PatchFirst · Latest vulnerabilities
Follow new advisories by stack, product and installed version. Vulnerabilities published or escalated in the last 30 days: 20997. Listed in KEV: 90.
Fresh vulnerability reports from vendor announcements and security news. These warnings do not change the security rating.
According to OpenNet, Node.js has a remote code execution vulnerability (CVE-2026-111497). The exact affected versions are unspecified. The report does not name a fixed version.
What to do now: Check whether a Node.js update with the fix is available and install it.
CVE-2026-111497
According to GitHub Advisory Database, Node.js has a denial of service vulnerability (CVE-2026-109932). The exact affected versions are unspecified. The report does not name a fixed version.
What to do now: Check whether a Node.js update with the fix is available and install it.
CVE-2026-109932
According to OpenNet, PHP has a remote code execution vulnerability (CVE-2026-115560). The exact affected versions are unspecified. The report does not name a fixed version.
What to do now: Check whether a PHP update with the fix is available and install it.
CVE-2026-115560
Vulnerabilities: 489886
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.114 Runtime version: 10.0.14 Security Fix(es): * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.114
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.123 Runtime version: 9.0.22 Security Fix(es): * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.123 and
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.123 Runtime version: 9.0.22 Security Fix(es): * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.123 and
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.133 Runtime version: 8.0.33 Security Fix(es): * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.123 Runtime version: 9.0.22 Security Fix(es): * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.123 and
.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.133 Runtime version: 8.0.33 Security Fix(es): * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148)
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630) * bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300) * bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888) * bind: bind: Denial of service via assertio
IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059) * resteasy-core: RESTEasy: CorsFilter Reflects Arbitra
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911) * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277) * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) * brotli: Out-of-Bounds Write in Google
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911) * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277) * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) * brotli: Out-of-Bounds Write in Google
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458) * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924) * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856) * curl: Information disclosure due to uncleared proxy authentication state (CV
Expat is a C library for parsing XML documents. Security Fix(es): * expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633) * expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288) * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289) * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011) * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222) Bug Fix(es) and Enhancement(s): * ipv4: ip_gre: make ipgre_header() robust (rhel-8.10.z) (JIRA:RHEL-271135) * ip6_gre: make ip6gre_header(
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288) * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289) * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011) * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222) Bug Fix(es) and Enhancement(s): * ipv4: ip_gre: make ipgre_header() robust (rhel-8.
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance PKCS5 padding (CVE-2026-83374) * JDK: Enhance TLS certificate handling (CVE-2026-83376) * JDK: Improve C2 loop transformations (CVE-2026-83378) * JDK: Enhance LDAP logins (CVE-2026-83380) * JDK: Enhance SASL Authentication (CVE-2026-83381) * JDK: Enhance WebRowSets (CVE-2026-83387) * JDK: Enhance HTTP Client Response Handling (CVE-2026-83395) * JDK: Enhance XML Processing (CVE-2026-83400) * JDK: Enhance XPath Expressions (CVE-2026-87290) * JDK: Enhance HTTP Server
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance PKCS5 padding (CVE-2026-83374) * JDK: Enhance TLS certificate handling (CVE-2026-83376) * JDK: Enhance LDAP logins (CVE-2026-83380) * JDK: Enhance SASL Authentication (CVE-2026-83381) * JDK: Enhance WebRowSets (CVE-2026-83387) * JDK: Enhance HTTP Client Response Handling (CVE-2026-83395) * JDK: Enhance XML Processing (CVE-2026-83400) * JDK: Enhance XPath Expressions (CVE-2026-87290) * JDK: Enhance Network Clients (CVE-2026-87292) * JDK: Enhance Certificate Nam
The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance PKCS5 padding (CVE-2026-83374) * JDK: Enhance TLS certificate handling (CVE-2026-83376) * JDK: Improve C2 loop transformations (CVE-2026-83378) * JDK: Enhance LDAP logins (CVE-2026-83380) * JDK: Enhance SASL Authentication (CVE-2026-83381) * JDK: Enhance WebRowSets (CVE-2026-83387) * JDK: Enhance HTTP Client Response Handling (CVE-2026-83395) * JDK: Enhance XML Processing (CVE-2026-83400) * JDK: Enhance XPath Expressions (CVE-2026-87290) * JDK: Enhance HTTP Server
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the victim agent_id and agent_execution_id to /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}. The endpoint lacks an organization ownership check on the selected agent and execution.
SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.py. A remote authenticated attacker from one organization can retrieve latest execution and agent metadata for another organization's project through /agentexecutions/get/latest/agent/project/{project_id} by supplying a victim project_id.
Check your installed stack and versions against the current vulnerability feeds.