Astra Linux – Vulnerability in ldns

When ldns version 1.7.1 verifies a zone file, the ldnsrrnewfrmstrinternal function has a heap out-of-bounds read vulnerability. An attacker can leak information from the heap by constructing a zone file payload...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: btrfs: Zoned – Initialize the device’s zone info for seeding When performing seeding on a zoned filesystem, it is necessary to initialize the btrfszoneddeviceinfo structure of each zoned device. Otherwise, mounting the filesystem...

Astra Linux – Vulnerability in bind9

If a BIND resolver performs DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU resources. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries see:...

Astra Linux – Vulnerability in Golang 1.19, Golang 1.23

The matching of hosts against proxy patterns may improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to “.example.com”, a request to “::1%25.example.com:80” will be incorrectly matched and not be proxied...

Astra Linux – Vulnerability in Golang 1.19, Golang 1.23

A certificate with a URI that has an IPv6 address and a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not allowed in web PKIs; therefore, this only affects users of private PKIs that use URIs...

Linux Distros Unpatched Vulnerability : CVE-2025-56535

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A cross-site scripting XSS vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into...

Shopping privilege escalation through missing authorization in Settings components

Summary Four Livewire components in the Settings area expose destructive Filament actions delete / edit that perform no server-side authorization. Any authenticated user who can reach the Settings pages — i.e. holding only the coarse accesssetting permission, without being an admin and without an...

CVE-2026-89612

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid MFT LCNs from boot sector The NTFS boot sector stores the MFT and MFTMirr locations as unsigned 64-bit LCNs, but parsentfsbootsector decoded them into an s64. A crafted high-bit value could therefore become...

PT-2026-90328

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NTFS boot sector processing where MFT and MFTMirr locations, stored as unsigned 64-bit LCNs Logical Cluster Numbers, are incorrectly decoded into signed 64-bit...

CVE-2026-75999 ColdFusion | Improper Input Validation (CWE-20)

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative...

EUVD-2026-74067

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative...

Important: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.11.0 release

Red Hat OpenShift distributed tracing platform Tempo 3.11.0 has been released This release of the Red Hat OpenShift distributed tracing platform Tempo provides new features, security improvements, and bug fixes. Breaking changes: High availability defaults for TempoStack deployment sizes: Before...

CVE-2026-75999: Improper Input Validation

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative...

EulerOS 2.0 SP12 : dhcp (EulerOS-SA-2026-3329)

According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053258)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053258 advisory. In the Linux kernel, the following vulnerability has been resolved: thermal: Fix NULL pointer dereferences in ofthermal functions ofparsethermalzones parses the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053344)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053344 advisory. In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix thermal zone governor cleanup issues If thermalzonedeviceregisterwithtrips fai...

CVE-2026-83961

ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limited read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation of...

CVE-2026-83961 ColdFusion | Improper Authentication (CWE-287)

ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limited read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation of...

CVE-2026-83961

Adobe ColdFusion is affected by an Improper Authentication vulnerability (CWE-287) that could allow an unauthenticated attacker to escalate privileges and gain limited read and write access . By default, the vulnerable component is restricted to an administrative network zone , and exploitation r...

CVE-2026-62994

A flaw was found in CoreDNS, a DNS server. A remote attacker can trigger a denial of service by sending a specially crafted AXFR request to a CoreDNS zone. This occurs when CoreDNS is configured with k8sexternal headless-service zone transfers and Kubernetes contains a headless service endpoint...