Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: char: applicom: fix NULL pointer dereference in acioctl Discovered by Atuin – Automated Vulnerability Discovery Engine. In acioctl, the validation of IndexCard and the check for a valid RamIO pointer are skipped when cmd is 6...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/core: Correctly check the presence of LSNLATYPEDGID. The netlink response for RDMANLLSOPIPRESOLVE should always contain an LSNLATYPEDGID attribute; it is invalid if it is missing. Properly use the nl parsing logic and cal...

Astra Linux – Vulnerability in mapserver

MapServer is a system for developing web-based GIS applications. Prior to version 8.4.1, the XML Filter Query directive’s PropertyName was vulnerable to Boolean-based SQL injection. It seems that expression checking was bypassed by introducing double quote characters in PropertyName, allowing...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: smb: client: prevented races in -queryinterfaces It was possible for two query interfaces to simultaneously attempt to update the interfaces. This issue can be avoided by checking and updating ifacelastupdate under ifacelock...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: brcmmac – Fix for crashes occurring when sending Action Frames in standalone AP Mode Currently, whenever an Action Frame needs to be transmitted, the brcmmac driver always uses the P2P vif to send the “actframe” IOVAR to th...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: AppArmor: The recursive profile removal method has been replaced with an iterative approach. The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system crashes...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fixed the “scheduling while atomic” issue in IPsec MAC address queries. A bug involving “scheduling while atomic” was addressed in mlx5eipsecinitmacs, by replacing mlx5querymacaddress with etheraddrcopy to retrieve the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipv4: route: Prevent rtbindexception from rebinding stale fnhe The packet transmission path of the sit driver calls sittunnelxmit - updateorcreatefnhe. This leads to fnheremoveoldest being called to delete entries that exceed...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Platform/x86: classmate-laptop: Added NULL pointer checks where necessary. In several places within the Classmate laptop driver, code that uses the accel object may execute before its address is stored in the driver’s data...

Security Bulletin: IBM Operational Decision Manager for July 2026 - Multiple CVEs addressed

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Operational Decision Manager Vulnerability Details CVEID:CVE-2025-11143 DESCRIPTION: The Jetty URI parser has some key differences to other common parsers when...

CVE-2026-12570

A flaw was found in Keras. When loading malicious .keras model files using the keras.models.loadmodel function, the H5IOStore.getitem method does not validate the shape or size of datasets. This can lead to unbounded memory allocation, allowing a malicious actor to trigger an out-of-memory...

CVE-2026-12570 Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras

A vulnerability in keras-team/keras versions = 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in keras/src/saving/savinglib.py does not validate the shape or size of datasets, leading...

CVE-2026-12570

A vulnerability in keras-team/keras versions = 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in keras/src/saving/savinglib.py does not validate the shape or size of datasets, leading...

CVE-2026-12570 Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras

A vulnerability in keras-team/keras versions = 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in keras/src/saving/savinglib.py does not validate the shape or size of datasets, leading...

EUVD-2026-55002

A vulnerability in keras-team/keras versions = 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in keras/src/saving/savinglib.py does not validate the shape or size of datasets, leading...

CVE-2026-12570

A vulnerability in keras-team/keras versions = 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in keras/src/saving/savinglib.py does not validate the shape or size of datasets, leading...

CVE-2026-12570

CVE-2026-12570 affects keras-team/keras

CVE-2026-12570 Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras

A vulnerability in keras-team/keras versions = 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in keras/src/saving/savinglib.py does not validate the shape or size of datasets, leading...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 1.0.2.0 Vulnerability Details CVEID:CVE-2026-45186 DESCRIPTION: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized craft...

EUVD-2026-54993

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection...