Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fixed the reference leak in the receiver shutdown process. The timer handler for receiver shutdown, batadvtpreceivershutdown, is responsible for releasing the reference to tpvars. However, the existing logic...

Insecure Direct Object Reference (IDOR)

File Browser is vulnerable to an Insecure Direct Object Reference IDOR. The vulnerability is due to insufficient authorization checks in the share deletion functionality, which allows an authenticated attacker with share permissions to delete other users’ shared links by exploiting improper acces...

GHSA-PJ6P-9P8X-5MFC Alkacon OpenCms is vulnerable to XXE when the <!DOCTYPE> refers to an external host

Alkacon OpenCms before 16 allows XXE when the refers to an external host...

CGA-C3W9-CCH7-77VV

Bulletin has no description...

CGA-4M28-W32W-PX9F

Bulletin has no description...

CGA-W46G-PPXJ-V7H7

Bulletin has no description...

CVE-2026-42276 Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions

Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the POST /chat/stop-chat-session/chatsessionid endpoint lets any authenticated user stop any other user's active chat session. The endpoint checks authentication but never verifies the session belongs to the caller. An...

SUSE CVE-2026-43207

In the Linux kernel, the following vulnerability has been resolved: media: mtk-mdp: Fix error handling in probe function Add mtkmdpunregisterm2mdevice on the error handling path to prevent resource leak. Add check for the return value of vpugetplatdevice to prevent null pointer dereference. And...

EUVD-2026-28452

Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the gethfree function in the USB gadget subset not decrementing the reference count. As a result,...

PT-2026-44354

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the batman-adv module, the batadv bla add claim function fails to release a reference to the backbone gw object when it cannot insert a new claim into the hash. This results in a memo...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the serial CAIF component not properly holding the tty-link reference during operations like...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the xesyncentryparse function failing to clean up some initialized synchronization states when...

PT-2026-39221

Name of the Vulnerable Software and Affected Versions AnythingLLM versions prior to 1.12.1 Description An insecure direct object reference IDOR exists in the text-to-speech endpoint. The endpoint "/api/workspace/:slug/tts/:chatId" validates workspace membership but fails to enforce ownership of t...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from a redundant cssput call in the schedext module’s scxcgroupinit function. This vulnerability may...

PT-2026-39152

MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The...

PT-2026-38994

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An unbalanced reference count occurs in the f subset USB gadget driver. The geth alloc function increments the reference count, but the geth free function fails to decrement it. This iss...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, caused by the use of the runonedelayedref function for an unexpected delayed reference type. This vulnerability...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from insufficiently releasing syncobj and timeline fence references when the output array size is smal...

Mozilla Thunderbird < 140.10.2

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.10.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-44 advisory. - Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2,...