Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fixed reference count leaks in nfs42proccopynotify. You rarely receive emails from [email protected]. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification. The reference counting issue occurs i...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2 in versions prior to 2.06, where it incorrectly enabled the use of the ACPI command when Secure Boot was enabled. This flaw allows an attacker with privileged access to create a Secondary System Description Table SSDT containing code that can overwrite the Linux...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The issue of a null pointer dereference error in generateencryptionkey has been fixed. If a client sends two session setups with KRB5 authentication to ksmbd, a null pointer dereference error in generateencryptionkey can...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pwm: lpc32xx: Remove handling of PWM channels Since the LPC32xx PWM controllers have only one output, which is registered as the only PWM device/channel per controller, it is known in advance that pwm-hwpwm value is always 0. Bas...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2. A specially crafted JPEG file can cause the JPEG parser in grub2 to incorrectly check the boundaries of its internal buffers, leading to an out-of-bounds write. The possibility of overwriting sensitive information to bypass secure boot protections is still a concer...

Astra Linux – Vulnerability in poppler, poppler-22

Before version 25.04.0, crafted input files could cause out-of-bounds reads in the JBIG2Bitmap::combine function within JBIG2Stream.cc, due to an improperly placed isOk check...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, the WriteSVGImage function contained a vulnerability where using an integer variable to store numberattributes could lead to integer overflow. This, in turn, triggered a buffe...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Use two-phase skb reclamation in ieee80211dostop Since 'devqueuexmit' should be called with interrupts enabled, the following backtrace is shown: ieee80211dostop … spinlockirqsave&local-queuestopreasonlock, flags ...

Astra Linux – Vulnerability in net-snmp

Net-SNMP provides various tools related to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials could exploit an improper input validation vulnerability when setting malformed OIDs in both the master agent and subagent simultaneously. Version 5.9.2...

Astra Linux – Vulnerability in Ruby 2.5

URI is a module that provides classes for handling Uniform Resource Identifiers. In versions 0.12.4 and earlier bundled with Ruby 3.2 series, 0.13.2 and earlier bundled with Ruby 3.3 series, 1.0.3 and earlier bundled with Ruby 3.4 series, when using the + operator to combine URIs, sensitive...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fixed an issue where the BIOS boundary checking was off by one. Bounds checking during the parsing of init scripts embedded in the BIOS prevents access to the last byte. This causes driver initialization to fail on...

ROOT-APP-MAVEN-CVE-2026-45367 CVE-2026-45367 in ca.uhn.hapi.fhir:org.hl7.fhir.validation - Patched by Root

Root has patched CVE-2026-45367 in the ca.uhn.hapi.fhir:org.hl7.fhir.validation package for Root:Maven. Multiple fixed versions available...

WordPress WP 2FA plugin < 4.1.0 - Two-Factor Authentication Bypass vulnerability

Two-Factor Authentication Bypass vulnerability discovered by Suhayb Ahmed cyboltx in WordPress Plugin WP 2FA versions 4.1.0...

Efficient Auditing of Adversarial AI Agent Behavior from Agent Traces

AI agents powered by large language models LLMs can perform complex tasks but may harm the systems they operate in, either intentionally or unintentionally. Existing agent monitoring approaches rely on rule-based guardrails or LLM-based trace auditing. However, rule-based guardrails can be bypass...

Security Bulletin: Vulnerabilities reported in compiler-21.2.4.tgz are addressed in APIM 11.1

Summary Vulnerabilities reported in compiler-21.2.4.tgz are addressed in APIM 11.1 Vulnerability Details CVEID:CVE-2026-54265 DESCRIPTION: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17,...

CVE-2026-103514

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

EUVD-2026-91934

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

CVE-2026-103514 WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

CVE-2026-103514 WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

CVE-2026-103514

The WP 2FA WordPress plugin, in versions prior to 4.1.0 , is vulnerable to a two-factor authentication bypass. The root cause is the failure to invalidate a time-based one-time passcode (TOTP) after its initial use. An attacker who possesses an account's password and observes a valid code within ...