Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fixed reference count leaks in nfs42proccopynotify. You don’t often receive emails from [email protected]. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification. The reference counting issue...

Astra Linux – Vulnerability in Netty

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high-performance protocol servers and clients. In Netty io.netty:netty-codec-http2, before version 4.1.60.Final, there was a vulnerability that allowed for request smuggling. If...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Do not hold the layoutget locks across multiple RPC calls When performing layoutget as part of the open compound, we must be careful to release the layout locks before calling any further RPC calls, such as setattr. The...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fixed a credential leak in nfs4discovertrunking...

JLSEC-2026-516

A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021626)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021626 advisory. In the Linux kernel, the following vulnerability has been resolved: net: fix crash when config small gsomaxsize/gsoipv4maxsize Config a small...

GHSA-73JC-5MRQ-PRW7 SQLFluff: Uncontrolled Resource Consumption in SQLFluff Parser

Impact In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion. Patches Versions 4.2.0 and up contain a configurable parse node...

WordPress Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Image Deletion vulnerability discovered by Bao Luu Gia Nguyen in WordPress Plugin NextGEN Gallery versions = 4.2.0...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.32 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.14.32 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.14.32 security, enhancement & bug fix update FIXED BUGS: ========== CVEs: ========== CVE-2025-52881...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.19.16 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.19.16 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.19.16 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-6482: Backport to odf-4.19.z ODF installation constantly fails with Assisted Installer CVEs: ==========...

Advisory ROSA-SA-2026-3276

software: ocaml 4.12.0 WASP: ROSA-CHROME unaffected versions = ocaml-4.12.0-3 affected versions ocaml-4.12.0-3 CVE-ID: CVE-2026-28364 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: An out-of-buffer read vulnerability in the Marshal deserialization function runtime/intern.c in OCaml allows a remote attack...

GHSA-QR28-P3WR-MXQ3 ngrok is Vulnerable to Command Injection

ngrok v4.3.3 and 5.0.0-beta.2 are vulnerable to Command Injection...

multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception

Impact [email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property e.g., proto, constructor, toString, the parser invokes .push on the inherited...

CLEANSTART-2026-UV23635 Security fixes for CVE-2026-44431, CVE-2026-44432 applied in versions: 4.3.3-r0

Multiple security vulnerabilities affect the jupyterhub-k8s-hub package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EP51501 Security fixes for CVE-2024-6763, CVE-2025-11143, CVE-2026-1225, CVE-2026-22184, CVE-2026-27171, CVE-2026-34757, CVE-2026-44431, CVE-2026-44432, ghsa-25qh-j22f-pwp8, ghsa-72hv-8253-57qq, ghsa-gc5v-m9x4-r6x2, ghsa-mf9v-mfxr-j63j, ghsa-qccp-gfcp-xxvc, ghsa-qh8g-58pp-2wxh, ghsa-qqpg-mvqg-649v applied in versions: 4.0.1-r1, 4.0.1-r2, 4.0.1-r3, 4.0.1-r4

Multiple security vulnerabilities affect the cassandra-reaper-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2025-57282

ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection...

ngrok 命令注入漏洞

Ngrok is a security internal network penetration and application access platform developed by the US company Ngrok. Versions 4.3.3 and 5.0.0-beta.2 of Ngrok contain command injection vulnerabilities, which are vulnerable to command injection attacks...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: firebird (UTSA-2026-021466)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021466 advisory. Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when...

EUVD-2026-30611

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, validateurl in backend/openwebui/retrieval/web/utils.py calls validators.ipv6ip, private=True, but the validators library does NOT implement the private keyword for IPv6 — the call...

The vulnerability was exploited in Exim.

The developers of Exim introduced a vulnerability in the Exim Mail Transfer Agent versions prior to 4.99.3. This vulnerability involves a use-after-free in the BDAT body parsing process, specifically when certain GnuTLS backend configurations are used. An unauthorized attacker can exploit this...