Astra Linux – Vulnerability in gst-plugins-ugly1.0

GStreamer RealMedia File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability, but the attack vectors may...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using the Postgres database extension, providing invalid parameters to the parameterized query may cause PHP to attempt to free memory by using uninitialized data as pointers. This could lead to a RCE vulnerabilit...

Astra Linux – Vulnerability in Chromium

The use of after-free in Payments in Google Chrome before version 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in PHP 8.1

In PHP versions 8.3. before 8.3.19 and 8.4. before 8.4.5, a code sequence involving the set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If a third party can control the memory layout, for example by providing specially crafted inputs to the script, it could...

Astra Linux – Vulnerability in Chromium

The use of after free in Web Authentication in Google Chrome before version 149.0.7827.155 allowed a remote attacker to execute arbitrary code through a crafted HTML page. Chromium security severity: Critical...

Astra Linux – Vulnerability in Chromium

The use of after-free in WebGL in Google Chrome before version 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in libx11

The LookupCol.c file in X.Org X, as well as versions of X11 such as X11R7.7 and libX11 before version 1.7.1, may allow remote attackers to execute arbitrary code. The libX11 XLookupColor function, intended for server-side color lookups, contains a flaw that allows a client to send color-name...

Astra Linux – Vulnerability in Chromium

Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

apche_unomi_rce

CVE-2020-13942 Original blog post about the vulnerability: https://www.checkmarx.com/blog/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/ There are two RCE vectors: through MVEL injection and through OGNL injection. Both vectors target different code though the payloads look relativel...

CVE-2026-104811

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...

Malicious code in etherdum.rb (RubyGems)

RubyGems runs this gem's native extension script ext/etherdum.rb/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minute...

MAL-2026-17599 Malicious code in etherdum.rb (RubyGems)

RubyGems runs this gem's native extension script ext/etherdum.rb/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minute...

EUVD-2026-92305

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...

CVE-2026-104811 Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...

CVE-2026-104811

The Mitel MiVoice Office 400 is vulnerable to remote code execution due to an improper file type validation flaw in the Music on Hold functionality. Located in the web portal on TCP port 443 (Configuration → Services), the application fails to properly restrict uploaded files to the intended WAV ...

Malicious code in solaan-ruby (RubyGems)

RubyGems runs this gem's native extension script ext/solaan-ruby/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minute...

MAL-2026-17610 Malicious code in solaan-ruby (RubyGems)

RubyGems runs this gem's native extension script ext/solaan-ruby/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minute...

Malicious code in bitcion-ruby (RubyGems)

RubyGems runs this gem's native extension script ext/bitcion-ruby/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minut...

MAL-2026-17584 Malicious code in bitcion-ruby (RubyGems)

RubyGems runs this gem's native extension script ext/bitcion-ruby/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minut...