CVE-2026-77181

Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp. This issue affects Apache Syncope: from...

CLSA-2026-1789391519 TuxCare security update for org.bouncycastle (4 CVEs)

TuxCare rebuilt 38 org.bouncycastle packages to address 4 CVEs. Fixed in 1.77-tuxcare.2...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.73 bug fix and security update

Red Hat OpenShift Container Platform release 4.14.73 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

CVE-2026-77181 Apache Syncope: ClientApp update entitlement not effective

Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp. This issue affects Apache Syncope: from...

CVE-2026-77181

An Incorrect Authorization vulnerability exists in Apache Syncope where administrators with ClientApp update entitlement are unable to perform related operations because the system incorrectly checks for create entitlement during both create and update operations. This issue affects versions 3.0....

CVE-2026-77181 Apache Syncope: ClientApp update entitlement not effective

Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp. This issue affects Apache Syncope: from...

EUVD-2026-77444

Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp. This issue affects Apache Syncope: from...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fixed the buffer overflow in showrcutasksTracegpkthread. There is a possibility of buffer overflow in showrcutasksTracegpkthread if the counters passed to sprintf are very large. The counter values used for this functi...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: schhfsc: made hfscqlennotify idempotent. hfscqlennotify itself is not idempotent, and it is not friendly to its callers, like fqcodeldequeue. We need to make it idempotent to ease the work of qdisctreereducebacklog callers: 1...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: net/mlx5e: Fixed a use-after-free in the neigh update handler for the encap entry. The function mlx5erepneighupdate was not updated to accommodate the removal of the rtnl lock from the TC filter update path, and it did not...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject unhashed sockets in bpfskassign The semantics for bpfskassign are as follows: c sk = somelookupfunc bpfskassignskb, sk bpfskreleasesk That is, the sk is not consumed by bpfskassign. Therefore, the function must ensure...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fixed the cleanup flow for mlx5eprivinit. When mlx5eprivinit fails, the cleanup flow calls mlx5eselqcleanup, which in turn calls mlx5eselqapply. This ensures that priv-statelock is held using lockdepisheld. The statelo...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: arm64: The issue was fixed in the concurrently setting of insnemulation sysctls. The emulationprochandler function changes table-data for procdointvecminmax. However, it may cause an OOPs error if called concurrently with itself:...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7923: Fixed buffer overflow issues for txbuf and ringxfer. The AD7923 was updated to support devices with 8 channels, but the sizes of txbuf and ringxfer were not adjusted accordingly, resulting in a potential buffer...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: bridge: mst: fix vlan use-after-free The syzbot reported a suspicious RCU usage1 in the mst code of bridge. While fixing this issue, I noticed that nothing prevents vlan information from being freed while walking the list...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: binfmtflat: Corruption occurred when data start offsets were not applied. The commit 04d82a6d0881 “binfmtflat: Allow not offsetting data start” introduced a RISC-V-specific variant of the FLAT format. This variant does not alloca...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - In the net subsystem, do not delay the execution of dstentriesadd within dstrelease. - dstentriesadd uses data per-core that might be freed during the dismantling of ip6routenetexit, by calling dstentriesdestroy. Before...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fpga: region: adding the owner module and taking its reference count The current implementation of the fpga region assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take the...

Astra Linux – Vulnerability in Zabbix

A authenticated user with API access e.g., a user with the default User role can be added to any group e.g., Zabbix Administrators. Specifically, a user with access to the user.update API endpoint can be added to any group, except for groups that are disabled or have restricted GUI access...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: The ATTRCTIME flags were set when setting the mtime. David reported that the new warning from setattrcopymgtime appears as follows: 113.215316 ------------ Cut here ----------- 113.215974 WARNING: CPU: 1 PID: 31 at...