CVE-2026-84606

A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to identify a user across reinstalls...

CVE-2026-91003

creationtimestamp| type| source ---|---|--- 2026-09-14 16:03:04+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117270235343636544 2026-09-15 08:01:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvk5tuq5ja2e 2026-09-15 15:12:57+00:00| seen|...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftct: Skip the evaluation of rules for confirmed conntrack entries. The nftctexpectobjeval function calls nfctextadd for confirmed conntrack entries. However, nfctextadd can only be called when !nfctisconfirmed is...

Astra Linux – Vulnerability in Firefox

When Firefox is configured to block the storage of all cookies, it is still possible to store data in localstorage by using an iframe with a source of ‘about:blank’. This could allow malicious websites to store tracking data without permission. This vulnerability affects Firefox versions earlier...

Astra Linux – Vulnerability in Thunderbird

It was possible to create an email that included a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird would automatically access the link. The configuration to block remote content did not prevent this behavior. Thunderbird has been updated to no longer allo...

Astra Linux – Vulnerability in Firefox and Thunderbird

The Enhanced Tracking Protection’s Strict mode may have inadvertently allowed a CSP frame-src bypass and DOM-based XSS attacks through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames disguised as legitimate content. This...

Astra Linux – Vulnerability in WebKit2GTK

This issue was resolved by removing the origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4, and iPadOS 16.4; iOS 15.7.4 and iPadOS 15.7.4; tvOS 16.4; and watchOS 9.4. A website may be able to track sensitive user information...

Astra Linux – Vulnerability in Firefox

Mitigation bypass in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 147.0.2...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fpga: region: adding the owner module and taking its reference count The current implementation of the fpga region assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take the...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: netfilter: It is now possible for allow exp to not be removed during the nfctfindexpectation operation. Currently, when the nfconntrackin function calls nfctfindexpectation, the exp is removed from the hash table. However, in som...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: KVM: x86 – Handling of SRCU initialization failures during page track initialization Check the return value of initsrcustruct, which may fail due to OOM conditions when initializing the page track mechanism. Lack of checking lead...

Astra Linux – Vulnerability in WebKit2GTK

An information disclosure issue was resolved by removing the vulnerable code. This issue has been fixed in macOS Monterey 12.5. A website may be able to track the websites a user visited in Safari’s private browsing mode...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iommufd: Do not cause an overflow during division for dirty tracking. If pgshift is 63, then BITSPERTYPEbitmap-bitmap pgsize will result in an overflow to 0, which can trigger a division by zero. In this case, the index should...

bluehood v0.8.0

Bluehood Bluetooth Neighborhood - Track BLE devices in your area and analyze traffic patterns. WARNING: Alpha Software This project is in early development and is not ready for production use. Features may change, break, or be removed without notice. Use at your own risk. Data collected should be...

PT-2026-91703

A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to track users across apps and websites without permission...

Important: expat

Issue Overview: libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, CVE-2026-50219 libexpat before 2.8.2 lacks handler...

foxguard v0.13.0

foxguard Fast local security scanning for code, secrets, dependencies, and crypto risk. Integrated into 0sec, the open cybersecurity harness. root@kitploit: npx foxguard . Why 200+ built-in rules across 12 source languages, plus config and manifest checks Taint tracking for 14 languages, with...

CVE-2026-89488

A flaw was found in the Linux kernel's Open vSwitch OVS component. An unprivileged user, operating from a user and network namespace, can trigger a use-after-free vulnerability during network namespace teardown. This occurs because packet processing attempts to use connection tracking CT limit...

CVE-2026-49992 Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team,...

CVE-2026-49865 Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...