XWiki Platform - Information Disclosure

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. id: CVE-2025-55747 info: name: XWiki Platform - Information Disclosure author: Redmomn...

Dgraph <= 25.3.2 - Admin Token Disclosure

Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...

CVE-2024-6387fixshell

CVE-2024-6387fixshell Only affects 8.5p1 = OpenSSH 9.8p1 Install build dependencies sudo apt-get update sudo apt-get install -y build-essential zlib1g-dev libssl-dev Download specified version source code wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.8p1.tar.gz Extract and...

Astra Linux – vulnerability in Apache2

Vulnerability related to unrestricted resource allocation or throttling in Apache HTTP Server’s modmd, caused by OCSP response data. This issue affects Apache HTTP Server versions 2.4.30 through 2.4.66. Users are advised to upgrade to version 2.4.67, which resolves the issue...

Astra Linux – vulnerability in Tomcat9

Vulnerability related to improper resource shutdown or release in Apache Tomcat. If an error occurs including exceeding limits during the processing of a multipart upload, temporary copies of the uploaded parts written to disk are not cleaned up immediately; instead, they are left to be deleted b...

Astra Linux – vulnerability in netty

Netty is an asynchronous, event-driven network application framework designed for rapidly developing highly maintainable, high-performance protocol servers and clients. In versions prior to 4.1.71.Final, Netty skips control characters that appear at the beginning or end of a header name. However,...

Astra Linux – Vulnerability in Tomcat9

There is a vulnerability related to improper input validation in Apache Tomcat Native and Apache Tomcat. When using an OCSP responder, Apache Tomcat Native and Tomcat’s FFM port of the Apache Tomcat Native code failed to perform verification or freshness checks on the OCSP response, allowing...

Astra Linux – Vulnerability in Tomcat9

Inconsistent interpretation of HTTP requests „HTTP Request/Response Smuggling“ vulnerability in Apache Tomcat due to an invalid chunk extension. This issue affects Apache Tomcat: versions from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0...

Astra Linux – Vulnerability in Containerd

Containerd is an open-source container runtime. A bug was discovered in Containerd’s CRI implementation, where a user could exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user’s process fails to launch d...

Astra Linux – Vulnerability in openssl1.0

Calls to the EVPCipherUpdate, EVPEncryptUpdate, and EVPDecryptUpdate functions may cause the output length argument to overflow in some cases where the input length is close to the maximum permissible length for integers on the platform. In such cases, the return value from the function call will...

Astra Linux – Vulnerability in Apache Log4j2

In Apache Log4j Core versions 2.0-beta9 through 2.25.2, the Socket Appender does not perform TLS hostname verification of the peer certificate, even when the verifyHostName configuration attribute https://logging.apache.org/log4j/2.x/manual/appenders/network.htmlSslConfiguration-attr-verifyHostNa...

Chromium, Google Chrome, Microsoft Edge, Opera, Vivaldi: Multiple Vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Microsoft Edge is a browser that combines a minimal design with...

BIT-TOMCAT-2025-66614 Apache Tomcat: Client certificate verification bypass due to virtual host mapping

Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0 through 11.0.14, from 10.1.0 through 10.1.49, from 9.0.0 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions...

CVE-2026-16239 affecting package postgresql for versions less than 16.15-1

CVE-2026-16239 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-14679 affecting package postgresql for versions less than 16.15-1

CVE-2026-14679 affecting package postgresql for versions less than 16.15-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-46600 affecting package golang for versions less than 1.26.6-1

CVE-2026-46600 affecting package golang for versions less than 1.26.6-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-73075 affecting package vim for versions less than 9.2.0957-1

CVE-2026-73075 affecting package vim for versions less than 9.2.0957-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-18503 affecting package python3 for versions less than 3.12.14-1

CVE-2026-18503 affecting package python3 for versions less than 3.12.14-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-75935 Memory-amplification denial of service via declared-length preallocation in Amazon ion-java

Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users shou...

CVE-2026-75090

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convertgguftohftokenizer of the file mistralrs-core/src/gguf/gguftokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eostokenid/bostokenid/unknowntokenid results...