netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the DelegatingDecompressorFrameListener class. This resource leak could lead to an Out Of Memory Error OOME, potentially causing a Denial of Service DoS by taking down th...

CVE-2026-104809 Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

CVE-2026-104809 Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

CVE-2026-104809

The Mitel MiVoice Office 400 is vulnerable to a Shared Object Hijacking vulnerability. The issue stems from a loading mechanism that relies on a predictable module name without performing adequate integrity or origin verification. An attacker can place a malicious .so file in the expected path, w...

CVE-2026-104809: External Control of File Name or Path

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

trivy v0.75.0

📖 Documentation Trivy pronunciation is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues. Targets what Trivy can scan: Container Image Filesystem Git Repository remote Virtual Machine Image Kubernetes...

CVE-2026-100658

A flaw was found in Netty. An unbounded memory queue in the WebSocket server extension handler allows an unauthenticated remote attacker to cause a Denial of Service DoS. By sending pipelined HTTP requests faster than the server produces responses, an attacker can force the connection queue to gr...

Docker Control System Record-Output Command Execution

The vulnerability of the “record-output” parameter at the final destination /instances/$name/exec of the Docker control system and the Incus virtual machine manager is related to improper external management of file names or file paths. Exploiting this vulnerability allows a remote attacker to...

CVE-2026-93604

A flaw was found in vm2. Untrusted guest code can exploit this vulnerability when the crypto builtin is explicitly allowlisted for a NodeVM Node.js Virtual Machine. By calling the crypto.setFips function, an attacker can modify the FIPS Federal Information Processing Standards mode of the entire...

CVE-2026-66079

A flaw was found in RabbitMQ. An unauthenticated network attacker can exploit an issue in the AMQP 1.0 listener by sending a specially crafted 19-byte frame. This causes the system to attempt to build a list of approximately 4 billion empty elements, exhausting heap memory and terminating the...

CVE-2026-89425

A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted, malformed token to the JsonFactory.createParserDataInput method. The UTF8DataInputJsonParser component, responsible for handling DataInput...

ROS-20260923-73-0012

The vulnerability of the kvmresetdirtygfn function in the virt/kvm/dirtyring.c module of the Kernel-based Virtual Machine KVM subsystem of the Linux operating system is related to integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability could allow an attacker to compromise...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing

A flaw was found in RabbitMQ. An unauthenticated network attacker can exploit an issue in the AMQP 1.0 listener by sending a specially crafted 19-byte frame. This causes the system to attempt to build a list of approximately 4 billion empty elements, exhausting heap memory and terminating the...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

A flaw was discovered in KVM. When calling the KVMGETDEBUGREGS ioctl on 32-bit systems, there might be uninitialized portions of the kvm Debugregs structure that could be copied into user space, resulting in an information leak...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: igb: Initialize the mailbox message for VF reset When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. However, memory is allocated from the stack, which means that information may b...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: KVM: Do not corrupt the irqfd routing entry when deassigning an irqfd When deassigning a KVMIRQFD, do not corrupt the irqfd’s copy of the IRQ routing entry. Doing so would break the kvmarchirqbypassdelproducer function on x86...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in the QEMU implementation of VMWare’s paravirtual RDMA device. The issue arises when handling the “PVRDMACMDCREATEMR” command due to improper memory remapping mremap. This flaw allows a malicious guest to crash the QEMU process on the host. The greatest threat posed by this...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: uiohvgeneric: The issue of NULL pointer dereferencing in hvuiorescind has been fixed. For primary VM Bus channels, the primarychannel pointer is always NULL. This pointer is valid only for secondary channels. Additionally, the...

Astra Linux – Vulnerability in Qemu

It was found that the patch for CVE-2020-17380/CVE-2020-25085 is ineffective. As a result, QEMU becomes vulnerable to out-of-bounds read/write access issues that were previously identified in the SDHCI controller emulation code. This flaw allows a malicious privileged attacker to crash the QEMU...