PatchFirst · Vulnérabilités récentes
Suivez les nouveaux avis par pile, produit et version installée. Vulnérabilités publiées ou ayant fait l’objet d’une escalade au cours des 30 derniers jours : 20997. Présentes dans KEV : 90.
Signalements récents de vulnérabilités issus des annonces des éditeurs et de l’actualité de la sécurité. Ces alertes ne modifient pas la note de sécurité.
Selon OpenNet, Node.js présente une vulnérabilité d’exécution de code à distance (CVE-2026-111497). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.
Que faire maintenant : Vérifiez si une mise à jour de sécurité de Node.js contenant le correctif est disponible et installez-la.
CVE-2026-111497
Selon GitHub Advisory Database, Node.js présente une vulnérabilité de déni de service (CVE-2026-109932). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.
Que faire maintenant : Vérifiez si une mise à jour de sécurité de Node.js contenant le correctif est disponible et installez-la.
CVE-2026-109932
Selon OpenNet, PHP présente une vulnérabilité d’exécution de code à distance (CVE-2026-115560). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.
Que faire maintenant : Vérifiez si une mise à jour de sécurité de PHP contenant le correctif est disponible et installez-la.
CVE-2026-115560
Vulnérabilités : 489886
These are all security issues fixed in the perl-MIME-tools-5.522.0-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the perl-HTTP-Body-1.240.0-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the java-25-openjdk-25.0.5.0-2.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the java-21-openjdk-21.0.13.0-2.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the java-17-openjdk-17.0.21.0-2.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the containerd-2.4.2-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the buildah-1.46.0-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the amazon-cloudwatch-agent-1.300073.2-3.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the MozillaThunderbird-153.6.0-1.1 package on the GA media of openSUSE Tumbleweed.
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927) * tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation (CVE-2026-65637) * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569) * tomcat: Apache Tomcat: Authentication bypass via limited replay at
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pillow: Pillow: Denial of Service via unbounded recursion in PDF parser (CVE-2026-112391) * pillow: pillow: Denial of service via double free during image transformation (CVE-2026-112402) * pillow: pillow: Denial of Service via zero-size images in rank filters (CVE-2026-112392) * pillow: pillow: Denial of Service via out-of-bounds me
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006) * httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi (CVE-2026-63718) * httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546) * httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637) * httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045)
GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker. Security Fix(es): * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 11.0.100~rc.3.26522.148 Runtime version: 11.0.0~rc.3.26522.148 Security Fix(es): * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnera
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.133 Runtime version: 8.0.33 Security Fix(es): * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689) * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer
GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker. Security Fix(es): * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.114 Runtime version: 10.0.14 Security Fix(es): * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.114
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.114 Runtime version: 10.0.14 Security Fix(es): * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.114
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.