Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: hns3: A deadlock issue was fixed when configuring TC during the reset process. When configuring TC during the reset process, a deadlock may occur. The sequence is as follows: 1. pf reset start 2. setup tc 3. down: napidisabl...

Astra Linux – Vulnerability in Chromium

The race condition in Payments in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Apache2

A path handling issue in moddavfs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child processes to crash. Users are recommended to upgrade to version 2.4.68, which fixes this issue...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Missing authorization in the Network section of Google Chrome before version 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: riscv/mm: Added handling for VMFAULTSIGSEGV in mmfaulterror. Handle VMFAULTSIGSEGV in the page fault path so that we can correctly kill the process without causing bugs in the kernel...

Security update for sssd

This update for sssd fixes the following issues: CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a process crash when a crafted protocol v1 request is processed bsc1273925. CVE-2026-12610: cancelled or completed PAM request while the asynchronous...

SUSE-SU-2026:4456-1 Security update for sssd

This update for sssd fixes the following issues: - CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a process crash when a crafted protocol v1 request is processed bsc1273925. - CVE-2026-12610: cancelled or completed PAM request while the...

Malicious code in tx-broadcast-utils (RubyGems)

RubyGems runs this gem's native extension script ext/tx-broadcast-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17612 Malicious code in tx-broadcast-utils (RubyGems)

RubyGems runs this gem's native extension script ext/tx-broadcast-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

CVE-2026-104809

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

CVE-2026-104809 Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

CVE-2026-104809 Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

Security update for perl-DBI

This update for perl-DBI fixes the following issues: CVE-2026-88815: numeric value incorrectly treated as strings in sqltypecastsvpv allows for process crash bsc1283055. CVE-2026-88816: numeric value incorrectly treated as strings in FetchHashKeyName allows for process crash bsc1283056. Patch...

SUSE-SU-2026:4442-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues: - CVE-2026-88815: numeric value incorrectly treated as strings in sqltypecastsvpv allows for process crash bsc1283055. - CVE-2026-88816: numeric value incorrectly treated as strings in FetchHashKeyName allows for process crash bsc1283056...

Malicious code in ethereum-tx-helper (RubyGems)

RubyGems runs this gem's native extension script ext/ethereum-tx-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in typesens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ded39f31b2c2d4d73e0b576ab862c9ed90688153a43c359dae5b26854ad8738 package.json declares postinstall wscript.exe 4444.vbs, which runs automatically on npm install. The shipped 4444.vbs 765 KB contains a multi-layer...

MAL-2026-17565 Malicious code in typesens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ded39f31b2c2d4d73e0b576ab862c9ed90688153a43c359dae5b26854ad8738 package.json declares postinstall wscript.exe 4444.vbs, which runs automatically on npm install. The shipped 4444.vbs 765 KB contains a multi-layer...

PT-2026-106239

Name of the Vulnerable Software and Affected Versions Camunda versions 7.24.0 through 7.24.14 Description An incorrect authorization issue exists in the Admin web application's first-run setup endpoint. The SetupResource incorrectly determines if the setup process is available by counting only...

Cisco ASA Command Injection (CVE-2021-1488)

A vulnerability in the upgrade process of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to inject commands that could be executed with root privileges on the underlying operating system OS. This...