PatchFirst · Latest vulnerabilities
Follow new advisories by stack, product and installed version. Vulnerabilities published or escalated in the last 30 days: 20690. Listed in KEV: 85.
Fresh vulnerability reports from vendor announcements and security news. These warnings do not change the security rating.
According to GitHub Advisory Database, Node.js has a denial of service vulnerability (CVE-2026-109932). The exact affected versions are unspecified. The report does not name a fixed version.
What to do now: Check whether a Node.js update with the fix is available and install it.
CVE-2026-109932
According to OpenNet, Node.js has a remote code execution vulnerability (CVE-2026-111497). The exact affected versions are unspecified. The report does not name a fixed version.
What to do now: Check whether a Node.js update with the fix is available and install it.
CVE-2026-111497
According to OpenNet, PHP has a remote code execution vulnerability (CVE-2026-115560). The exact affected versions are unspecified. The report does not name a fixed version.
What to do now: Check whether a PHP update with the fix is available and install it.
CVE-2026-115560
Vulnerabilities: 488303
A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.
These are all security issues fixed in the zed-1.24.2-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the versitygw-1.10.0-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the trufflehog-3.99.7-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the terragrunt-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the tempo-cli-3.1.1-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the libsofia-sip-ua-glib3-1.13.19-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the rsyslog-8.2608.0-4.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the python315-3.15.2-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the perl-MIME-tools-5.522.0-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the perl-HTTP-Body-1.240.0-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the java-25-openjdk-25.0.5.0-2.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the java-21-openjdk-21.0.13.0-2.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the java-17-openjdk-17.0.21.0-2.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the containerd-2.4.2-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the buildah-1.46.0-1.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the amazon-cloudwatch-agent-1.300073.2-3.1 package on the GA media of openSUSE Tumbleweed.
These are all security issues fixed in the MozillaThunderbird-153.6.0-1.1 package on the GA media of openSUSE Tumbleweed.
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927) * tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation (CVE-2026-65637) * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569) * tomcat: Apache Tomcat: Authentication bypass via limited replay at
Check your installed stack and versions against the current vulnerability feeds.