Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: spi: atcspi200: Fixed an use-after-free issue when the driver unbind. The DMA resource is initialized after the SPI controller is registered. Therefore, when the driver unbind occurs, this can lead to a use-after-free, especially...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. Proper migration requires that additional SNP-specific states, such as...

.NET: .NET Information Disclosure Vulnerability

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

PT-2026-81002

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description A broken object-level authorization issue exists in the REST API company bank account write routes. This allows authenticated attackers with third-party creation rights to create, replace, or delet...

The vulnerability of the longestMatch() function in the plugin/transfer/transfer.go file of the CoredNS DNS server allows a hacker to gain unauthorized access to protected information.

The vulnerability of the longestMatch function in the plugin/transfer/transfer.go file of the CoredNS DNS server is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

CVE-2026-71507: Authorization Bypass Through User-Controlled Key

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

AZL-97257 CVE-2026-74682 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...

CVE-2026-74681

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: check ibuflen against rxbuflen in bulk msg ibuflen is the bulk IN receive buffer size, but the EMSGSIZE check in usbiobulkmsg compares it against txbuflen — the bulk OUT endpoint size. Both are taken independent...

CVE-2026-58001

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

CVE-2026-58001

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery (CSRF) vulnerability in objects/videoEditLight.php . The root cause is the absence of request authenticity checks combined with acceptance of GET requests , which enables state-changing operations via unauthenticated reques...

CVE-2026-58001 WWBN AVideo Cross-Site Request Forgery via videoEditLight.php

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

CVE-2026-58001

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

CVE-2026-58001 WWBN AVideo Cross-Site Request Forgery via videoEditLight.php

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

EUVD-2026-64262

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

SUSE CVE-2026-63382

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first...

CVE-2026-58001: Cross-Site Request Forgery (CSRF)

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled...

PT-2026-79537

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to commit 9c39d8c8 Description A cross-site request forgery CSRF issue exists in the 'objects/videoEditLight.php' endpoint. The system fails to perform request authenticity checks and incorrectly accepts GET requests...

MAL-2026-14344 Malicious code in @js-lib-team/env-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47 Package @js-lib-team/env-parser is advertised as an environment-variable parser but on require/import executes a top-level IIFE in index.js that read...

Linux Distros Unpatched Vulnerability : CVE-2026-63382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate...

CVE-2026-73256

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The httpcb function in src/http.c tests hm.proto.len with an...