CLEANSTART-2024-UF67124 By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the prompt, resulting in th...

CVE-2021-38508 affects multiple packages. By displaying a form validity message in the correct location at the same time as a permission prompt such as for geolocation, the validity message could have obscured the prompt, resulting in the user potentially being tricked into granting the permissio...

CLEANSTART-2024-CN73601 By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the prompt, resulting in th...

CVE-2021-38508 affects multiple packages. By displaying a form validity message in the correct location at the same time as a permission prompt such as for geolocation, the validity message could have obscured the prompt, resulting in the user potentially being tricked into granting the permissio...

AZL-109953 CVE-2026-87866 affecting package curl 8.11.1-11

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -...

CVE-2026-87866

When built with wolfSSL , curl is vulnerable to a public-key pinning bypass. During a TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the certificate—tricked by a manipulated validity length field —extracts and matches a different embedded key. This results in...

CVE-2026-87866 wolfSSL public-key pinning bypass

When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess. During the TLS handshake, wolfSSL validates the connection, but curl's subsequent re-parsing of the same certificate - tricked by a manipulated validity length field -...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: pinctrl: nuvoton: wpcm450: fix an out-of-bounds write issue. The write operation to ‘pctrl-gpiobank’ occurs before the check for the validity of the GPIO index, which may lead to an out-of-bounds write. This issue was detected by...

Astra Linux – Vulnerability in freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol RDP. Prior to version 2.7.0, server-side authentication against a SAM file might succeed with invalid credentials if the server had configured an invalid SAM file path. Clients based on FreeRDP are not affected by this issue. However...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fixed slab-out-of-bounds read in hdrdeletede Here is a BUG report from syzbot: BUG: KASAN: slab-out-of-bounds in hdrdeletede+0xe0/0x150 fs/ntfs3/index.c:806 Read of size 16842960 at addr ffff888079cc0600 by task...

Astra Linux - Vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: serial: max310x: fix NULL pointer dereference in I2C instantiation When attempting to instantiate a max14830 device from userspace: echo max14830 0x60 /sys/bus/i2c/devices/i2c-2/newdevice the following error occurs: Unable to...

Astra Linux – vulnerability in Firefox and Thunderbird

By using reportValidity and window.open, a plain-text validation message could have been displayed on another origin, potentially causing user confusion and enabling spoofing attacks. This vulnerability affects Firefox 93, Thunderbird 91.2, and Firefox ESR 91.2...

Astra Linux – vulnerability in Firefox and Thunderbird

By displaying a form validation message in the correct location alongside a permission prompt—such as one used for geolocation—the validation message might cover up the prompt, potentially tricking the user into granting the permission. This vulnerability affects Firefox 94, Thunderbird 91.3, and...

CVE-2026-101271 OAuth credentials not disabled when application is disabled

OAuth credentials access tokens are valid for the entirety of their lifetime, even if the application OAuth client they are bound to is manually disabled...

GO-2026-6537 nginx ignition has TOTP Reuse During Validity Window in github.com/lucasdillmann/nginx-ignition

nginx ignition has TOTP Reuse During Validity Window in github.com/lucasdillmann/nginx-ignition...

GHSA-HF33-Q6CF-C66F nginx ignition has TOTP Reuse During Validity Window

Summary Any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Details The https://github.com/pquerna/otp package doesn't include checking for already used TOTPs within its the validity window. This requires each application that uses the...

CVE-2026-61630

nginx ignition (a web user interface for nginx) in versions 2.33.0 through 2.35.0 allows any user who has enabled OTP 2FA to have their TOTP token reused during the standard 30-second validity window. The issue is fixed in version 2.35.1 . The CVSS 3.1 score is 4.2 (MEDIUM) , reflecting high atta...

CVE-2026-61630 nginx ignition has TOTP Reuse During Validity Window

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

CVE-2026-61630 nginx ignition has TOTP Reuse During Validity Window

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

Attack Success Rate Is Not a Number: On Measurement Validity in Agentic AI Security Evaluation

Attack success rate ASR is the headline metric in nearly every published evaluation of attacks on, and defenses for, LLM agents. We argue that ASR as currently used is not a single quantity but a family of metrics parameterized by six design choices that papers seldom specify and never hold...

Astra Linux – Vulnerability in Thunderbird

When receiving an email message signed with OpenPGP/MIME and containing an additional outer MIME message layer, such as a message footer added by a mailing list gateway, Thunderbird only considers the signed inner message for signature validity. This creates the false impression that the addition...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: f2fs: A fix was made to perform a sanity check on totaldatablocks. As reported by Yanming in Bugzilla: https://bugzilla.kernel.org/showbug.cgi?id=215916 The kernel message is as follows: Kernel BUG at fs/f2fs/segment.c:2560! Call...