Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sddr55: Reject out-of-bound newpba This issue was discovered by Atuin – the Automated Vulnerability Discovery Engine. newpba is derived from the status packet returned after each write operation. A malicious device...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fixed a possible memory leak if deviceadd fails. If deviceadd returns an error, the name allocated by devsetname needs to be freed. As noted in the comments for deviceadd, putdevice should be used to reduce the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Do not call scsiremovehost in pm8001alloc. Calling scsiremovehost before scsiaddhost results in a crash. BUG: Kernel NULL pointer dereferencing, address: 0000000000000108 RIP: 0010: devicedel+0x63/0x440 Call Trace:...

Astra Linux – Vulnerability in Rails

Active Storage allows users to attach cloud and local files in Rails applications. Before versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage’s proxy delivery mode, the proxy controller would load the entire requested byte range into memory before sending it. A reque...

Astra Linux – Vulnerability in Python-Django

In Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1, directory traversal is allowed if the filenames are passed to it directly...

Astra Linux – Vulnerability in libvirt

A NULL pointer dereference was detected in the libvirt API, which was introduced in the upstream version 3.10.0 and fixed in libvirt 6.0.0. This issue relates to the retrieval of a storage pool based on its target path. More specifically, this flaw affects storage pools created without a target...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in the Storage Access API in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: udc: remove warning when queue disabled ep It is possible for this issue to occur when the mass storage function tries to queue requests from the main thread. However, other threads may already disable the endpoint when the...

CVE-2026-98386

A flaw was found in the Linux kernel's qla2xxx storage driver. When preparing request queues for specific storage adapters, the driver improperly uses standard memory operations instead of dedicated device input/output I/O functions to zero memory. On certain processor architectures, such as ARM6...

Cleartext Storage of Sensitive Information

Overview org.eclipse.jetty:jetty-client is an is an asynchronous http client module fro jetty server. Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information via the SessionAuthentication process. An attacker can access plaintext passwords of authenticated...

Important: Red Hat Security Advisory: Red Hat Ceph Storage

A new version of Red Hat build of Ceph Storage has been released The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 7.1. This release updates to the latest version...

CVE-2026-19864

Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An...

CVE-2026-19864

The Eclipse Jetty server's SessionAuthentication component contains a vulnerability where authentication credentials are retained in a serializable object . If these credentials include a plaintext password and the authenticated session is persisted to a session data store, the password may be wr...

CVE-2026-105271

"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a user of the affected application...

CVE-2026-63315 Plaintext storage of a password in WebCTI

WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account. This issue was fixed in IPx series version 6.62.0100...

CVE-2026-63315

The WebCTI service for Slican IPx telephone exchanges is vulnerable to plaintext storage of temporary subscriber passwords. An attacker who gains access to the database can retrieve these passwords to log into subscriber accounts. This issue is resolved in IPx series version 6.62.0100 . No specif...

CVE-2026-105271

"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a user of the affected application...

CVE-2026-105271

"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a user of the affected application...

CVE-2026-105271

The ギェォアフリ application, provided by GEO CORPORATION , contains a vulnerability involving the cleartext storage of sensitive information (CWE-312). This flaw may allow an attacker to obtain a user's password from the affected application. No specific exploitation details or remediation steps are p...