Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: i2c: smbus – fixed the issue of NULL function pointers being dereferenced. Baruch reported an OOPS error when using the Designware controller as the target. Only targeting mode breaks the assumption that one transfer function ...

Astra Linux – Vulnerability in targetcli-fb

The Open-iSCSI TargetCLI-fb version up to 2.1.52 has weak permissions for the /etc/target directory as well as for the backup directory and backup files...

Astra Linux – Vulnerability in libvirt

A improper locking issue was detected in the virStoragePoolLookupByTargetPath API of libvirt. This issue occurs in the storagePoolLookupByTargetPath function, where a locked virStoragePoolObj object is not properly released in case of an ACL permission failure. Clients connecting to the read-writ...

Astra Linux – Vulnerability in OpenVSwitch

A flaw was discovered in Open vSwitch, allowing ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may enable a local attacker to create specially crafted packets with a modified or spoofed target IP address field, which can redirect ICMPv6 traffic...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: target: file: Use kzallocflex for aiocmd The targetcorefile does not initialize the aiocmd-iocb for the kiwritestream. When the writecommand fdexecuterwaio is executed, we may receive an invalid value for kiwritestream,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: dm: limiting swapping tables for devices with zone write plugs The dmrevalidatezones function only allows new or previously unzoned devices to call blkrevalidatediskzones. If the device was already zoned, disk-nrzones would alway...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: scsi: target: core: Fix targetcmdcounter leak The targetcmdcounter structure, which is allocated using targetalloccmdcounter, is never freed, resulting in leaks across various transport types. For example: - Unreferenced objec...

Astra Linux – Vulnerability in Firefox and Thunderbird

Under certain circumstances, asynchronous functions could cause a navigation failure while exposing the target URL. This vulnerability affects Thunderbird 91.4.0, Firefox ESR 91.4.0, and Firefox 95...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the context of dm-verity-target.c, there is a potential way to modify read-only files due to a missing permission check. This could lead to a local escalation of privileges, as System execution privileges are required. User interaction is not necessary for exploiting this vulnerability. Produc...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmloop: The “Drain commands” step in the targetreset handler is not properly executed. The tcmlooptargetreset function violates the SCSI EH contract: it returns SUCCESS without draining any ongoing commands. The SC...

golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...

libzypp 安全漏洞

Libzypp is a package manager developed by OpenSUSE. There is a security vulnerability in Libzypp, which arises when the chroot target is the system root directory. This vulnerability allows for traversing paths with root privileges, enabling execution of host binary files...

Unbreakable Enterprise kernel security update

5.4.17-2136.355.3.3 - ptrace: slightly saner 'getdumpable' logic Linus Torvalds Orabug: 39391459 CVE-2026-46333 5.4.17-2136.355.3.2 - scsi: target: iscsi: Fix use-after-free in iscsitdecsessionusagecount Maurizio Lombardi Orabug: 39368774 CVE-2026-23193 - scsi: target: iscsi: Fix use-after-free i...

FreeBSD-SA-26:21.ptrace

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:21.ptrace Security Advisory The FreeBSD Project Topic: Missing validation in ptracePTSCREMOTE Category: core Module: ptrace Announced: 2026-05-20 Credits:...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021525)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021525 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix a race condition between loginwork and the login thread In case a...

Metasploitable3-pentest-lab

🛡️ Metasploitable3 — Home Lab Penetration Test Report Aut...

GHSA-JH67-HWQW-M5R7 rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths

Summary Alice exposes a Python SDK ProxyShare with a fixed target URL. Bob sends a request to the share with an absolute URL in the path. The Flask handler passes that path to urllib.parse.urljoin, which replaces Alice's configured target host with Bob's host and returns the server-side response ...

PT-2026-42031

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.33.3 Coder versions prior to 2.32.2 Coder versions prior to 2.31.12 Coder versions prior to 2.30.8 Coder versions prior to 2.29.13 Coder versions prior to 2.24.5 Description An unauthenticated semi-blind Server-Side...

PT-2026-41960

Name of the Vulnerable Software and Affected Versions zrok affected versions not specified Description A path traversal issue exists when using the zrok2 copy command to move files from a WebDAV or zrok drive to a local filesystem. An attacker can provide a malicious DAV href containing directory...

PT-2026-41957

Name of the Vulnerable Software and Affected Versions zrok versions 0.4.47 through 1.1.11 Description The ProxyShare feature in the Python SDK is susceptible to Server-Side Request Forgery SSRF, a flaw where a server is tricked into making requests to an unintended destination. This occurs becaus...