Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A vulnerability classified as problematic has been discovered in the Linux kernel. The affected function is j1939sessiondestroy in the file net/can/j1939/transport.c. This manipulation leads to a memory leak. It is recommended that a patch be applied to fix this issue. The identifier of this...

Astra Linux – Vulnerability in Wireshark

The SDP protocol dissector in Wireshark versions 4.6.0 to 4.6.4 allows for a denial of service attack...

Astra Linux – Vulnerability in Firefox

A compromised content process could have performed session history manipulations that it should not have been able to due to a testing infrastructure that wasn’t restricted to only testing configurations. This vulnerability affects Firefox versions less than 88...

Astra Linux – Vulnerability in Samba

In DCE/RPC, it is possible to share handles cookies for resource state between multiple connections through a mechanism called “association groups”. These handles can reference connections to our sam.ldb database. However, while the database is correctly shared, the user credentials are only...

Astra Linux – Vulnerability in Chromium

The use of “after free” in WebRTC in Google Chrome before version 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption through a crafted WebRTC session. Chromium security severity: High...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix memory corruption on open The overflow check in the probe session-duplication function increased the session count, even when there were no more available sessions. This could lead to corruption of memory beyon...

Astra Linux – Vulnerability in Chromium

The use of after free in the Media Session in Google Chrome before version 125.0.6422.141 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fixed a resource leak in ksmbdsessionrpcopen. When ksmbdrpcopen fails, it must call ksmbdrpcidfree to undo the results of ksmbdipcidalloc...

Astra Linux – Vulnerability in curl

Curl versions 7.63.0 through 7.75.0 include a vulnerability that allows a malicious HTTPS proxy to intercept connections by mishandling TLS 1.3 session tickets. When using an HTTPS proxy and TLS 1.3, libcurl may misinterpret session tickets sent from the HTTPS proxy as those coming from the remot...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the SESSIONREATTACH. An attacker can gain unauthorized access to an existing session and assume the privileges of a previously authenticated user by sending a specially crafted CORE...

kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers

A flaw was found in the Linux kernel's iwlwifi Intel Wireless WiFi driver. This vulnerability allows an attacker to cause an out-of-bounds memory access in the WiFi Block Acknowledgement BA session handlers. This occurs when the stamask value is zero, leading to an incorrect station ID calculatio...

Exploit for Code Injection in Craftcms Craft_Cms

CVE-2025-32432 — Craft CMS getRequest-getBodyParam'handle'...

CLSA-2026-1789376005 TuxCare security update for zendframework/zend-session (1 CVE)

TuxCare rebuilt zendframework/zend-session to address 1 CVE. Fixed in 2.1.6-p1+tuxcare...

Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issue: CVE-2026-15747: exposing a stable representation of the session CSRF token to a BREACH compression oracle bsc1271431. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve

A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will...

PT-2026-91207

Name of the Vulnerable Software and Affected Versions LaraDashboard versions 0.9.0 through 1.2.2 Description Insufficient sanitization of SVG file content during media upload allows authenticated users with the media.create permission to upload malicious SVG files containing script tags. When a...

PT-2026-91759

Name of the Vulnerable Software and Affected Versions DocsGPT versions prior to 0.20.1 Description The software posts OAuth connector session tokens to a wildcard target origin in the 'callback-status' endpoint without validating the sender origin. An attacker can act as the window.opener during...

CVE-2026-46696: Improper Privilege Management

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted...

PT-2026-97769

TuxCare rebuilt zendframework/zend-session to address 1 CVE. Fixed in 2.1.6-p1+tuxcare...

CVE-2026-14277: Improper Neutralization of Special Elements used in an OS Command

IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a session file...