CVE-2026-43787

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to leak sensitive user information...

EUVD-2026-78027

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to leak sensitive user information...

CVE-2026-43787

CVE-2026-43787 is a logic issue in Apple macOS , resolved through improved input checks. An attacker in a privileged network position may be able to leak sensitive user information , with no integrity or availability impact. The vulnerability is rated CVSS 5.9 (Medium) — network attack vector, hi...

CVE-2026-34213

CVE-2026-34213 一个低权限的 Docmost 用户可以向通用上传端点提供一个受害者的 attachmentId，并覆盖同一工作空间内另一页面的存储附件。 引言 我在 Docmost （开源协作文档平台）中发现、负责任地披露并复现了一个 高严重性 的授权缺陷。 Docmost 官网将其描述为可本地部署、适合企业的 wiki，拥有 300万+ 次下载，并表示受到包括 维尔纽斯市 、Bechtle 、澳大利亚政府 、红十字会 和 ETS Quebec 在内的团队信任。 该漏洞存在于 Docmost 也用于图表保存/更新流程的通用文件上传路径中。...

CVE-2026-47256 OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...

CVE-2026-90933

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...

CVE-2026-77147

CVE-2026-77147 is a code injection vulnerability in Apache Syncope 's Groovy security sandbox. An administrator with sufficient entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in the CommandArgs static implementation , bypassing the sandbox —...

CVE-2026-90933

laradashboard through 1.2.2 contains a missing authorization vulnerability in its Local License API endpoints. Any authenticated user with low privileges can access three endpoints — GET /api/admin/licenses/show , POST /api/admin/licenses/store , and POST /api/admin/licenses/remove — to read, ove...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Mitigation is only applied to cBPF programs loaded by unprivileged users. Support for eBPF programs loaded by unprivileged users is typically disabled. This means that only cBPF programs need to be mitigated for BHB...

Astra Linux – Vulnerability in Intel Microcode

Observable discrepancies in the RAPL interface of certain Intel processors may allow a privileged user to potentially enable information disclosure through local access...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allows exposure of file descriptors to an unintended control sphere, because rdainterpret uses a privileged pipe without the closeonexec flag...

Astra Linux – Vulnerability in Qemu

An integer overflow issue was identified in the vmxnet3 NIC emulator of QEMU for versions up to v5.2.0. This issue can occur if a guest provides invalid values for the rx/tx queue size or other NIC parameters. A privileged guest user may exploit this flaw to crash the QEMU process on the host,...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A flaw was discovered in the Netfilter subsystem of the Linux kernel. The xtu32 module failed to validate the fields within the xtu32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value that exceeds the bounds of the...

Astra Linux – Vulnerability in edk2

Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure through network access...

Astra Linux – Vulnerability in Samba

A flaw was discovered in the Samba AD LDAP server. The AD DC database audit logging module can access values of LDAP messages freed by a preceding database module, leading to a use-after-free issue. This issue only occurs when certain privileged attributes are modified, such as userAccountControl...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in qemu. A host privilege escalation issue was identified in the virtio-fs shared file system daemon, where a privileged guest user is able to create a device-specific special file in the shared directory and use it to gain read/write access to host devices...

Astra Linux – Vulnerability in Intel Microcode

Improper input validation in UEFI firmware for some Intel processors may allow a privileged user to potentially enable information disclosure through local access...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A flaw was discovered in the XFRM subsystem of the Linux kernel. The specific flaw occurs during the processing of state filters, which can lead to a read of data beyond the end of an allocated buffer. This flaw allows a local privileged CAPNETADMIN attacker to trigger an out-of-bounds read,...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in Intel Microcode

Incorrect calculations in the microcode keying mechanism of some 3rd Generation IntelR XeonR Scalable Processors may allow a privileged user to potentially enable information disclosure through local access...