Astra Linux – Vulnerability in Python-Django

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are vulnerable to a ReDoS regular expression denial of service attack due to a very large number of domain name labels for emails and URLs...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: i40e: Fixed idx validation in i40evalidatequeuemap. Ensured that the idx value is within the range of active/initialized TC’s when iterating over vf-chidx in i40evalidatequeuemap...

Astra Linux – vulnerability in linux-firmware

Improper input validation in certain IntelR PROSet/Wireless WiFi and KillerTM WiFi software may allow an authenticated user to potentially enable privilege escalation via local access...

Astra Linux – vulnerability in exempi

The XMP Toolkit SDK version 2020.1 and earlier is affected by an Improper Input Validation vulnerability that may lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction; a victim must open a specially crafted file...

Astra Linux – vulnerability in python-django

In Django 3.2 prior to 3.2.19, 4.x prior to 4.1.9, and 4.2 prior to 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField only the last uploaded file was validated...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate index root when initialize NTFS security This enhances the sanity check for $SDH and $SII while initializing NTFS security, ensuring that these index roots are legitimate. 162.459513 BUG: KASAN: use-after-free ...

Astra Linux – vulnerability in intel-microcode

Improper input validation in UEFI firmware for certain IntelR processors may allow a privileged user to potentially enable information disclosure via local access...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: validate nvmelocalport correctly The driver load failed with an error message: qla2xxx 0000:04:00.0-ffff:0: registerlocalport failed: ret=ffffffef and resulted in a kernel crash: BUG: unable to handle kernel NULL...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Calipso: Do not call Calipso functions for AFINET sk. Syzkaller reported a null-ptr-deref in txoptget. 0 The offset 0x70 corresponds to struct ipv6txoptions within struct ipv6pinfo; thus, struct ipv6pinfo was NULL at that locatio...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: greybus: lights: check return of getchannelfrommode If no channel for the given node is found, we return null from getchannelfrommode. Be sure to validate the return pointer before using it in two of the missing places. This was...

Astra Linux – Vulnerability in freerdp3

FreeRDP before version 3.29.0 affected versions ≤ 3.28.0 contains a vulnerability related to improper certificate hostname validation. The TLS hostname matcher tlcMatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending with...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks whether it has three endpoints, as well as endpoints for bulk in-and-out operations. However, it does not check whether the third endpoint is an interrupt input. Th...

openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages

A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...

ai.djl/api: Integer overflow in tensor buffer validation in Deep Java Library

A flaw was found in Deep Java Library. Due to an integer overflow during tensor buffer validation, a remote, unauthenticated attacker can send a crafted tensor payload to trigger out-of-bounds memory access. Successful exploitation can allow an attacker to obtain sensitive data from adjacent...

SUSE CVE-2026-101019

Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...

SUSE CVE-2026-105236

Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there. A server that serves several SNI nam...

Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability

Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network...

Why AI Confidence Is Not Validation

AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools are growing more confident in their own output faster than practitioners are developing reliable ways to verify it. Without governance models and...

PYSEC-2026-4220 Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Summary The Headroom WebSocket server does not validate the Origin header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious...

curl: CVE-2026-111483: GnuTLS accepts non-successful OCSP staples

A vulnerability was identified in curl version 8.22.0 and 8.23.0 when built with GnuTLS. The --cert-status option failed to properly validate stapled OCSP responses. Instead of checking the response status and certificate status within the response, the code only verified that some stapled OCSP...