p PatchFirst

PatchFirst · Latest vulnerabilities

Operating systems stack vulnerabilities · Page 100

Vulnerabilities published for Operating systems in the last 30 days: 6432. Listed in the KEV catalogue: 4.

RSS ↗ JSON ↗
Filter vulnerabilities
Operating systems

Vulnerabilities: 160404

  1. SUSE-SU-2026:24371-1

    Not ratedFix available

    Security update for the Linux Kernel

    The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531). - CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267). - CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851). - CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694). - CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730). - CVE-2026-53108: powerpc/64s: Fix unmap race

    kernel-default kernel-default-base kernel-kvmsmall kernel-sourceOperating systems
    • Update to 6.4.0-159998.54.1
    • Update to 6.4.0-159998.54.1.159998.21.40
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. RLSA-2026:85308

    High · CVSS 8.8Fix available

    Important: bubblewrap security update

    Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    bubblewrapOperating systems
    • Update to 0:0.10.0-5.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. RLSA-2026:85848

    High · CVSS 7.5Fix available

    Important: rust-sequoia-sq security update

    Command-line frontends for Sequoia. Security Fix(es): * hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657) * rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    rust-sequoia-sqOperating systems
    • Update to 0:1.4.0.1-4.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. RLSA-2026:85847

    Medium · CVSS 6.5Fix available

    Moderate: openssh security update

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw (CVE-2026-59997) * openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (CVE-2026-59998) * openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts (CVE-2026-60000) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other

    opensshOperating systems Network services
    • Update to 0:9.9p1-29.el10_2.rocky.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. RLSA-2026:85321

    High · CVSS 8.8Fix available

    Important: kernel security, bug fix, and enhancement update

    The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678) * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917) * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801) * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971) * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962) * kernel: sctp: a

    kernelOperating systems
    • Update to 0:6.12.0-211.67.1.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. RLSA-2026:85276

    High · CVSS 7.1Fix available

    Moderate: hostapd security update

    hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a "daemon" program that runs in the back-ground and acts as the backend component controlling authentication. hostapd supports separate frontend programs and an example text-based frontend, hostapd_cli, is included with hostapd. Security Fix(es): * hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request (CVE-2026-58374) For more details about the security issue(s), includin

    hostapdOperating systems
    • Update to 0:2.11-3.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. SUSE-SU-2026:4829-1

    Not ratedFix available

    Security update for libraw

    This update for libraw fixes the following issue: - CVE-2026-88387: incorrect numeric conversion in `LibRaw::parse_tiff_ifd()` when processing TIFF tag `0x00fe` can lead to undefined behavior and a process crash when a specially crafted file is processed (bsc#1282783).

    libraw libraw librawOperating systems
    • Update to 0.21.1-150600.3.13.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. SUSE-SU-2026:4827-1

    Not ratedFix available

    Security update for openssh

    This update for openssh fixes the following issues: - CVE-2026-73281: refused binding requests on locked SSH agents can allow destination restriction bypasses (bsc#1275075). - CVE-2026-73282: unsynchronized remote forwarding updates in SSH client multiplexing can cause use-after-free (bsc#1275074). - CVE-2026-73283: unenforced restriction keywords on tunnel forwarding can allow administrative security policy bypasses (bsc#1275079). Changes for openssh: - Included mentions of the configuration drop-in directories (bsc#1259462).

    openssh openssh-askpass-gnome openssh openssh-askpass-gnome openssh openssh-askpass-gnomeOperating systems Network services
    • Update to 9.6p1-150600.6.52.1
    • Update to 9.6p1-150600.6.52.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. SUSE-SU-2026:24379-1

    Not ratedFix available

    Security update for the Linux Kernel

    The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531). - CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267). - CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851). - CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694). - CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730). - CVE-2026-53108: powerpc/64s: Fix unmap race

    kernel-default kernel-default-base kernel-kvmsmall kernel-sourceOperating systems
    • Update to 6.4.0-159998.54.1
    • Update to 6.4.0-159998.54.1.159998.21.39
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. SUSE-SU-2026:4819-1

    Not ratedFix available

    Security update for cifs-utils

    This update for cifs-utils fixes the following issue: - CVE-2026-104715: mount options injection via CIFS credentials-file parsing (bsc#1284932).

    cifs-utils cifs-utils cifs-utils cifs-utils cifs-utils cifs-utils cifs-utils cifs-utils cifs-utils cifs-utils cifs-utils cifs-utilsOperating systems
    • Update to 6.15-150400.3.27.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. SUSE-SU-2026:4817-1

    Not ratedFix available

    Security update for cyrus-sasl

    This update for cyrus-sasl fixes the following issue: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST-MD5 clients (bsc#1284687).

    cyrus-sasl cyrus-sasl cyrus-sasl-bdb cyrus-sasl-saslauthd cyrus-sasl cyrus-sasl-bdb cyrus-sasl-saslauthd cyrus-sasl cyrus-sasl-bdb cyrus-sasl-saslauthd cyrus-sasl-saslauthd-bdb cyrus-saslOperating systems
    • Update to 2.1.28-150500.3.12.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. SUSE-SU-2026:4814-1

    Not ratedFix available

    Security update for libpng16

    This update for libpng16 fixes the following issues: - CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression (bsc#1283183). Changes for libpng16: - version update to 1.6.59 (jsc#PED-16190): * Fixed a regression introduced in version 1.6.47 that caused libpng to reject hIST chunks in their correct position, after PLTE. * Prevented a double free of `png_struct` members after an allocation failure. * Applied fixes and updates to the CMake build. * Adopted the REUSE Specification for licensing the CI files.

    libpng16 libpng16 libpng16Operating systems
    • Update to 1.6.59-150000.3.28.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2026-105923

    Medium · CVSS 4EPSS 0.12%Fix available

    Null-pointer dereference in QTriangulator reachable through VectorImage

    A malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type.

    qt qt6-base qt6-base qt6-base qtbase-opensource-src qtbase-opensource-src qtbase-opensource-src qtbase-opensource-src-gles qtbase-opensource-src-gles qtbase-opensource-src-gles qtbase-opensource-src-gles qtbase-opensource-src-glesOperating systems
    • Update to 6.11.3
    • Update to 6.8.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2026-97206

    High · CVSS 7.5EPSS 0.33%Public exploitFix available

    DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.

    NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.

    unbound unbound unbound unbound unbound unbound unbound unbound unbound unbound unbound unboundOperating systems
    • Update to 1.26.2
    • Update to 1.26.2-0+deb13u1
    • Update to 1.26.2-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  20. CVE-2026-96405

    Medium · CVSS 5.3EPSS 0.25%Fix available

    Aggregate DNS name chained pointer decompression work leads to degradation of service.

    NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.

    unbound unbound unbound unbound unbound unbound unbound unbound unbound unbound unbound unboundOperating systems
    • Update to 1.26.2
    • Update to 1.26.2-0+deb13u1
    • Update to 1.26.2-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →