Astra Linux – Vulnerability in gdcm

There is an out-of-bounds write vulnerability in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in Firefox, Thunderbird

When accessing throttled streams, the number of available bytes that need to be checked in the calling function must be within limits. This could cause future code to be incorrect and vulnerable. This vulnerability affects Firefox 111, Firefox ESR 102.9, and Thunderbird 102.9...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams bounds before overflow The check for data-streams overflow is performed after a buffer overflow has already occurred. Move the overflow check to before writing to the buffer. By the way, issuing a...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: A out-of-bounds write vulnerability has been fixed in ksmbdvfsstreamwrite. The offset from the client can be a negative value, which may allow writing data beyond the boundaries of the allocated buffer...

GHSA-59H8-W5Q6-MFMP Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

Summary The POST handler for /realtime/v1/streams/:runId/:streamId has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream. Vulnerability Details File: apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts The action...

Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

Summary The POST handler for /realtime/v1/streams/:runId/:streamId has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream. Vulnerability Details File: apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts The action...

CVE-2026-92955

A flaw was found in vm2. This vulnerability allows an attacker running untrusted code within the sandbox to achieve arbitrary code execution on the host system. By accessing internal host properties through standard output streams, the untrusted code can manipulate process event handlers and esca...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GStreamer Good Plugins vulnerabilities (USN-8863-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8863-1 advisory. Yazan Balawneh discovered that GStreamer Good Plugins incorrectly handled certain FLAC audio...

GO-2026-6592 Dozzle label filters do not restrict container event and statistics streams in github.com/amir20/dozzle

Dozzle label filters do not restrict container event and statistics streams in github.com/amir20/dozzle...

pypdf: Possible long runtimes when generating appearance streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires updating form field values with flattening enabled, which triggers appearance stream generation. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider...

BIT-RABBITMQ-2026-67408 RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service

RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/vhost/name reques...

PT-2026-105166

RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, accept content/2 at line 56 calls rabbit stream manager:create super stream/... directly after is authorized which only checks the management tag + vhost access via is authorized vhost. The...

PT-2026-105609

Dozzle label filters do not restrict container event and statistics streams in github.com/amir20/dozzle...

Rocky Linux 8 [CIQ] Security Update: redis / redis-debuginfo / redis-debugsource / redis-devel / etc Multiple Vulnerabilities (crlsa-2021_3945)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20213945 advisory. redis: Lua scripts can overflow the heap-based Lua stack CVE-2021-32626 redis: Integer overflow issue with Streams CVE-2021-32627 redis: Integer overflow b...

Rocky Linux 8 [CIQ] Security Update: redis / redis-debuginfo / redis-debugsource / redis-devel / etc Multiple Vulnerabilities (crlsa-2021_3918)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20213918 advisory. redis: Lua scripts can overflow the heap-based Lua stack CVE-2021-32626 redis: Integer overflow issue with Streams CVE-2021-32627 redis: Integer overflow b...

CVE-2026-102995

A flaw was found in pypdf. A remote attacker could exploit this vulnerability by submitting a specially crafted PDF document containing unusually large tokens in font mapping streams. When the library parses this data during operations such as text extraction, it decodes and retains oversized...

firefox: thunderbird: Use-after-free in the DOM: Streams component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Streams component...

Linux Distros Unpatched Vulnerability : CVE-2026-100771

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4,...

SUSE CVE-2026-100771

Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...

CVE-2026-100771

Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...