Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mm: Avoid leaving partial pfn mappings in error cases. As Jann points out, PFN mappings are special. Unlike normal memory mappings, there is no lifetime information associated with the mapping—it’s just a raw mapping of PFNs,...

Linux Distros Unpatched Vulnerability : CVE-2025-0647

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element PE may inhibit TLB invalidation when a TLBI is issued to the PE, either by the sa...

SUSE SLES15 Security Update : openssl-3-livepatches (SUSE-SU-2026:4418-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4418-1 advisory. This update for openssl-3-livepatches fixes the following issue: - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via insufficient scoping of response cache keys to their source route in base-server.ts and related export/build pipeline files. When multiple routes share a cache...

CVE-2026-104912

MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation...

CVE-2026-104912

The MISP platform contains an authorization flaw in its correlation handling during attribute searches, affecting versions prior to v2.5.48 . The root cause is that the system uses a stale distribution snapshot stored on the correlation row—which is a point-in-time copy lacking a published flag—i...

Security update for openssl-3-livepatches

This update for openssl-3-livepatches fixes the following issue: CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset bsc1280587. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:4418-1 Security update for openssl-3-livepatches

This update for openssl-3-livepatches fixes the following issue: - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset bsc1280587...

CVE-2026-104912: Missing Authorization

MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distribution snapshot stored on the correlation...

RabbitMQ 4.2.x < 4.2.8 / 4.3.x < 4.3.2 Non-RFC-Conformant Auth Mechanism Cookie Name

The version of RabbitMQ installed on the remote host is 4.2.x prior to 4.2.8, or 4.3.x prior to 4.3.2. It is, therefore, affected by a vulnerability: - getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or preferredauthmechanism atom when clearing the corresponding cookie, producin...

BIT-RABBITMQ-2026-67420 RabbitMQ OAuth credential refresh retains revoked runtime tags

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username toke...

CVE-2026-103651 MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass

MISP contains a vulnerability in its one-time password OTP authentication flow that allows replay of a consumed HOTP paper token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that was cached in the user's session at the time t...

PT-2026-105202

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username toke...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc (ALMALINUX9.6:CLSA-2026:1784278790)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784278790 advisory. - In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc (ALMALINUX9.6:CLSA-2026:1784278790)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784278790 advisory. - In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK...

SUSE CVE-2026-98137

In the Linux kernel, the following vulnerability has been resolved: ntfs: treat any nonzero dio zero-range return as an error ntfsdiozerorange returns either 0 or a negative errno from blkdevissuezeroout; it never returns a positive value. The zeroing failure check in ntfsattrfallocate therefore...

CVE-2026-103012

The Claude Code application is vulnerable to a security flaw where it prioritizes locally stored API keys (from previous logins or configurations) over the server-managed settings of a valid Claude Enterprise or Team account. If the settings endpoint rejects the stored key, the session may start ...

EUVD-2026-89778

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

CVE-2026-103012

Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated wi...

CVE-2026-97988

A flaw was found in the Linux kernel's vhost subsystem. When transitioning device address modes or updating feature settings, cached virtual ring pointers and translation metadata are not properly invalidated, leaving stale memory mappings in use. A local attacker with access to the vhost device...