Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: filemap: Avoid truncating the 64-bit offset to 32 bits. On 32-bit kernels, the folioseekholedata function inadvertently truncated a 64-bit value to 32 bits, which could lead to an infinite loop when writing to an xfs filesystem...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: orangefs: Do not truncate the file size. len is used to store the result of isizeread. Therefore, making len a sizet type results in truncation to 4GiB on 32-bit systems...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Using a code segment selector for the VERW operand Robert Gill reported the following issue in 32-bit mode when the dosemu software executed the vm86 system call: General protection fault: 0000 1 PREEMPT SMP CPU: 4 PID:...

Astra Linux – Vulnerability in binutils

“rememberKtype” in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption also known as OOM. This can occur during the execution of cxxfilt...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: A overflow issue was fixed in the bitmapipcreate function before the bitmap was widened. When firstip is 0, lastip is 0xFFFFFFFF, and the netmask is 31, the value of an arithmetic expression 2 netmask - maskbits...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pwm: lpc32xx: Remove handling of PWM channels Since the LPC32xx PWM controllers have only one output, which is registered as the only PWM device/channel per controller, it is known in advance that pwm-hwpwm value is always 0. Bas...

Astra Linux – Vulnerability in glibc

The mqnotify function in the GNU C Library also known as glibc versions 2.32 and 2.33 has a use-after-free vulnerability. It may access the notification thread attributes object passed through its struct sigevent parameter after it has been freed by the caller, resulting in a denial of service...

ROOT-OS-UBUNTU-2404-CVE-2026-43495 CVE-2026-43495 in linux - Patched by Root

Root has patched CVE-2026-43495 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-38190 CVE-2025-38190 in linux - Patched by Root

Root has patched CVE-2025-38190 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

CVE-2026-109394

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest...

EUVD-2026-97492

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest...

CVE-2026-109394 Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest...

CVE-2026-109394

The Thirty bees software (versions through 1.7.0 ) contains an authentication bypass vulnerability within the PasswordController::resolveCustomer() function. This flaw allows unauthenticated attackers to perform an account takeover by exploiting the guest checkout feature. An attacker can initiat...

CVE-2026-109394 Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest...

CVE-2026-109394: Authorization Bypass Through User-Controlled Key

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iomap: Avoid truncating the 64-bit offset to 32 bits. On 32-bit kernels, iomapwritedelallocscan inadvertently used a 32-bit position due to folionextindex returning a unsigned long value. This could lead to an infinite loop when...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: fqpie: Avoid stalls in fqpietimer When setting a high number of flows limit being 65536, fqpietimer currently uses too much time, as reported by syzbot. Add logic to yield the CPU every 2048 flows less than 150...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fixed an issue where the index out of bounds occurred in the DCN30 degamma hardware format translation. This commit addresses a potential index out of bounds issue in the cm3helpertranslatecurvetodegammahwformat...

Astra Linux – Vulnerability in binutils

There is a flaw in binutils /bfd/pef.c. An attacker who can submit a crafted input file for processing by the objdump program could cause a null pointer dereference. The greatest threat of this flaw is to the availability of the application. This flaw affects binutils versions prior to 2.34...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Prevent integer overflow in AG size calculation The JFS filesystem calculates the allocation group AG size using 1 bmap-dbagsize. - Subsequent block allocations will reference invalid AG structures. - This can cause: -...