Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: media: rc: sunxi-cir: Unregistering a rc device due to probe failure After rcregisterdevice succeeds, subsequent probe failures must undo the registration using rcunregisterdevice. The current error handling logic jumps to the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed a data race around sysctltcpprobeinterval. When reading sysctltcpprobeinterval, it can be changed concurrently. Therefore, we need to add READONCE to its reader function...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: HID: hid-thrustmaster: A warning was fixed in thrustmasterprobe by adding an endpoint check. syzbot has identified a type mismatch between a USB pipe and the transfer endpoint, which is triggered by the hid-thrustmaster driver...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd-mbhc-v2: fixed resource leaks during component removal The MBHC resources must be released in case of component probe failures and removals; therefore, they cannot be tied to the lifetime of the component device...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: spi: tegra: A memory leak has been fixed in tegraslinkprobe. In tegraslinkprobe, when platformgetirq fails, it directly returns from the function with an error code, resulting in a memory leak. This issue can be addressed by...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: soc: ti: k3-socinfo: Fixed the regmap leak that occurs during probe failures. The mmio regmap allocated during the probe never gets freed. We have switched to using the device-managed allocator, so that the regmap is released...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: fix reference count leak in uniphierspiprobe The issue occurs in several error paths within uniphierspiprobe. When either dmagetslavecaps or devmspiregistermaster returns an error code, the function forgets to...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: media: usb: go7007: s2250-board: fix leak in probe Call i2cunregisterdeviceaudio on this error path...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix use-after-free on probe failure The vub300 driver manages its controller state using vub300-kref. The vub300delete function frees the mmc host when the last reference to it is dropped. However, the error path aft...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: PM: hibernate: deferring device probing when resuming from hibernation syzbot is reporting a hung task at miscopen, due to a race condition involving the probecount variable. Currently, waitfordeviceprobe from snapshotopen and...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: caifvirtio: The incorrect pointer check in cfvprobe has been fixed. delvqs frees virtqueues. Therefore, the pointer cfv-vqtx should be checked for being NULL before calling delvqs. The current implementation is redundant because...

RTCore64-probe

This repository does not have a README...

Linux Distros Unpatched Vulnerability : CVE-2026-109956

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated...

CVE-2026-109956

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the modelfilename or model argument can make the weka JVM write files via -d or probe files via -l...

CVE-2026-109956

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the modelfilename or model argument can make the weka JVM write files via -d or probe files via -l...

UBUNTU-CVE-2026-109956

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the modelfilename or model argument can make the weka JVM write files via -d or probe files via -l...

CVE-2026-109956

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the modelfilename or model argument can make the weka JVM write files via -d or probe files via -l...

BIT-GHOST-2026-105682 Ghost: Server-Side Request Forgery in Webhook Trigger

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0...

CVE-2026-109956: Improper Limitation of a Pathname to a Restricted Directory

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the modelfilename or model argument can make the weka JVM write files via -d or probe files via -l...

CVE-2026-109556

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview...