Astra Linux – Vulnerability in GIMP

GIMP XWD File Parsing: Out-of-Bounds Write Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a malicious file. The...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: The x-tunnel is deleted as soon as the x is deleted. The ipcomp fallback tunnels are currently deleted from various lists and hashtables because the last user state that relied on those fallbacks is destroyed not deleted. I...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: reset: gpio: Suppressing the bind attributes in sysfs. This is a special device that is created dynamically and is supposed to remain in memory forever. Currently, there is no devlink between this device and the actual reset...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm: Property blob allocations to memcg The DRMIOCTLMODECREATEPROPBLOB function allows userspace to allocate property blobs of arbitrary size, which are backed by kernel memory. Currently, the blob data allocation is not accounte...

Astra Linux – Vulnerability in util-linux

util-linux is a collection of Linux utilities. Prior to version 2.41.4, a TOCTOU Time-of-Check-Time-of-Use vulnerability was identified in the SUID binary /usr/bin/mount from util-linux. When the mount binary sets up loop devices, it validates the source file path with user privileges using fork ...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Tracing: The WARNON message in tracingbuffersmmapclose has been fixed. When a process forks, the child process copies the parent’s virtual memory addresses, but the usermapped reference count is not incremented. As a result, when...

Astra Linux – Vulnerability in GIMP

GIMP JP2 File Parsing: Heap-Based Buffer Overflow and Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability, as the target must visit a malicious page ...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbdev: smscufx – The data passed through ioctl is copied to the kernel’s space properly. The UFXIOCTLREPORTDAMAGE ioctl does not copy data from user space to the kernel’s space properly. Instead, it directly references the memory...

Astra Linux – Vulnerability in Chromium

In Google Chrome, policy bypass in the “Audio” section prior to version 147.0.7727.55 allowed a remote attacker who convinced a user to perform certain UI gestures to bypass sandbox download restrictions through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fixed a double-free in rxesrqfrominit. In rxesrqfrominit, the queue pointer ‘q’ is assigned to ‘srq-rq.queue’ before copying the SRQ number to user space. If copytouser fails, the function calls rxequeuecleanup to free...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: AppArmor: Fixed the issue by limiting the number of levels of policy namespaces. Currently, the number of policy namespaces is not bounded, relying on the user namespace limits. However, policy namespaces are not strictly tied to...

CVE-2026-57279

Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product...

CVE-2026-57279

The CVE-2026-57279 entry concerns Cybozu Garoon with a Cross-Site Scripting (CWE-79) vulnerability in the Scheduler component. An attacker could inject and execute arbitrary script in the web browser of a user who is logged into Garoon, potentially leading to session takeover or hijacking of user...

EUVD-2026-55082

Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product...

CVE-2026-18200 FoodBoxBooker < 1.0.8 - Subscriber+ Arbitrary User Profile Update

The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators...

CVE-2026-18200

The FoodBoxBooker WordPress plugin is affected by CVE-2026-18200 (WordPress plugin

EUVD-2026-54994

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

EUVD-2026-55007

The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclos...

CVE-2026-18960 Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...

EUVD-2026-55011

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...