Astra Linux – Vulnerability in the 389-DS-base

A access control bypass vulnerability was discovered in version 389-ds-base. This issue arises from improper handling of filters, which can lead to incorrect results. However, further analysis revealed that it actually constitutes an access control bypass. This vulnerability could allow any remot...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible’s amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to exploit the issue, as the module handles the parameter insecurely, resulting in the password being leaked in the logs...

Astra Linux – Vulnerability in Ruby 2.5, JRuby

A issue was discovered in Ruby between versions 2.6.7, 2.7.x up to 2.7.3, and 3.x up to 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a specified IP address and port. This potentially allows curl to extract information about services that would...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, NSS

An unchecked return value in the TLS handshake code could have caused a potentially exploitable crash. This vulnerability affects Firefox 122, Firefox ESR 115.9, and Thunderbird 115.9...

Astra Linux – Vulnerability in Firefox and Thunderbird

Additional techniques that built upon the slipstream research, combined with a malicious web page, could have exposed both hosts within an internal network as well as services running on the user’s local machine. This vulnerability affects Firefox versions earlier than 85...

MDT-XXE-exploit

MDT-XXE-exploi...

Vulnerability in Cosminexus Component Container

Overview Cosminexus Service Coordinator, which uses the SOAP communication infrastructure of Cosminexus Component Container, contains an XXE XML External Entity vulnerability in user-defined reception services SOAP reception services or SOAP adapters operating in SOAP 1.1 mode. Impact Regarding t...

September 14, 2026—KB5129244 (Monthly Rollup) Out-of-band

September 14, 2026—KB5129244 Monthly Rollup Out-of-band Applies To Windows Server 2012 ESU Important The installation of this Extended Security Update ESU might fail when you try to install it on an Azure Arc-enabled device that is running Windows Server 2012. For a successful installation, pleas...

September 14, 2026—KB5129237 (OS Build 20348.5631) Out-of-band

September 14, 2026—KB5129237 OS Build 20348.5631 Out-of-band Applies To Windows Server 2022 Announcements and messages This section provides key notifications related to this release, including announcements, change logs, and end-of-support notices. Windows Secure Boot certificate expiration...

PT-2026-91294

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images...

Remote Desktop Services RCE

The vulnerability of Remote Desktop Services RDS for Windows operating systems relates to the possibility of exploiting memory after it is freed. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

September 14, 2026—KB5129236 (OS Builds 19045.7727 and 19044.7727) Out-of-band

September 14, 2026—KB5129236 OS Builds 19045.7727 and 19044.7727 Out-of-band Applies To Windows 10 ESU Windows 10 Enterprise LTSC 2021 Important Free support for Windows 10 Enterprise LTSC 2021 will end soon. For information about the availability of an Extended Security Update ESU, see the End o...

September 14, 2026—KB5129238 (OS Build 17763.9247) Out-of-band

September 14, 2026—KB5129238 OS Build 17763.9247 Out-of-band Applies To Win 10 Ent LTSC 2019 Windows Server 2019 Summary This article lists the security issues and quality improvements included in this out-of-band update. Windows Server 2019 Windows 10, version 1809 Applies to: Windows Server 201...

September 14, 2026—KB5129242 (OS Build 22631.7584) Out-of-band

September 14, 2026—KB5129242 OS Build 22631.7584 Out-of-band Applies To Windows 11 version 23H2, all editions This out-of-band update for Windows 11, version 23H2 KB5129242 is cumulative. It includes updates from previous security releases, along with additional improvements. Visit the Windows...

CVE-2026-91199: Server-Side Request Forgery (SSRF)

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-90996: Integer Underflow (Wrap or Wraparound)

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services NSS responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affect...

September 14, 2026—KB5129235 (OS Build 26100.33451) Out-of-band

September 14, 2026—KB5129235 OS Build 26100.33451 Out-of-band Applies To Windows Server 2025, all editions This out-of-band OOB update for Windows Server 2025 KB5129235 is a non-security cumulative update. Improvements This out-of-band update contains quality improvements from KB5122871 released...

September 14, 2026, 2026—KB5129239 (OS Build 14393.9514) Out-of-band

September 14, 2026, 2026—KB5129239 OS Build 14393.9514 Out-of-band Applies To Windows Server 2016, all editions Win 10 Ent LTSB 2016 Win 10 IoT Ent LTSB 2016 Important Free support for Windows 10 Enterprise 2016 LTSB and Windows Server 2016 will soon end. For information about the availability of...

CVE-2026-90769 Open Notebook before 1.11.0 Server-Side Request Forgery via link-source

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...

EUVD-2026-76990

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...