV: CVE-2026-23536

A security issue was discovered in the Feast Feature Server's /read-document endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker can bypass intended access restrictions to...