p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de la pile Systèmes d’exploitation · Page n° 176

Vulnérabilités publiées pour Systèmes d’exploitation au cours des 30 derniers jours : 6852. Présentes dans le catalogue KEV : 4.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Systèmes d’exploitation

Vulnérabilités : 160935

  1. CVE-2026-111755

    Élevée · CVSS 8.2EPSS 0,47%Code d’exploitation publicCorrectif disponible

    follow-redirects sensitiveHeaders regex escaping can expose credential headers

    follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attacker-controlled redirect target. This issue is fixed in version 1.16.1.

    follow-redirects node-follow-redirects node-follow-redirects node-follow-redirects follow-redirects node-follow-redirects node-follow-redirects node-follow-redirects node-follow-redirects node-follow-redirects node-follow-redirectsSystèmes d’exploitation Node.js
    • Mettez à jour vers 1.16.1
    • Mettez à jour vers 1.16.1+~1.14.4-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. openSUSE-SU-2026:22134-1

    Non évaluéeCorrectif disponible

    Security update for gh

    This update for gh fixes the following issues: Changes in gh: - Update to version 2.102.0, fixing four security issues (GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7, GHSA-wjmr-j3rp-mh2g): * gh release/run/attestation download and repo read-file --output could write to an unintended file through symbolic links * gh attestation verify compared --source-ref case-insensitively * gh attestation verify matched --signer-workflow only by prefix * gh skill search could inject options into gh skill install * Copy auth codes to the clipboard by default (gh config set clipboard disabled to opt out) * Remove the

    ghSystèmes d’exploitation
    • Mettez à jour vers 2.102.0-bp160.1.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2026-111750

    Moyenne · CVSS 6.3EPSS 0,38%Correctif disponible

    AIOHTTP: Pure-Python parser request smuggling

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EXTENSIONS or otherwise runs without a standard wheel and an intermediary interprets the framing differently. This issue is fixed in version 3.14.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 3.14.4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2026-111749

    Faible · CVSS 2.3EPSS 0,38%Correctif disponible

    AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 3.14.4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2026-111748

    Moyenne · CVSS 6.3EPSS 0,39%Correctif disponible

    AIOHTTP: Absolute-form request targets can spoof Request.scheme

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme for security decisions can consequently be tricked into treating an unencrypted connection as encrypted or an encrypted connection as unencrypted. This issue is fixed in version 3.14.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 3.14.4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2026-111066

    Élevée · CVSS 8.2EPSS 0,41%Correctif disponible

    AIOHTTP: File descriptor exhaustion in multipart requests

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart requests when a handler uses Request.post(). This issue is fixed in version 3.14.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 3.14.4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2026-111065

    Moyenne · CVSS 6.9EPSS 0,4%Correctif disponible

    AIOHTTP: Connector pool exhaustion via Max-Age overflow

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fixed in version 3.14.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 3.14.4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. openSUSE-RU-2026:22132-1

    Non évaluéeCorrectif disponible

    Recommended update for sequoia-sq

    This update for sequoia-sq fixes the following issues: Changes in sequoia-sq: - Use crypto-openssl also for tests Update to version 1.5.0: * tool: Release v1.5.0. * tool: Fix link to README. * tool: Set a version for the sqz dependency. * Enable optimizations when building rust-crypto crates. * Update NEWS. * lib: Release v0.1.0. * Update Cargo.lock. * meta: Update link to documentation. * lib: Update README. * lib: Rename the high-level library to sqz. * lib: Fix documentation. * lib: Mention network_search in the lookup functions documentation. * lib: Mention lookup and lookup_by in the certify documentation.

    sequoia-sqSystèmes d’exploitation
    • Mettez à jour vers 1.5.0-bp160.1.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2026-111064

    Élevée · CVSS 8.2EPSS 0,4%Correctif disponible

    aiohttp server lacks an initial request/header timeout

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request data, consuming server connection capacity. This issue is fixed in version 3.14.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 3.14.4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2026-111063

    Moyenne · CVSS 6.3EPSS 0,23%Correctif disponible

    AIOHTTP: Secure attribute not enforced for shared cookie

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 3.14.4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. openSUSE-SU-2026:22125-1

    Non évaluéeCorrectif disponible

    Security update for grafana

    This update for grafana fixes the following issues: Changes in grafana: Update to version 12.4.10: * Security: * CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource credentials (bsc#1275934) * CVE-2026-2303: Drop dependency on vulnerable go.mongodb.org/mongo-driver (bsc#1269841) * CVE-2026-17033: Fix stored XSS via external Alertmanager generatorURL (bsc#1276426) * CVE-2026-73501: Fix fail-open authentication bypass in github.com/getkin/kin-openapi (bsc#1276973) * CVE-2026-19475: Fix DoS in PostgreSQL Datasource (bsc#1278307) * CVE-2026-14199: Fix session takeover via Auth Proxy c

    grafanaSystèmes d’exploitation Logiciels applicatifs
    • Mettez à jour vers 12.4.10-bp160.1.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. openSUSE-SU-2026:22135-1

    Non évaluéeCorrectif disponible

    Security update for coredns

    This update for coredns fixes the following issues: Changes in coredns: - Bump vendored google.golang.org/grpc from 1.83.0 to 1.83.1: * CVE-2026-84304: heap memory exhaustion via HTTP/2 DATA frame fragmentation in the gRPC transport (boo#1279216) * Done through the go_modules "require" parameter in _service - Update license tag to Apache-2.0 AND MPL-2.0 * outcome of legal review Update to version 1.14.6: * Test: populating build test failure * fix(auto): keep first matching zone file for duplicate origins * plugin/secondary: serve catalog member zones * plugin/tsig: don't echo client's TSIG.Error if verification is suc

    corednsSystèmes d’exploitation Services réseau
    • Mettez à jour vers 1.14.7-bp160.2.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. openSUSE-SU-2026:22138-1

    Non évaluéeCorrectif disponible

    Security update for hashcat

    This update for hashcat fixes the following issues: Changes in hashcat: Update to snapshot v7.1.2-942-gef3508ed8: * Addressed CVE-2026-68768 [boo#1276256], CVE-2026-68767 [boo#1276255], CVE-2026-68766 [boo#1276254] * Feed plugins and attack-mode 8 * Probability-ordered PCFG and targeted hints in attack-mode 4 * Device-accelerated table attacks in attack-mode 5 * Wordlists inside masks with attack-mode 12 * Account-aware association in attack-mode 9 * Seekable wordlists and one cache location * A brain server built for large sessions * Rules in every attack-mode * A Python bridge that uses every CPU thread Update to

    hashcatSystèmes d’exploitation
    • Mettez à jour vers 7.1.2+git942-bp160.1.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2026-111061

    Moyenne · CVSS 4.3EPSS 0,35%Code d’exploitation publicCorrectif disponible

    russh agent server converts constraint records into unbounded never-rolled-back tasks

    russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSH_AGENT_CONSTRAIN_LIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the key blob into each task, and does not roll back tasks when later constraint parsing fails. An attacker that can speak the agent protocol locally or through agent forwarding can exhaust memory and tasks until the agent process is starved or terminated, denying SSH agent service. This issue is fixed in version 0.64.1.

    russh rust-russh rust-russhSystèmes d’exploitation
    • Mettez à jour vers 0.64.1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. openSUSE-SU-2026:22126-1

    Non évaluéeCorrectif disponible

    Security update for gitoxide

    This update for gitoxide fixes the following issues: Changes in gitoxide: Update to version 0.60.0: * BREAKING: remove the full-screen progress mode: the --progress and --progress-keep-open flags and the prodash-render-tui feature are gone, line progress stays the only progress UI * Trace output is now independently configurable with a bounded -t/--trace counter, separate from verbose and progress rendering * Add gix worktree add (alias create) and worktree remove * Various security improvements and more consistent error handling across the plumbing crates - Refresh the vendored dependencies. The linked graph still

    gitoxideSystèmes d’exploitation
    • Mettez à jour vers 0.60.0-bp160.1.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. openSUSE-SU-2026:22130-1

    Non évaluéeCorrectif disponible

    Security update for grok-build

    This update for grok-build fixes the following issues: Changes in grok-build: - CVE-2026-109349: gix-pack pack version 3 header assertion failure (boo#1285155) - CVE-2026-109350: gix-pack ofs-delta base-distance handling flaw (boo#1285155) - CVE-2026-109351: gix-pack header object-count denial of service (boo#1285155) - Refresh vendored Rust dependencies (gix 0.83.0 -> 0.88.0, gix-pack 0.70.0 -> 0.75.0, gix-status 0.30.0 -> 0.35.0); re-audited licences (913 external crates in the shipped graph, 1247 vendored); licence set unchanged - adapt xai-fast-worktree to the gix 0.88 API (anyhow Context bound, from_bstr signature)

    grok-buildSystèmes d’exploitation
    • Mettez à jour vers 1.0.45+git20260929.2bdd1d6-bp160.2.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. openSUSE-SU-2026:22133-1

    Non évaluéeCorrectif disponible

    Security update for tinyproxy

    This update for tinyproxy fixes the following issues: Changes in tinyproxy: - Fixed failure to reconcile conflicting Content-Length and Transfer-Encoding [boo#1268474, CVE-2026-54387] - Fixed failure to reject requests containing multiple Content-Length headers with differing values [boo#1268475, CVE-2026-54388] - Fixed failure to properly validate the Host header during stathost detection [boo#1268476, CVE-2026-55202]

    tinyproxySystèmes d’exploitation
    • Mettez à jour vers 1.11.3-bp160.2.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. openSUSE-SU-2026:22127-1

    Non évaluéeCorrectif disponible

    Security update for putty

    This update for putty fixes the following issues: Changes in putty: - Update to release 0.85 * Fixed a remotely triggerable use-after-free in Pageant. * Fixed a remotely triggerable buffer overflow if the OpenSSH encrypt-then-MAC cipher modes are in use. (Only used if a server supports nothing else.) * Fixed a buffer overflow in private key decryption, if the private key is constructed maliciously. (Only triggerable on purpose if you let somebody else generate a key for you.) * Denial-of-service security fixes for where a server could trigger a tight loop in PuTTY, and even a MITM can make it consume unlimit

    puttySystèmes d’exploitation
    • Mettez à jour vers 0.85-bp160.1.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →