Astra Linux – Vulnerability in Linux, Linux 5.10

In mmcblkreadsingle of block.c, there is a way to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card triggers errors, without requiring additional execution privileges. User interaction is not required for exploitation...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fixed the potential issue of using “glock” after a file system unmount. When a DLM lockspace is released and there are still locks in that lockspace, the DLM will automatically unlock those locks. Commit fb6791d100d1b...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: mmc: uniphier-sd: A resource leak has been fixed in the remove function. A call to tmiommchostfree is missing from the remove function. This is to balance the call to tmiommchostalloc in the probe. This issue occurs in the error...

CVE-2026-15923: Loop with Unreachable Exit Condition

The Zephyr SDIO subsystem function sdioiorwextendedhelper in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MINremaining, func-cis.maxblksize as the per-iteration step. The value func-cis.maxblksize is decoded directly from the SDIO card's CIS FUNCE tuple in sdiodecodec...

CVE-2026-89440

A flaw was found in the Linux kernel's mmc: via-sdmmc component. During the probe process, if the mmcaddhost function fails, the SD card-detect interrupt handler continues to operate on memory that has already been released. This can lead to memory corruption, potentially allowing a local attacke...

Palo Alto Networks PAN-OS 10.2.x < 10.2.14 / 11.1.x < 11.1.8 / 11.2.x < 11.2.8 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.2.x prior to 10.2.14, 11.1.x prior to 11.1.8, or 11.2.x prior to 11.2.8. It is, therefore, affected by a vulnerability. The Terrapin attack allows an attacker with the ability to intercept SSH traffic on affected Palo Alto...

Security Bulletin: Multiple vulnerabilities addressed in IBM SevOne Network Performance Management for August 2026

Summary IBM SevOne Network Performance Management has addressed these security vulnerabilities in the SD-WAN component with a Service Pack update. The publication of this security bulletin represents a change in our communication process, not an increase in security vulnerabilities. IBM SevOne...

PT-2026-84577

PX4 Autopilot contains a heap buffer overflow vulnerability in the sd bench command that writes a four-byte block number into a user-supplied sized allocation. Attackers can invoke sd bench with a block size below four bytes to overflow the heap buffer and potentially execute code or crash the...

The vulnerability of the programmatically defined Cisco Catalyst SD-WAN (formerly Cisco SD-WAN) lies in the fact that information is stored in an open manner, allowing attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the programmatically defined Cisco Catalyst SD-WAN formerly Cisco SD-WAN is related to the storage of information in an open manner. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the programmatically defined Cisco Catalyst SD-WAN (formerly Cisco SD-WAN) arises from incorrect input of configuration data, allowing attackers to compromise the accessibility of protected information.

The vulnerability of the programmatically defined Cisco Catalyst SD-WAN formerly Cisco SD-WAN is related to incorrect input of configuration data. Exploiting this vulnerability can allow a malicious actor to compromise the accessibility of protected information...

@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

@logtape/syslog contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with includeStructuredData: true, which is non-default. 1. Unescaped C0 control characters in structured data values escapeStructuredDataValue in...

GHSA-8H6H-X5PQ-56FQ @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

@logtape/syslog contains two related output-encoding bugs in the structured data formatting code. Both only affect deployments with includeStructuredData: true, which is non-default. 1. Unescaped C0 control characters in structured data values escapeStructuredDataValue in...

CVE-2026-54511 @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData...

CVE-2026-54511

@logtape/syslog (part of LogTape, a Node.js logging library) contains two related output-encoding bugs in its structured-data formatting, affecting versions prior to 1.3.11 , 2.0.14 , and 2.1.5 when includeStructuredData is set to true (non-default). The escapeStructuredDataValue() function fails...

EUVD-2026-66563

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData...

CVE-2026-54511 @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData...

CVE-2026-54511 @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData...

PT-2026-82112

Name of the Vulnerable Software and Affected Versions @logtape/syslog versions prior to 1.3.11 @logtape/syslog versions prior to 2.0.14 @logtape/syslog versions prior to 2.1.5 Description Two output-encoding issues exist in the structured data formatting code when includeStructuredData is set to...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098842)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098842 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: sd: fix missing putdisk when deviceadd&diskdev fails If deviceadd&sdkp-diskdev fails,...

The vulnerability of the vub300_probe() function in the drivers/mmc/host/vub300.c file of the MMC/SD/SDIO card driver module in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the vub300probe function in the drivers/mmc/host/vub300.c file of the MMC/SD/SDIO card driver module in the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...