PatchFirst · Latest vulnerabilities
Follow new advisories by stack, product and installed version. Vulnerabilities published or escalated in the last 30 days: 20750. Listed in KEV: 89.
Fresh vulnerability reports from vendor announcements and security news. These warnings do not change the security rating.
According to OpenNet, Node.js has a remote code execution vulnerability (CVE-2026-111497). The exact affected versions are unspecified. The report does not name a fixed version.
What to do now: Check whether a Node.js update with the fix is available and install it.
CVE-2026-111497
According to GitHub Advisory Database, Node.js has a denial of service vulnerability (CVE-2026-109932). The exact affected versions are unspecified. The report does not name a fixed version.
What to do now: Check whether a Node.js update with the fix is available and install it.
CVE-2026-109932
According to OpenNet, PHP has a remote code execution vulnerability (CVE-2026-115560). The exact affected versions are unspecified. The report does not name a fixed version.
What to do now: Check whether a PHP update with the fix is available and install it.
CVE-2026-115560
Vulnerabilities: 489492
These are all security issues fixed in the terragrunt-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the tempo-cli-3.1.1-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the libsofia-sip-ua-glib3-1.13.19-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the rsyslog-8.2608.0-4.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the python315-3.15.2-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the perl-MIME-tools-5.522.0-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the perl-HTTP-Body-1.240.0-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the java-25-openjdk-25.0.5.0-2.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the java-21-openjdk-21.0.13.0-2.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the java-17-openjdk-17.0.21.0-2.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the containerd-2.4.2-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the buildah-1.46.0-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the amazon-cloudwatch-agent-1.300073.2-3.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the MozillaThunderbird-153.6.0-1.1 package on the GA media of openSUSE Tumbleweed.
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927) * tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation (CVE-2026-65637) * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569) * tomcat: Apache Tomcat: Authentication bypass via limited replay at
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pillow: Pillow: Denial of Service via unbounded recursion in PDF parser (CVE-2026-112391) * pillow: pillow: Denial of service via double free during image transformation (CVE-2026-112402) * pillow: pillow: Denial of Service via zero-size images in rank filters (CVE-2026-112392) * pillow: pillow: Denial of Service via out-of-bounds me
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006) * httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi (CVE-2026-63718) * httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546) * httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637) * httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045)
GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker. Security Fix(es): * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 11.0.100~rc.3.26522.148 Runtime version: 11.0.0~rc.3.26522.148 Security Fix(es): * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnera
Check your installed stack and versions against the current vulnerability feeds.