Astra Linux – Vulnerability in Chromium

In DevTools in Google Chrome before version 126.0.6478.182, it was possible for an attacker to convince a user to install a malicious extension, allowing them to inject scripts or HTML into a privileged page through a crafted Chrome Extension. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox

Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox versions earlier than 110...

Astra Linux – Vulnerability in the 389-DS-base

A flaw was discovered in the 389-ds-base LDAP Server. This issue occurs when performing an Modify DN LDAP operation via the ldap protocol, where the function’s return value is not checked, and a NULL pointer is dereferenced. If a privileged user performs an LDAP MODDN operation after a failed...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. A user with sufficient privileges can create a malformed ACL selector, which, when accessed, triggers a server panic and subsequent denial of service. This issue exists in Redis version 7, before versions 7.2.6 and 7.4.1. Use...

Astra Linux – Vulnerability in Linux

A flaw was discovered in the Linux kernel’s implementation of string matching within packets. A privileged user with root or CAPNETADMIN status can insert rules into iptables, and this action may cause the system to panic. The issue affects kernels prior to version 5.5-rc1...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...

Astra Linux – Vulnerability in PostgresSQL 11

schemaelement defeats protective measures for search paths; It was discovered that certain database calls in PostgreSQL could allow an authenticated attacker with elevated database-level privileges to execute arbitrary code...

Astra Linux – Vulnerability in Qemu

A use-after-free flaw was discovered in the MegaRAID emulator of QEMU. This issue occurs during the processing of SCSI I/O requests when the mptsasfreerequest function fails to dequeue the request object ‘req’ from the pending requests queue. This flaw allows a privileged guest user to crash the...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

A flaw was discovered in the Netfilter subsystem of the Linux kernel. The nfnlosfaddcallback function did not validate the optnum field controlled by the user mode. This flaw allows a local privileged CAPNETADMIN attacker to trigger an out-of-bounds read, resulting in a crash or information...

Astra Linux – Vulnerability in Ceph

A privilege escalation flaw was discovered in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root through a crash dump, thereby exposing privileged information...

Astra Linux – Vulnerability in Firefox

In a non-standard configuration of Firefox, an integer overflow could have occurred due to network traffic possibly under the influence of a local unprivileged web page, resulting in an out-of-bounds write to privileged process memory. This bug only affects Firefox if a non-standard preference...

Astra Linux – Vulnerability in Linux 5.10, Linux

A denial-of-service DOS issue was detected in the smb2ioctlqueryinfo function of the Linux kernel, within the fs/cifs/smb2ops.c Common Internet File System. This issue arises due to an incorrect return value from the memdupuser function. This flaw allows a local, privileged attacker with...

Astra Linux – Vulnerability in Qemu

An infinite loop flaw was discovered in the USB xHCI controller emulation of QEMU while calculating the length of the Transfer Request Block TRB Ring. This flaw allows a privileged guest user to halt the QEMU process on the host, resulting in a denial of service...

Astra Linux – Vulnerability in Firefox and Thunderbird

A compromised content process could have allowed malicious data to be stored in a PathRecording object, resulting in an out-of-bounds write operation. This led to a potentially exploitable crash in a privileged process. This vulnerability affects Firefox 118, Firefox ESR 115.3, and Thunderbird...

Astra Linux – Vulnerability in Firefox, Thunderbird

If an attacker were able to corrupt the methods of an Array object in JavaScript through prototype pollution, they could have executed JavaScript code under their control in a privileged context. This vulnerability affects Firefox ESR 91.9.1, Firefox 100.0.2, Firefox for Android 100.3.0, and...

EUVD-2026-64248

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser...

CVE-2026-66917

JoomGallery (a Joomla extension) versions prior to 4.3.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. An authenticated user with privileged access can embed an XSS payload in any image, resulting in JavaScript execution in the browser of every visitor who views the affected ...

CVE-2026-66917 Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser...

CVE-2026-66917 Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser...

CVE-2026-69233

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, an...