Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: BPF: Using rawspinlockt in ringbuf. The function bpfringbufreserve is invoked from a tracepoint, which disables preemption. Using spinlockt in this context can lead to a “sleep in atomic” warning in the RT variant. This issue is...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Makes rmwlock a rawspinlock. The following bug was triggered: ============================= Bug: Invalid wait context 6.12.0-rc2-XXX 406 Not tainted ----------------------------- kworker/1:1/62 is trying to lock:...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RISCV: Fixed sleeping in an invalid context in die. Die can be called within an exception handler, and therefore cannot sleep. However, die uses spinlockt, which can sleep when PREEMPTRT is enabled. This causes the following...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Wifi: ath9k: Avoid reading uninitialized memory in ath9khtcrxmsg. syzbot reports that the uninitialized value is accessed at ath9khtcrxmsg. For ioctlUSBRAWIOCTLEPWRITE, the function ath9khifusbrxstream may call ath9khtcrxmsg with...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RCU: Fixed the lockdep warning in thiscpuread in rcuforcequiescentstate. Running rcutorture with a non-zero fqsduration module parameter in a kernel built with CONFIGPREEMPTION=y results in the following error: BUG: Using...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: raw: Fixed a data race around sysctlrawl3mdevaccept. When reading sysctlrawl3mdevaccept, it can be changed concurrently. Therefore, we need to add READONCE to its reader function...

Astra Linux – Vulnerability in exiv2

In Exiv2 through 0.27.1, a vulnerability in CiffDirectory::readDirectory allows for integer overflow and out-of-bounds reads. This vulnerability enables an attacker to cause a denial of service SIGSEGV by using a crafted CRW image file...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

A NULL pointer dereference flaw was discovered in the rawv6pushpendingframes function in net/ipv6/raw.c within the network subcomponent of the Linux kernel. This flaw can cause the system to crash...

Astra Linux – Vulnerability in libraw

In LibRaw, there is a out-of-bounds read vulnerability within the gethuffmandiff function libraw\src\x3f\x3futilspatched.cpp when reading data from an image file...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: HID: hidraw: fixed a memory leak in hidrawrelease Free the buffered reports before deleting the list entry. BUG: memory leak Unreferenced object 0xffff88810e72f180 size 32: comm "softirq", pid 0, jiffies 4294945143 age 16.080s He...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

The IPv6 implementation in the Linux kernel before version 6.3 has a maxsize threshold in the net/ipv6/route.c file that can be easily exceeded. This can lead to a denial of service condition, where the network becomes unreachable, resulting in errors when IPv6 packets are sent through a raw sock...

openssl: RPK server signature algorithm selection can dereference a missing certificate

A flaw was found in OpenSSL. In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, where only the private key with no certificate is configured, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted...

Medium: jsoup

Issue Overview: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permi...

PT-2026-91277

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safe mode is enabled. The Laravel session store was exposed to Twig with unrestricte...

Important: openssl

Issue Overview: Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically...

CVE-2026-90583

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The...

CVE-2026-90583 kagisearch smallweb Query String Rendering sw.py index cross site scripting

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The...

EUVD-2026-77073

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The...

CVE-2026-90583

A cross-site scripting (XSS) flaw exists in kagisearch smallweb (up to commit 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf) in the index function of app/sw.py within the Query String Rendering component. Manipulating the qs argument injects untrusted content into the rendered page. Exploitation requi...

PT-2026-90967

Name of the Vulnerable Software and Affected Versions kagisearch smallweb versions up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf Description A remote cross site scripting issue exists in the Query String Rendering component within the index function of the app/sw.py file. The flaw is triggered b...