p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Schwachstellen im Stack Betriebssysteme · Seite 176

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für Betriebssysteme: 6855. Davon im KEV-Katalog: 4.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Betriebssysteme

Sicherheitslücken: 160938

  1. CVE-2026-110672

    Hoch · CVSS 7.5EPSS 0,49%Korrektur verfügbar

    Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv

    Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set. A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.

    libcpanel-json-xs-perl libcpanel-json-xs-perl libcpanel-json-xs-perl libcpanel-json-xs-perl libcpanel-json-xs-perl libcpanel-json-xs-perl libcpanel-json-xs-perl libcpanel-json-xs-perl libcpanel-json-xs-perl libcpanel-json-xs-perlBetriebssysteme
    • Auf 4.80-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. openSUSE-SU-2026:22131-1

    Nicht bewertetKorrektur verfügbar

    Security update for varnish

    This update for varnish fixes the following issues: Changes in varnish: - update to 7.7.3 (bsc#1280114, CVE-2025-8671): * https://vinyl-cache.org/docs/7.7/whats-new/changes-7.7.html * https://vinyl-cache.org/security/VSV00017.html#vsv00017 - Update to release 7.7.1 * VSV-16: Resolve request smuggling attack - Update to release 7.7.0 * The `linux` jail gained control of transparent huge pages settings. * An issue has been fixed which could cause a crash when varnishd receives an invalid Content-Range header from a backend. * Timestamping for HTTP/2 requests (when idle period begins) has been switched to be more in l

    varnishBetriebssysteme
    • Auf 7.7.3-bp160.1.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-111759

    Hoch · CVSS 7.5EPSS 0,59%Korrektur verfügbar

    markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

    markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2.

    markdown-it node-markdown-it node-markdown-it node-markdown-it markdown-it markdown-it node-markdown-it node-markdown-it node-markdown-it node-markdown-itBetriebssysteme Node.js
    • Auf 14.3.2 aktualisieren
    • Auf 15.0.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-111755

    Hoch · CVSS 8.2EPSS 0,47%Öffentlicher ExploitKorrektur verfügbar

    follow-redirects sensitiveHeaders regex escaping can expose credential headers

    follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.

    follow-redirects node-follow-redirects node-follow-redirects node-follow-redirects follow-redirects node-follow-redirects node-follow-redirects node-follow-redirects node-follow-redirects node-follow-redirects node-follow-redirectsBetriebssysteme Node.js
    • Auf 1.16.1 aktualisieren
    • Auf 1.16.1+~1.14.4-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. openSUSE-SU-2026:22134-1

    Nicht bewertetKorrektur verfügbar

    Security update for gh

    This update for gh fixes the following issues: Changes in gh: - Update to version 2.102.0, fixing four security issues (GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7, GHSA-wjmr-j3rp-mh2g): * gh release/run/attestation download and repo read-file --output could write to an unintended file through symbolic links * gh attestation verify compared --source-ref case-insensitively * gh attestation verify matched --signer-workflow only by prefix * gh skill search could inject options into gh skill install * Copy auth codes to the clipboard by default (gh config set clipboard disabled to opt out) * Remove the

    ghBetriebssysteme
    • Auf 2.102.0-bp160.1.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-111750

    Mittel · CVSS 6.3EPSS 0,38%Korrektur verfügbar

    AIOHTTP: Pure-Python parser request smuggling

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. This issue is fixed in version 3.14.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpBetriebssysteme Python
    • Auf 3.14.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-111749

    Niedrig · CVSS 2.3EPSS 0,38%Korrektur verfügbar

    AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpBetriebssysteme Python
    • Auf 3.14.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-111748

    Mittel · CVSS 6.3EPSS 0,39%Korrektur verfügbar

    AIOHTTP: Absolute-form request targets can spoof Request.scheme

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpBetriebssysteme Python
    • Auf 3.14.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-111066

    Hoch · CVSS 8.2EPSS 0,41%Korrektur verfügbar

    AIOHTTP: File descriptor exhaustion in multipart requests

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpBetriebssysteme Python
    • Auf 3.14.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-111065

    Mittel · CVSS 6.9EPSS 0,4%Korrektur verfügbar

    AIOHTTP: Connector pool exhaustion via Max-Age overflow

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpBetriebssysteme Python
    • Auf 3.14.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. openSUSE-RU-2026:22132-1

    Nicht bewertetKorrektur verfügbar

    Recommended update for sequoia-sq

    This update for sequoia-sq fixes the following issues: Changes in sequoia-sq: - Use crypto-openssl also for tests Update to version 1.5.0: * tool: Release v1.5.0. * tool: Fix link to README. * tool: Set a version for the sqz dependency. * Enable optimizations when building rust-crypto crates. * Update NEWS. * lib: Release v0.1.0. * Update Cargo.lock. * meta: Update link to documentation. * lib: Update README. * lib: Rename the high-level library to sqz. * lib: Fix documentation. * lib: Mention network_search in the lookup functions documentation. * lib: Mention lookup and lookup_by in the certify documentation.

    sequoia-sqBetriebssysteme
    • Auf 1.5.0-bp160.1.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-111064

    Hoch · CVSS 8.2EPSS 0,4%Korrektur verfügbar

    aiohttp server lacks an initial request/header timeout

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpBetriebssysteme Python
    • Auf 3.14.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-111063

    Mittel · CVSS 6.3EPSS 0,23%Korrektur verfügbar

    AIOHTTP: Secure attribute not enforced for shared cookie

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpBetriebssysteme Python
    • Auf 3.14.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. openSUSE-SU-2026:22125-1

    Nicht bewertetKorrektur verfügbar

    Security update for grafana

    This update for grafana fixes the following issues: Changes in grafana: Update to version 12.4.10: * Security: * CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934) * CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841) * CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426) * CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973) * CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307) * CVE-2026-14199: Fix session takeover via Auth Proxy c

    grafanaBetriebssysteme Anwendungen
    • Auf 12.4.10-bp160.1.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. openSUSE-SU-2026:22135-1

    Nicht bewertetKorrektur verfügbar

    Security update for coredns

    This update for coredns fixes the following issues: Changes in coredns: - Bump vendored google.golang.org/grpc from 1.83.0 to 1.83.1: * CVE-2026-84304: heap memory exhaustion via HTTP/2 DATA frame fragmentation in the gRPC transport (boo#1279216) * Done through the go_modules "require" parameter in _service - Update license tag to Apache-2.0 AND MPL-2.0 * outcome of legal review Update to version 1.14.6: * Test: populating build test failure * fix(auto): keep first matching zone file for duplicate origins * plugin/secondary: serve catalog member zones * plugin/tsig: don't echo client's TSIG.Error if verification is suc

    corednsBetriebssysteme Netzwerkdienste
    • Auf 1.14.7-bp160.2.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. openSUSE-SU-2026:22138-1

    Nicht bewertetKorrektur verfügbar

    Security update for hashcat

    This update for hashcat fixes the following issues: Changes in hashcat: Update to snapshot v7.1.2-942-gef3508ed8: * Addressed CVE-2026-68768 [boo#1276256], CVE-2026-68767 [boo#1276255], CVE-2026-68766 [boo#1276254] * Feed plugins and attack-mode 8 * Probability-ordered PCFG and targeted hints in attack-mode 4 * Device-accelerated table attacks in attack-mode 5 * Wordlists inside masks with attack-mode 12 * Account-aware association in attack-mode 9 * Seekable wordlists and one cache location * A brain server built for large sessions * Rules in every attack-mode * A Python bridge that uses every CPU thread Update to

    hashcatBetriebssysteme
    • Auf 7.1.2+git942-bp160.1.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-111061

    Mittel · CVSS 4.3EPSS 0,35%Öffentlicher ExploitKorrektur verfügbar

    russh agent server converts constraint records into unbounded never-rolled-back tasks

    russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the key blob into each task, and does not roll back tasks when later constraint parsing fails. An attacker that can speak the agent protocol locally or through agent forwarding can exhaust memory and tasks until the agent process is starved or terminated, denying SSH agent service. This issue is fixed in version 0.64.1.

    russh rust-russh rust-russhBetriebssysteme
    • Auf 0.64.1-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. openSUSE-SU-2026:22126-1

    Nicht bewertetKorrektur verfügbar

    Security update for gitoxide

    This update for gitoxide fixes the following issues: Changes in gitoxide: Update to version 0.60.0: * BREAKING: remove the full-screen progress mode: the --progress and --progress-keep-open flags and the prodash-render-tui feature are gone, line progress stays the only progress UI * Trace output is now independently configurable with a bounded -t/--trace counter, separate from verbose and progress rendering * Add gix worktree add (alias create) and worktree remove * Various security improvements and more consistent error handling across the plumbing crates - Refresh the vendored dependencies. The linked graph still

    gitoxideBetriebssysteme
    • Auf 0.60.0-bp160.1.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →