PatchFirst · Vulnérabilités récentes
Vulnérabilités publiées pour Systèmes d’exploitation au cours des 30 derniers jours : 6981. Présentes dans le catalogue KEV : 4.
Vulnérabilités : 161064
Red Hat Security Advisory: rsyslog security update
Red Hat Security Advisory: gegl04 security update
Red Hat Security Advisory: xorg-x11-server security update
Red Hat Security Advisory: openssl security update
This update for rpcbind fixes the following issue: - CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service (bsc#1282326).
This update for docker fixes the following issues: Security issues fixed: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265782). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266625). - CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be used to bypass some authorization controls (bsc#1262346). - CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compre
This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758). - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939). - CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935). - CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938). - CVE-2026-41178: go.opentelemetry.io/otel/baggage,go
This update for google-osconfig-agent fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283672). Changes for google-osconfig-agent: - Update to version 20260928.01 * scalibr linux new metadata support (#1038) * Fix failing to report REBOOTING state during postPatchReboot due to context canceled for Windows VMs (#1055) * Fix os/snap extractor usage (#1053) - Update github.com/klauspost/compress to v1.18.7 (bsc#1283672, CVE-2026-63209) * bump grpc package to new version (#1057) * bump
This update for wpa_supplicant fixes the following issue: - CVE-2026-78807: Security bypass via missing PMKSA validation (bsc#1280914).
This update for openssl-3 fixes the following issues: - CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589). - CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591). - CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596). - CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597). - CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598). - CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
This update for glibc fixes the following issues: - CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to trigger a process crash (bsc#1281297). - CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509). - CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449). - CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program crash (bsc#1283147).
This update for python311 fixes the following issues: - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free (bsc#1283969). - CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses (bsc#1283826). - CV
This update for expat fixes the following issues: - CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584). - CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144). - CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496). - CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726). - CVE-2026-327
A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
This update for xen fixes the following issues: - CVE-2026-79609: x86: XPTI may break on huge-memory systems (bsc#1283321). - CVE-2026-79610: grant-table: double version change race (bsc#1283322). - CVE-2026-79611: VMX: VMentry failure with branch tracing and blocked states (bsc#1283323). - CVE-2026-102700: gnttab: cache-flush handling may cause page reference leak (bsc#1283325).
This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.121 fixes various security issues: The following security issues were fixed: - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269775). - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271965). - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272386). - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1276303).
A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_pipe in the library libr/core/rtr_http.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is assessed as difficult. Upgrading to version 6.2.4 is capable of addressing this issue. The patch is named 18fd12efa98a7d1977de7bdd379d8a848777b90f. Upgrading the affected component is recommended. The pre-requisite of the vulnerability is reflected by the CVSS ve
A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named 3984925b660afb8a781ddf504021e91be1bc671e. To fix this issue, it is recommended to deploy a patch.
These are all security issues fixed in the chromedriver-155.0.8059.84-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the ImageMagick-7.1.2.34-2.1 package on the GA media of openSUSE Tumbleweed.
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.