Giga Messenger WordPress - Cross-Site Scripting

Giga Messenger WordPress plugin = 2.3.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

ROOT-APP-GOBINARY-CVE-2026-53492 CVE-2026-53492 in github.com/containerd/containerd/v2 - Patched by Root

Root has patched CVE-2026-53492 in the github.com/containerd/containerd/v2 package for Root:Go. Multiple fixed versions available...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in durable v2 replay of active file handles parsedurablehandlecontext unconditionally assigns dhinfo-fp-conn to the current connection when handling a DURABLEREQV2 context with SMB2FLAGSREPLAYOPERATION...

Astra Linux – Vulnerability in advancecomp

It was discovered that Advancecomp v2.3 contains a heap buffer overflow issue through the leuint32read function in /lib/endianrw.h...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix sleep from invalid context BUG When the qosmutex is used to process RoCEv2 QPs via netdev events, a kernel splat occurs. This issue can be fixed by removing the handling of RoCEv2 in irdmacmteardownconnections tha...

Astra Linux – vulnerability in Apache2

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, Expat, LibXMLTok

In doProlog, within xmlparse.c of the Expat library also known as libexpat, there is an integer overflow issue related to mgroupSize before version 2.4.3...

Astra Linux – Vulnerability in freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol RDP. In versions prior to 2.7.0, NT LAN Manager NTLM authentication does not properly abort when someone provides an empty password value. This issue affects FreeRDP-based RDP Server implementations. RDP clients are not affected. The...

Astra Linux – Vulnerability in Python-Werkzeug

Werkzeug is a comprehensive WSGI web application library. Browsers may allow “nameless” cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on a neighboring subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: NFSD: Protection against send buffer overflow in NFSv2 READDIR. The previous limit on the @count argument has been restored to prevent buffer overflow attacks...

Astra Linux – vulnerability in ruby-loofah

Loofah is a general-purpose library for manipulating and transforming HTML/XML documents and fragments, built upon Nokogiri. Loofah versions = 2.2.0 and 2.19.1 utilize recursion to sanitize CDATA sections; this makes them vulnerable to stack exhaustion and can trigger a SystemStackError exception...

Astra Linux – vulnerability in freerdp2

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP lack input length validation in the drive channel. A malicious server can trick a FreeRDP-based client into reading out-of-bounds data and sending it back to the server. This issue has been resolved in...

Astra Linux – Vulnerability in Firefox and Thunderbird

A use-after-free might have occurred when an HTTP2 session object was released on a different thread, resulting in memory corruption and potentially exploitable crashes. This vulnerability affects Firefox 93, Thunderbird 91.3, and Firefox ESR 91.3...

EUVD-2026-51992

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide BOLA...

ROOT-APP-MAVEN-CVE-2026-45367 CVE-2026-45367 in ca.uhn.hapi.fhir:org.hl7.fhir.validation - Patched by Root

Root has patched CVE-2026-45367 in the ca.uhn.hapi.fhir:org.hl7.fhir.validation package for Root:Maven. Multiple fixed versions available...

EUVD-2026-42267

Grav: Stored CSS injection via Markdown image resize bypasses prior media style sanitizers in Grav...

Astra Linux – Vulnerability in Tomcat9

A denial-of-service attack occurs due to a vulnerability related to improper input validation in HTTP/2 requests handled by Apache Tomcat. When processing an HTTP/2 request, if the request exceeds any of the configured header limits, the associated HTTP/2 stream is not reset until all headers hav...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

The Cross-Privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recently introduced FineIBT, and to leak arbitrary Linux kernel memory on Intel systems...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible Engine when using Ansible Vault to edit encrypted files. When a user executes “ansible-vault edit”, another user on the same computer can read the old and new secrets. This occurs because the secrets are created in a temporary file using mkstemp, and after the fil...

Astra Linux – Vulnerability in cups

Due to a failure in validating the length provided by a PPD PostScript document crafted by an attacker, CUPS and libppd are vulnerable to a heap-based buffer overflow, potentially leading to code execution. This issue has been fixed in CUPS version 2.4.7, released in September 2023...