Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ACPICA: fixed the ACPI operand cache leak in dswstate.c ACPICA commit: 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732 I discovered a ACPI cache leak in cases where ACPI early termination occurs and the boot process continues. When earl...

Astra Linux – Vulnerability in Linux

In the file drivers/pci/hotplug/rpadlpar/sysfs.c within the Linux kernel up to version 5.11.8, the RPA PCI Hotplug driver suffers a user-tolerable buffer overflow when writing a new device name to the driver from user space. This allows user space to write data directly to the kernel stack frame...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: tty: serial: fsllpuart: fixed a race condition during RX DMA shutdown. From time to time, DMA completion can occur mid-way through the DMA shutdown process: : lpuart32shutdown lpuartdmashutdown deltimersync lpuartdmarxcomplete...

Astra Linux – Vulnerability in Apache2

Improper null termination and out-of-bounds read vulnerabilities in the Apache HTTP Server. This issue affects the Apache HTTP Server version up to 2.4.66. Users are recommended to upgrade to version 2.4.67, as this fix addresses the vulnerability...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, and watchOS 10.5. Processing a file may lead to unexpected app termination or arbitrary code execution...

Astra Linux – Vulnerability in bind9

In BIND 9.0.0 - 9.11.29, 9.12.0 - 9.16.13, and versions BIND 9.9.3-S1 - 9.11.29-S1 and 9.16.8-S1 - 9.16.13-S1 of the Supported Preview Edition, as well as release versions 9.17.0 - 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a query for a record that...

CVE-2026-105757: Improper Input Validation

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by t...

AZL-106518 CVE-2026-83663 affecting package kata-containers-cc 3.15.0.aks0-21

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

CVE-2026-83663 Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception due to improper exception handling in the TNonblockingServer. An attacker can disrupt server availability by sending specially crafted requests that trigger unhandled exceptions, resulting in the termination of the...

CVE-2026-91784

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

CVE-2026-91784 Argument Injection leading to arbitrary process termination in gotop

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

CVE-2026-91784

The cjbassi/gotop utility is vulnerable to local argument injection within its process termination functionality. The software fails to sanitize process names before passing them directly to the pkill command. A local attacker can exploit this by creating a process with a crafted name starting wi...

CVE-2026-91784 Argument Injection leading to arbitrary process termination in gotop

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

EUVD-2026-91318

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

CVE-2026-91784 Argument Injection leading to arbitrary process termination in gotop

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

CLEANSTART-2026-ZV78301 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process

Security vulnerability affects the consul package. SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process...

PT-2026-104160

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

CVE-2026-91784: Improper Neutralization of Argument Delimiters in a Command

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

PT-2026-104327

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description An uncontrolled recursion issue exists in the Go bindings. Both Go transports attempt to satisfy a read from a buffered frame; if the frame contains no payload bytes, the system reads the next...