CVE-2026-84533

CVE-2026-84533 is a cryptographic issue in Apple's operating systems affecting iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, and watchOS 27 . The vulnerability was addressed through improved integrity checks. An attacker in a privileged network position may be able to modify network traffic, ...

CVE-2026-43787

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to leak sensitive user information...

EUVD-2026-78027

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to leak sensitive user information...

CVE-2026-43787

CVE-2026-43787 is a logic issue in Apple macOS , resolved through improved input checks. An attacker in a privileged network position may be able to leak sensitive user information , with no integrity or availability impact. The vulnerability is rated CVSS 5.9 (Medium) — network attack vector, hi...

CVE-2026-34213

CVE-2026-34213 Un usuario de Docmost con pocos privilegios podría proporcionar un attachmentId de una víctima al endpoint de carga genérico y sobrescribir el archivo adjunto de otra página dentro del mismo espacio de trabajo. Introducción Identifiqué, divulgué responsablemente y reproduje una fal...

CVE-2026-47256 OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...

CVE-2026-90933

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...

CVE-2026-77147

CVE-2026-77147 is a code injection vulnerability in Apache Syncope 's Groovy security sandbox. An administrator with sufficient entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in the CommandArgs static implementation , bypassing the sandbox —...

CVE-2026-90933

laradashboard through 1.2.2 contains a missing authorization vulnerability in its Local License API endpoints. Any authenticated user with low privileges can access three endpoints — GET /api/admin/licenses/show , POST /api/admin/licenses/store , and POST /api/admin/licenses/remove — to read, ove...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Mitigation is only applied to cBPF programs loaded by unprivileged users. Support for eBPF programs loaded by unprivileged users is typically disabled. This means that only cBPF programs need to be mitigated for BHB...

Astra Linux – Vulnerability in Intel Microcode

Observable discrepancies in the RAPL interface of certain Intel processors may allow a privileged user to potentially enable information disclosure through local access...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allows exposure of file descriptors to an unintended control sphere, because rdainterpret uses a privileged pipe without the closeonexec flag...

Astra Linux – Vulnerability in Qemu

An integer overflow issue was identified in the vmxnet3 NIC emulator of QEMU for versions up to v5.2.0. This issue can occur if a guest provides invalid values for the rx/tx queue size or other NIC parameters. A privileged guest user may exploit this flaw to crash the QEMU process on the host,...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A flaw was discovered in the Netfilter subsystem of the Linux kernel. The xtu32 module failed to validate the fields within the xtu32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value that exceeds the bounds of the...

Astra Linux – Vulnerability in edk2

Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure through network access...

Astra Linux – Vulnerability in Samba

A flaw was discovered in the Samba AD LDAP server. The AD DC database audit logging module can access values of LDAP messages freed by a preceding database module, leading to a use-after-free issue. This issue only occurs when certain privileged attributes are modified, such as userAccountControl...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in qemu. A host privilege escalation issue was identified in the virtio-fs shared file system daemon, where a privileged guest user is able to create a device-specific special file in the shared directory and use it to gain read/write access to host devices...

Astra Linux – Vulnerability in Intel Microcode

Improper input validation in UEFI firmware for some Intel processors may allow a privileged user to potentially enable information disclosure through local access...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A flaw was discovered in the XFRM subsystem of the Linux kernel. The specific flaw occurs during the processing of state filters, which can lead to a read of data beyond the end of an allocated buffer. This flaw allows a local privileged CAPNETADMIN attacker to trigger an out-of-bounds read,...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...