CVE-2026-46696 October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted...

CVE-2026-61534

Yayson is a JavaScript library for serializing and reading JSON:API data. Prior to 4.3.0 , Store and LegacyStore use attacker-controlled type, id, and relationship names directly as keys in plain-object lookup tables. A JSON:API document with type: "__proto__" writes onto Object.prototype, giving...

CVE-2026-61534 Yayson: Prototype pollution in the Store/LegacyStore deserialization

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: PCI: Fixed the memory leak in resetmethodstore In resetmethodstore, a string is allocated via kstrndup and assigned to the local variable “options”. Then, options is used with strsep to find spaces: c while name = strsep&options,...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dma-buf: A memory barrier should be inserted before updating numfences. smpstoremb inserts a memory barrier after storing data. This differs from what the comment originally intended; a null pointer dereferencing can occur if the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ip: Fixed data races related to sysctlipprotsock. sysctlipprotsock is accessed concurrently, and there is always a chance of data races occurring. Therefore, both readers and writers require some basic protection to avoid...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel up to version 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory through a Speculative Store Bypass side-channel attack. This occurs because a certain preempting store operation does not necessarily occur before a store operation whose valu...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel up to version 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory through a Speculative Store Bypass side-channel attack, because the protection mechanism ignores the possibility of uninitialized memory locations within the BPF stack...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fixed an off-by-one buffer overflow in alarmsstore. The sysfs buffer passed to alarmsstore is allocated with ‘size + 1’ bytes, and a NUL terminator is appended. However, the ‘size’ argument does not account for this...

Astra Linux – Vulnerability in Samba

A vulnerability related to information leaks was discovered in Samba’s LDAP server. Due to missing access control checks, a authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: BPF: Fixed the bpfxdpstorebytes proto for read-only arguments. While making some maps in Cilium read-only from the BPF side, we noticed that the bpfxdpstorebytes proto is incorrect. In particular, the verifier threw the following...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbcon: Ensure that the modelist parameter is not set for unregistered consoles. It appears that attempts to write to the “storemodes” sysfs node will encounter unregistered consoles. UBSAN: Array index out of bounds in...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the...

Astra Linux – Vulnerability in curl

When performing TLS-related transfers using reused easy or multi-handles, and altering the CURLSSLOPTNOPARTIALCHAIN option, libcurl may accidentally reuse a CA store cached in memory, where the partial chain option is reversed. This goes against the user’s wishes and expectations. As a result,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: rpmsg: core: fixed a race condition in the driveroverrideshow function and used a core helper function. The driveroverrideshow function reads the driveroverride string without holding the devicelock. However, the store function...

Astra Linux – Vulnerability in Apache Log4j2

In Apache Log4j Core versions 2.0-beta9 through 2.25.2, the Socket Appender does not perform TLS hostname verification of the peer certificate, even when the verifyHostName configuration attribute https://logging.apache.org/log4j/2.x/manual/appenders/network.htmlSslConfiguration-attr-verifyHostNa...

Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users

A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service. The extension, named "Twitch Enhanced Viewer | JeetBot," lists HISHIMIRO/jeetbot.cc as its developer and has the following...

CVE-2026-71198

In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the importfilteringopts host restrictions. An authenticated user ca...

CVE-2026-71198

In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the importfilteringopts host restrictions. An authenticated user ca...

EUVD-2026-77315

In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the importfilteringopts host restrictions. An authenticated user ca...