Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21, and 7.4.x below 7.4.9, when processing PHAR files using the phar extension, pharparsezipfile might be tricked into accessing freed memory, which could lead to a crash or information disclosure...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in the GPU component of Google Chrome prior to version 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Added a check for cstate. Since kzalloc may fail and return a NULL pointer, it would be better to check the cstate to avoid dereferencing the NULL pointer in drmatomichelpercrtcreset. Patchwork:...

CVE-2026-11993

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a user with permission to upload files to spawn more goroutines than intended and block the...

EUVD-2026-77361

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a user with permission to upload files to spawn more goroutines than intended and block the...

kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. This use-after-free vulnerability arises from incorrect handling of fast-RX rate data during mesh processing. This can lead to memory corruption, which an attacker could potentially exploit to cause a system crash denial of service...

Security update for strongswan

This update for strongswan fixes the following issues: CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7 Containers bsc1276534. CVE-2026-78126: NULL-Pointer Dereference When Handling...

Moderate: Red Hat Security Advisory: perl security update

An update for perl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2026-90556

A flaw was found in Freeciv. This vulnerability, a heap buffer overflow in the worklistload function, occurs when processing specially crafted savegame files. An attacker can create a malicious savegame file that, when loaded by a user or server operator, causes memory corruption. This could lead...

CVE-2026-90682

A flaw was found in Matthias-Wandel jhead. This vulnerability, a heap-based buffer overflow, exists within the WebP EXIF Handler component, specifically in the ProcessGpsInfo function. A local attacker could exploit this by manipulating the TAGGPSLAT or TAGGPSLONG arguments. Successful exploitati...

CVE-2025-26790

Withsecure Atlant with Capricorn engine before 2025-01-2002 allows a Remote Denial of Service via an out-of-bounds memory read during processing of a document file by the antivirus engine...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

PT-2026-91502

Name of the Vulnerable Software and Affected Versions macOS versions prior to Golden Gate 27 Description An integer overflow occurs due to insufficient input validation. Processing a maliciously crafted file can result in a denial-of-service or the potential disclosure of memory contents. An...

PT-2026-91628

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination...

CVE-2025-26790

Withsecure Atlant with the Capricorn engine, in versions prior to 2025-01-20_02 , is vulnerable to a remote denial of service caused by an out-of-bounds memory read during processing of a document file by the antivirus engine. The CVSS 3.1 score is 3.7 (Low) with a vector of AV:N/AC:H/PR:N/UI:N/S...

PT-2026-91492

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.6, macOS Tahoe 26.7, tvOS 26.6, watchOS 26.6. Processing a maliciously crafted video file may lead to unexpected app termination or...