CVE-2026-75340

The device metadata import interface /device/instance/productId/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery SSRF...

PT-2026-82339

Name of the Vulnerable Software and Affected Versions jetlinks community version 2.11 Description The device metadata import interface '/device/instance/productId/property-metadata/import' is susceptible to Server-side request forgery SSRF, a flaw that allows an attacker to induce the server-side...

PT-2026-82348

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

Important: Red Hat Security Advisory: sg3_utils security update

An update for sg3utils is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

Important: Red Hat Security Advisory: sg3_utils security update

An update for sg3utils is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

Important: Red Hat Security Advisory: sg3_utils security update

An update for sg3utils is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

Important: Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update

An update for sg3utils is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

BIT-KEYCLOAK-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

Astra Linux – Vulnerability in Systemd

It was discovered that a Systemd service that uses the DynamicUser property can create a SUID/SGID binary that will be allowed to run as the transient service’s UID/GID even after the service is terminated. A local attacker could exploit this flaw to access resources that will be owned by a...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Device property: Fixed the node refcount leak in fwnodegraphgetnextendpoint. The “parent” returned by fwnodegraphgetportparent has its refcount incremented when ‘prev’ is not NULL. This variable needs to be set after using it...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm: Fixed a potential null-ptr-deref due to drmmmodeconfiginit. drmmmodeconfiginit will call drmmodecreatestandardproperties, and it does not check the return value. When drmmodecreatestandardproperties fails due to allocatio...

Astra Linux – Vulnerability in xorg-server

A flaw was discovered in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow, which may lead to the disclosure of sensitive information...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Wifi: brcmfmac: Check the return value of ofpropertyreadstringindex. Between version 6.10 and 6.11, the driver began crashing on my MacBookPro14,3. The ofpropertyreadstringindex function does not exist, and the tmp variable...

Astra Linux – Vulnerability in Firefox

By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could be applied, leading to memory corruption and potentially exploitable crashes. This vulnerability affects Firefox versions less than 87...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Avoid device tree lookups in rtasosterm. rtasosterm is called during panic. Its behavior depends on several conditions in the /rtas node of the device tree; traversing these nodes involves locking and changes to loc...

MiracleLinux 9 : sg3_utils-1.47-10.el9_8.1 (AXSA:2026-1623:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1623:02 advisory. sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Tenable has extracted the preceding description...