Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fixed an infinite loop caused by resetting nextsmb2rcvhdroff during error paths. The issue occurs when a signed request fails the smb2 signature verification check. In processrequest, if checksignreq returns an error,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fixed a memory leak that occurred during codecinfo allocation failures. In wave5vpuopenenc and wave5vpuopendec, a vpu instance is allocated using kzalloc. If the subsequent allocation of inst-codecinfo...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a buffer overread could occur in the freerdpimagecopyfromicondata function libfreerdp/codec/color.c, due to malicious RDP window icon TSICONINFO data. This bug could be exploited over the network when a clie...

Astra Linux – Vulnerability in Chromium

Before version 147.0.7727.101, writing the GPU information in Google Chrome allowed a remote attacker who had compromised the GPU process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: ath11k: Fixed an issue where the RCU stall occurred during the processing of the monitor destination ring. During this process, MSDUs are retrieved from the link descriptor based on the corresponding bufid. However,...

CVE-2026-56272

Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password hashes approximately 30 times faster with modern GPU hardware, potentially compromising all user accounts in a database...

OESA-2026-2697 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: An out-of-bounds write...

CVE-2026-13006

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by compromising an existing logback configuration...

Expression Injection

Overview ch.qos.logback:logback-core is a logback-core module. Affected versions of this package are vulnerable to Expression Injection in the Janino-evaluated condition attribute of configuration elements, handled by IfModelHandler, whose denylist blocked only the literal new operator. A user wh...

SUSE CVE-2026-56371

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is process...

[SECURITY] Fedora 44 Update: grout-0.16.0-1.fc44

grout stands for Graph Router. In English, "grout" refers to thin mortar that hardens to fill gaps between tiles. grout is a DPDK based network processing application. It uses the rtegraph library for data path processing. Its main purpose is to simulate a network function or a physical router fo...

PT-2026-51709

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the batman-adv module where the batadv frag skb buffer function is called by batadv batman skb recv upon receiving a BATADV UNICAST FRAG packet. After reassembling the...

RHEL 9 : buildah (RHSA-2026:29455)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:29455 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

Poly Video Codec - Qualcomm KGSL GPU Driver Update

The Qualcomm Graphics Processing Unit GPU is responsible for rendering graphics, such as images, videos, and text messages on Poly Studio X32, X52, X72, and G62. A memory-corruption vulnerability in the Kernel Graphics Support Layer KGSL GPU driver might allow an attacker to gain access to...

ROS-20260624-73-0021

The vulnerability in Netty is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a remote attacker to send hidden HTTP requests a type of HTTP request smuggling attack...

ROS-20260624-73-0026

The vulnerability in Netty is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a remote attacker to send hidden HTTP requests a type of HTTP request smuggling attack...

ROS-20260624-73-0020

The vulnerability in Netty is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a remote attacker to send hidden HTTP requests a type of HTTP request smuggling attack...

The vulnerability of the MagicYUV decoder on the FFmpeg media processing platform allows a hacker to execute arbitrary code.

The vulnerability of the MagicYUV decoder on the FFmpeg media processing platform relates to writing beyond the buffer boundaries. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created malicious media file...

Oracle Linux 9 : compat-openssl11 (ELSA-2026-22313)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-22313 advisory. 1:1.1.1k-5.3 - Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing Resolves: RHEL-165863 Tenable has...

vim: Command injection allows arbitrary code execution via malicious tag files

A flaw was found in Vim, an open-source command-line text editor. This command injection vulnerability occurs during tag file processing. A local user could craft a malicious tags file containing backtick syntax in the filename field. When Vim resolves a tag from this file, it executes the embedd...