Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Before versions 2.2.20, 3.1.18, and 3.2.3, Rack::RequestPOST would read the entire request body into memory when the Content-Type was application/x-www-form-urlencoded. This action did not enforce any length or capacity limits on the input. As a result...

Veeam ONE < 13.1.0.7034 Multiple Vulnerabilities (kb4892)

The version of Veeam ONE installed on the remote host is prior to 13.1.0.7034. It is, therefore, affected by multiple vulnerabilities, including: - A vulnerability allowing remote unauthenticated code execution on the agent host. CVE-2026-64633 - A vulnerability allowing a low-privileged user to...

Memory Allocation with Excessive Size Value

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the toByteArray method of DefiniteLengthInputStream, which allocates new byteintremaining up front from t...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the toByteArray method of DefiniteLengthInputStream, which allocates new byteintremaining up front from the declared ASN.1 definite-length value before reading any content. An attacker can...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the toByteArray method of DefiniteLengthInputStream, which allocates new byteintremaining up front from the declared ASN.1 definite-length value before reading any content. An attacker can...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file's MAC data and encrypted bags into key derivation during engineLoad without enforcing...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the S2K.Argon2Params class and the PGPUtil.makeKeyFromPassPhrase method, which read the one-byte OpenPGP Argon2 passes, parallelism, and memory-size exponent fields with only a...

Improper Input Validation

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power...

PT-2026-66566

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service process abort via stack exhaustion via...

Improper Verification of Cryptographic Signature

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the verifysignature parameter in the Azure AD OAuth login defaulting to False,...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization in the processuploadedfile process. An attacker can modify the file membership of a knowledge base without proper authorization by supplying a crafted metadata.knowledgeid value during...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the navigation mechanisms when attacker-supplied paths containing a backslash are processed. An attacker can redirect users to unintended external sites by crafting malicious links or inputs. Remediation Upgrade...

sh _uid does not drop supplementary groups (incomplete privilege drop)

ImpactThe uid option performed an incomplete privilege drop on Linux/Unix-like systems.When sh was run from a process with elevated privileges, such as root, and a command was launched with uid=, the child process changed its UID and primary GID but did not reset its supplementary groups. As a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of xDS RBAC policies and HTTP/2 transport handling. An attacker can gain unauthorized access to protected services or cause denial of service by exploiting improper handling of unsupported field...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the media upload. An attacker can access unauthorized network resources by submitting crafted input paths that are processed by the upload feature. Th...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the allowedAgentIds validation. An attacker can gain unauthorized access to restricted actions by submitting blank agent IDs, thereby bypassing intended...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...