Astra Linux – Vulnerability in the 389-DS-base

A flaw was discovered in 389-ds-base. A specially crafted LDAP query may potentially cause a failure on the directory server, resulting in a denial of service...

Astra Linux – Vulnerability in Zabbix

There is a vulnerability related to arbitrary file reading in the Zabbix Web Service Report Generation module, which listens on port 10053. The service does not perform proper validation on URL parameters before reading the files...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In rndisqueryoid in drivers/net/wireless/rndiswlan.c within the Linux kernel, from version 6.1.5 onwards, there is an integer overflow in a mathematical operation...

Astra Linux – Vulnerability in SQLite3

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 through the idxGetTableInfo function, when a crafted SQL query is executed. NOTE: The vendor disputes the relevance of this report, as the sqlite3.exe user already has full privileges i.e., they are...

Astra Linux – Vulnerability in node-qs

The qs format used before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process to hang for an Express application. This is because the proto key can be exploited. In many typical Express use cases, an unauthenticated remote attacker can insert the...

Astra Linux – Vulnerability in Docker-Registry

A flaw was discovered in the /v2/catalog endpoint located in the distribution/distribution directory. This endpoint accepts a parameter that controls the maximum number of records to be returned query string: n. This vulnerability allows a malicious user to submit an excessively large value for n...

Astra Linux – Vulnerability in isc-dhcp

In ISC DHCP 4.4.0 - 4.4.3, and ISC DHCP 4.1-ESV-R1 - 4.1-ESV-R16-P1, when the function optioncodehashlookup is called from addOption, it increments the refcount field of the option. However, there is no corresponding call to optiondereference to decrement the refcount field. The function addOptio...

Astra Linux – Vulnerability in mapserver

MapServer is a system for developing web-based GIS applications. Prior to version 8.4.1, the XML Filter Query directive’s PropertyName was vulnerable to Boolean-based SQL injection. It seems that expression checking was bypassed by introducing double quote characters in PropertyName, allowing...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: usb: rndishost: The secure rdrisquery check prevents integer overflow. The variables off and len, which are typed as uint32 in the rdrisquery function, are controlled by the incoming RNDIS response message. Therefore, their value...

Astra Linux – Vulnerability in PostgresSQL 11

A flaw was discovered in PostgreSQL. A specially crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can carry out this attack at will. The attack does not require the ability to create objects. If the server settings include...

Astra Linux – Vulnerability in Firefox

Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox versions earlier than 110...

Astra Linux – Vulnerability in bind9

Every named instance configured to run as a recursive resolver maintains a cache database that holds the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the max-cache-size statement in the configuration file; i...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Keys: Fixed the issue of linking a duplicate key to a keyring’s assocarray. When making a DNS query within the kernel using dnsquery, the request code can, in rare cases, create a duplicate index key in the assocarray of the...

Astra Linux – Vulnerability in python-pymysql

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input, because keys are not escaped by escapedict...

Linux Distros Unpatched Vulnerability : CVE-2026-77354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/reqrespdecoder.go converts...

CVE-2026-49360

Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...

CVE-2026-49360 Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...

CVE-2026-49360

Recce (a data-validation toolkit for dbt PR review) versions prior to 1.50.0 are vulnerable to unauthenticated SQL execution through the query run API when deployed with a DuckDB-backed project and exposed to an untrusted network without authentication. An attacker can leverage DuckDB filesystem ...

CVE-2026-30826

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3...

CVE-2026-77415

JSONata (a JSON query and transformation language) is vulnerable to arbitrary code execution in versions prior to 1.8.8 and 2.2.1 . An attacker can craft JSONata expressions that chain multiple object-integrity weaknesses—overwriting $clone, exposing internal functions via $merge.*, replacing pro...