CVE-2026-82438

This vulnerability exists in Apache Storm 's HTTP components, where three distinct mechanisms allowed web pages from unrelated origins to access authenticated user responses. Specifically, the Logviewer reflected the Origin header in Access-Control-Allow-Origin while sending Access-Control-Allow-...

Astra Linux – Vulnerability in rsync

A flaw was discovered in rsync. It allows a server to enumerate the contents of an arbitrary file from the client’s machine. This issue occurs when files are being copied from the client to the server. During this process, the rsync server sends checksums of local data to the client for compariso...

Astra Linux – Vulnerability in opensc

A vulnerability was discovered in OpenSC, OpenSC tools, the PKCS11 module, minidrivers, and CTKs. An attacker could use a specially crafted USB device or smart card, which would send a specially crafted response to APDUs to the system. When buffers are partially filled with data, the initialized...

Astra Linux – Vulnerability in Squid

In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, a Denial of Service can occur when processing long Gopher server responses due to improper buffer management...

Astra Linux – Vulnerability in Rails

An XSS vulnerability exists in Action Pack versions = 5.2.0 and 5.2.0, which could allow an attacker to bypass the Content Security Policy and generate non-HTML responses...

Astra Linux – Vulnerability in Thunderbird

If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses before the STARTTLS handshake was completed, then Thunderbird did not ignore the injected data. This could result in Thunderbird displaying incorrect information. For example, the...

Astra Linux – Vulnerability in opensc

A vulnerability was discovered in the pkcs15-init function in OpenSC. An attacker could use a specially crafted USB Device or Smart Card, causing the system to send a specially crafted response to APDUs. Insufficient or missing checks on the return values of functions lead to unexpected behavior...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Allow waiting for commands to complete on removed devices When an SCSI device is removed while still in active use, currently, sg will immediately return -ENODEV whenever an attempt is made to wait for active commands...

Astra Linux – Vulnerability in Zabbix

When the WebDriver for the Browser object downloads data from an HTTP server, the data pointer is set to NULL and is only allocated during the curlwritecb operation when receiving data. If the server’s response is an empty document, then wd-data in the code below will remain NULL, and attempting ...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: Fixed a use-after-free in l2capdisconnectreq,rsp. Similar to the issue reported in commit d0be8347c623 "Bluetooth: L2CAP: Fix use-after-free caused by l2capchanput", use l2capchanholdunlesszero to prevent...

Astra Linux – Vulnerability in isc-dhcp

In ISC DHCP 4.4.0 - 4.4.3, and ISC DHCP 4.1-ESV-R1 - 4.1-ESV-R16-P1, when the function optioncodehashlookup is called from addOption, it increments the refcount field of the option. However, there is no corresponding call to optiondereference to decrement the refcount field. The function addOptio...

Astra Linux – Vulnerability in Tomcat9

The simplified implementation of blocking reads and writes introduced in Tomcat 10, and backported to Tomcat 9.0.47 and later versions, exposed a long-standing but extremely difficult to trigger concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60, and...

Astra Linux – Vulnerability in glibc

nscd: Null pointer crash after a “notfound” response If the Name Service Cache Daemon’s nscd cache fails to add a “notfound” netgroup response to its cache, the client request may lead to a null pointer dereferencing. This flaw was introduced in glibc 2.15 when the cache was moved to nscd. This...

Important: ruby3.4

Issue Overview: An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record type, class pair, or each unknown SvcParamKey...

CVE-2026-57126: Server-Side Request Forgery (SSRF)

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools.validateurl calls hostisblocked, which checks literal host encodings but does not resolve DNS names before scrapepage, crawl, extractlinks, extracttext, or URL-mention fetches connect. An attacker-controlled...

SUSE CVE-2026-89476

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADDOUT request again while another...

PT-2026-96697

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable...

EUVD-2026-42684

@Mockoon/commons-server: Path traversal in templated filePath lets a request escape the served directory prefix-only base check...

CVE-2026-89146: Integer Overflow or Wraparound

libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when...

PT-2026-96541

In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream-outcnt underflow on duplicate RECONF responses A cached RECONF chunk may contain more than one request parameter. A duplicate response can therefore find and process the same ADD OUT request again while another...