13942 matches found
CVE-2026-49287
Statamic is a Laravel and Git powered content management system CMS. Prior to 5.73.23 and 6.20.0, the fix for CVE-2026-41175 was incomplete. It addressed the issue in the query builder, but the same protection was not applied to in-memory collection sorting. Manipulating sort parameters could...
CVE-2026-49288
Statamic is a Laravel and Git powered content management system CMS. Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: RDMA/mlx5: Fixed an issue where the error path resulted in a fall-through in mlx5ibdevressrqinit. The mlx5ibdevressrqinit function allocates two SRQs, s0 and s1. When ibcreatesrq fails for s1, the error handling code destroys...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix VF illegal register access The register WXCFGPORTST is a PF restricted register. When initializing a VF, attempting to read this register triggers an illegal register access, which can cause the system to hang. Wh...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: ibmvnic: fixed a race condition between xmit and reset There is a race condition between the reset path and the transmit path that can cause ibmvnicxmit to access an SCRQ after it has been freed in the reset path. This can...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: Protect memcgpath calls using damonsysfslock. The patch addresses the issue where reading and writing files named memcgpath in the DAMON sysfs interface can occur simultaneously with writing operations,...
ROOT-APP-PYPI-GHSA-58PV-8J8X-9VJ2 GHSA-58pv-8j8x-9vj2 in rootio-jaraco.context - Patched by Root
Root has patched GHSA-58pv-8j8x-9vj2 in the rootio-jaraco.context package for Root:PyPI. Multiple fixed versions available...
tinyproxy-1.11.3-3.1 on GA media (moderate)
tinyproxy-1.11.3-3.1 on GA media Announcement ID: openSUSE-SU-2026:11060-1 Rating: moderate Cross-References: CVE-2026-54387 CVE-2026-54388 CVE-2026-55202 Affected Products: openSUSE Tumbleweed An update that solves 3 vulnerabilities can now be installed. Description: These are all security issue...
ROOT-APP-GOBINARY-CVE-2026-33218 CVE-2026-33218 in rootio-github.com/nats-io/nats-server/v2 - Patched by Root
Root has patched CVE-2026-33218 in the rootio-github.com/nats-io/nats-server/v2 package for Root:Go. Multiple fixed versions available...
Siemens RUGGEDCOM RST2428P Improper Input Validation (CVE-2025-40252)
In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qedetpacont and qedetpaend The loops in 'qedetpacont' and 'qedetpaend', iterate over 'cqe-lenlist' using only a zero- length terminator as the stopping condition. If the...
PT-2026-50816
Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 1.0 through 9.15 Description An issue exists in the named restore point endpoint 'POST /browser/server/restore point/gid/sid' where the user-supplied value field is interpolated directly into the SQL string using str.format...
GHSA-6PR9-RP53-2PMC vLLM: OOM Denial of Service via Audio Decompression Bomb
Summary vLLM's /v1/audio/transcriptions endpoint limits compressed upload size but not decoded PCM output. A 25MB OPUS file expands to 14.9GB of float32 PCM at decode time. Tested on vLLM v0.19.0. Details SpeechToTextProcessor rejects uploads over VLLMMAXAUDIOCLIPFILESIZEMB default 25MB based on...
DEBIAN-CVE-2026-44587
CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the contenttypedenylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is intended to block. In...
[SECURITY] [DLA 4633-1] libreoffice security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4633-1 [email protected] https://www.debian.org/lts/security/ Rene Engelhard June 17, 2026 https://wiki.debian.org/LTS -...
RHSA-2026:26180 Red Hat Security Advisory: mysql:8.4 security update
Bulletin has no description...
RHSA-2026:26181 Red Hat Security Advisory: postgresql:15 security update
Bulletin has no description...
kernel: libceph: make decode_pool() more resilient against corrupted osdmaps
In the Linux kernel, the following vulnerability has been resolved: libceph: make decodepool more resilient against corrupted osdmaps If the osdmap is maliciously corrupted such that the encoded length of cephpgpool envelope is less than what is expected for a particular encoding version,...
kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done()
In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handleauthdone Perform an explicit bounds check on payloadlen to avoid a possible out-of-bounds access in the callout. idryomov: changelog...
