p PatchFirst

PatchFirst · Latest vulnerabilities

Operating systems stack vulnerabilities · Page 107

Vulnerabilities published for Operating systems in the last 30 days: 6476. Listed in the KEV catalogue: 4.

RSS ↗ JSON ↗
Filter vulnerabilities
Operating systems

Vulnerabilities: 160453

  1. ALSA-2026:87374

    Not ratedFix available

    Important: kernel-rt security update

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114) * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266) * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572) * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202) * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536) * kernel: inet: frags: strip GSO state from fragments

    kernel-rt kernel-rt-core kernel-rt-debug kernel-rt-debug-core kernel-rt-debug-devel kernel-rt-debug-modules kernel-rt-debug-modules-extra kernel-rt-devel kernel-rt-modules kernel-rt-modules-extraOperating systems
    • Update to 4.18.0-553.177.1.rt7.518.el8_10
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. ALSA-2026:87151

    Not ratedFix available

    Important: php security update

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    php php-bcmath php-cli php-common php-dba php-dbg php-devel php-embedded php-enchant php-ffi php-fpm php-gdOperating systems PHP
    • Update to 8.0.30-8.el9_8.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. ALSA-2026:87082

    Not ratedFix available

    Important: qt5-qtbase security update

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573) * qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    qt5-qtbase qt5-qtbase-common qt5-qtbase-devel qt5-qtbase-examples qt5-qtbase-gui qt5-qtbase-mysql qt5-qtbase-odbc qt5-qtbase-postgresql qt5-qtbase-private-devel qt5-qtbase-staticOperating systems
    • Update to 5.15.9-11.el9_8.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. ALSA-2026:87080

    Not ratedFix available

    Important: php:7.4 security update

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: php: Out-of-bounds read via empty HTTP redirect Location header (CVE-2026-93682) * php: PHP: Archive entry injection via integer overflow in TAR parser (CVE-2026-6103) * php: PHP: Denial of Service via heap buffer overflow in SOAP client (CVE-2025-14181) * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: php: Credential disclosure via cross-origin HTTP redirects (CVE-2026-91766) * php: php: Information disclosure via crafted TLS server certificate (CVE-2026-91767) * php: p

    apcu-panel libzip libzip libzip libzip-devel libzip-devel libzip-devel libzip-tools libzip-tools php php-bcmath php-cliOperating systems PHP
    • Update to 1.6.1-1.module_el8.10.0+3935+28808425
    • Update to 1.6.1-1.module_el8.6.0+2750+78feabcb
    • Update to 1.6.1-1.module_el8.6.0+3239+bedf0508
    • Update to 5.1.18-1.module_el8.6.0+2750+78feabcb
    • Update to 7.4.33-8.module_el8.10.0+4321+cf5fd4bb
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. ALSA-2026:87079

    Not ratedFix available

    Important: php:8.3 security update

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    apcu-panel php php-bcmath php-cli php-common php-dba php-dbg php-devel php-embedded php-enchant php-ffi php-fpmOperating systems PHP
    • Update to 5.1.23-1.module_el9.6.0+151+5f31e576
    • Update to 8.3.36-1.module_el9.8.0+330+fdc30075
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. ALSA-2026:87073

    Not ratedFix available

    Important: php:8.2 security update

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    apcu-panel libzip libzip-devel libzip-tools php php-bcmath php-cli php-common php-dba php-dbg php-devel php-embeddedOperating systems PHP
    • Update to 1.7.3-1.module_el8.10.0+3796+30ed3ef7
    • Update to 5.1.23-1.module_el8.10.0+3796+30ed3ef7
    • Update to 8.2.35-1.module_el8.10.0+4323+fc907035
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. ALSA-2026:87072

    Not ratedFix available

    Important: php:8.2 security update

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    apcu-panel php-pecl-apcu php-pecl-apcu-devel php-pecl-rrd php-pecl-xdebug3 php-pecl-zipOperating systems
    • Update to 1.22.3-1.module_el9.4.0+65+49ff6472
    • Update to 2.0.3-4.module_el9.4.0+65+49ff6472
    • Update to 3.2.2-2.module_el9.4.0+65+49ff6472
    • Update to 5.1.23-1.module_el9.4.0+65+49ff6472
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. ALSA-2026:87071

    Not ratedFix available

    Important: php8.4 security update

    PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale reque

    php8.4 php8.4-bcmath php8.4-cli php8.4-common php8.4-dba php8.4-dbg php8.4-devel php8.4-embedded php8.4-enchant php8.4-ffi php8.4-fpm php8.4-gdOperating systems
    • Update to 8.4.27-1.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. ALSA-2026:87070

    Not ratedFix available

    Important: php security update

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: php: Denial of Service via unbounded recursion in SOAP parser (CVE-2026-91765) * php: OOM bailout during request parsing leads to memory corruption and RCE (CVE-2026-109618) * php: fatal error handling retains stale request state leading to use-after-free (CVE-2026-109619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    php php-bcmath php-cli php-common php-dba php-dbg php-devel php-embedded php-enchant php-ffi php-fpm php-gdOperating systems PHP
    • Update to 8.3.36-1.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. ALSA-2026:86983

    Not ratedFix available

    Important: openexr security update

    OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * openexr: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544) * openexr: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982) * openexr: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184) * openexr: OpenEXR: Informa

    openexr-develOperating systems
    • Update to 3.1.1-3.el9_8.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. ALSA-2026:86982

    Not ratedFix available

    Moderate: fetchmail security update

    Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client. Security Fix(es): * fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, a

    fetchmailOperating systems
    • Update to 6.4.24-1.el8_10.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. ALSA-2026:86981

    Not ratedFix available

    Moderate: fetchmail security update

    Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client. Security Fix(es): * fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, a

    fetchmailOperating systems
    • Update to 6.4.24-1.el9_8.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. ALSA-2026:86971

    Not ratedFix available

    Moderate: cockpit-machines security update

    Cockpit component for managing libvirt virtual machines. Security Fix(es): * cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768) * cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747) * cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    cockpit-machinesOperating systems
    • Update to 348.1-1.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. ALSA-2026:86970

    Not ratedFix available

    Moderate: cockpit-machines security update

    Cockpit component for managing libvirt virtual machines. Security Fix(es): * cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768) * cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747) * cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    cockpit-machinesOperating systems
    • Update to 348.1-1.el9_8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. ALSA-2026:86921

    Not ratedFix available

    Important: librsvg2 security update

    The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library. Security Fix(es): * librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    librsvg2 librsvg2-devel librsvg2-toolsOperating systems
    • Update to 2.50.7-3.el9_8.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. ALSA-2026:86907

    Not ratedFix available

    Important: xorg-x11-server-Xwayland security update

    Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) * xorg-x11-server: xorg-x11-server: arbitrary code executi

    xorg-x11-server-xwaylandOperating systems
    • Update to 21.1.3-20.el8_10.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. ALSA-2026:86842

    Not ratedFix available

    Important: librsvg2 security update

    The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library. Security Fix(es): * librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    librsvg2 librsvg2-devel librsvg2-toolsOperating systems
    • Update to 2.42.7-6.el8_10
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. ALSA-2026:86841

    Not ratedFix available

    Important: librsvg2 security update

    The librsvg2 packages provide a Scalable Vector Graphics (SVG) library based on the libart library. Security Fix(es): * librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    librsvg2 librsvg2-devel librsvg2-tools rsvg-pixbuf-loaderOperating systems
    • Update to 2.57.1-9.el10_2.10
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. ALSA-2026:86706

    Not ratedFix available

    Moderate: jackson-core security update

    Core part of Jackson that defines Streaming API as well as basic shared abstractions. Security Fix(es): * com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407) * com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pki-jackson-coreOperating systems
    • Update to 2.21.6-1.el9_8.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. ALSA-2026:86594

    Not ratedFix available

    Critical: .NET 8.0 security, bug fix, and enhancement update

    .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.132 Runtime version: 8.0.32 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-

    aspnetcore-runtime-8.0 aspnetcore-runtime-dbg-8.0 aspnetcore-targeting-pack-8.0 dotnet-apphost-pack-8.0 dotnet-hostfxr-8.0 dotnet-runtime-8.0 dotnet-runtime-dbg-8.0 dotnet-sdk-8.0 dotnet-sdk-8.0-source-built-artifacts dotnet-sdk-dbg-8.0 dotnet-targeting-pack-8.0 dotnet-templates-8.0Operating systems
    • Update to 8.0.132-2.el8_10
    • Update to 8.0.32-2.el8_10
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →