p PatchFirst

PatchFirst · Latest vulnerabilities

Operating systems stack vulnerabilities · Page 186

Vulnerabilities published for Operating systems in the last 30 days: 6875. Listed in the KEV catalogue: 4.

RSS ↗ JSON ↗
Filter vulnerabilities
Operating systems

Vulnerabilities: 160958

  1. ALSA-2026:85245

    Not ratedFix available

    Important: emacs security update

    GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    emacs emacs-common emacs-filesystem emacs-lucid emacs-noxOperating systems
    • Update to 1:27.2-18.el9_8.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. ALSA-2026:85239

    Not ratedFix available

    Important: python3 security update

    Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Arbitrary file deletion via race condition during temporary directory cleanup (CVE-2026-12345) * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2

    platform-python platform-python-debug platform-python-devel python3-idle python3-libs python3-test python3-tkinterOperating systems
    • Update to 3.6.8-79.el8_10.alma.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. ALSA-2026:85234

    Not ratedFix available

    Important: resteasy security update

    RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification. Security Fix(es): * resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059) * resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References secti

    pki-resteasy-client pki-resteasy-core pki-resteasy-jackson2-provider pki-resteasy-servlet-initializerOperating systems
    • Update to 3.0.26-20.el9_8.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. ALSA-2026:85231

    Not ratedFix available

    Important: jackson-databind security update

    The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fix(es): * com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pki-jackson-databindOperating systems
    • Update to 2.21.6-1.el9_8.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. ALSA-2026:85193

    Not ratedFix available

    Important: xorg-x11-server-Xwayland security update

    Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) * xorg-x11-server: glamor: size tmp_bits buffer for source

    xorg-x11-server-xwayland xorg-x11-server-xwayland-develOperating systems
    • Update to 24.1.9-4.el9_8.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. ALSA-2026:85191

    Not ratedFix available

    Important: xorg-x11-server-Xwayland security update

    Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) * xorg-x11-server: glamor: size tmp_bits buffer for source

    xorg-x11-server-xwayland xorg-x11-server-xwayland-develOperating systems
    • Update to 24.1.9-4.el10_2.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. ALSA-2026:84799

    Not ratedFix available

    Important: mariadb11.8 security update

    MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145) * pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161) * pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111) For more details ab

    mariadb11.8 mariadb11.8-backup mariadb11.8-client-utils mariadb11.8-common mariadb11.8-devel mariadb11.8-embedded mariadb11.8-embedded-devel mariadb11.8-errmsg mariadb11.8-gssapi-server mariadb11.8-oqgraph-engine mariadb11.8-pam mariadb11.8-serverOperating systems
    • Update to 3:11.8.8-2.el10_2.alma.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. ALSA-2026:84798

    Not ratedFix available

    Important: pcs security update

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields (CVE-2026-82397) * python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding (CVE-2024-14029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    pcs pcs-snmpOperating systems
    • Update to 0.10.18-2.el8_10.10.alma.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. ALSA-2026:84796

    Not ratedFix available

    Important: openexr security update

    OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544) * OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184) * OpenEXR: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189) * OpenEXR: OpenEXR: Denial

    openexr openexr-devel openexr-libsOperating systems
    • Update to 3.1.10-8.el10_2.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. ALSA-2026:84795

    Not ratedFix available

    Important: librabbitmq security update

    The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1. Security Fix(es): * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    librabbitmq librabbitmq-devel librabbitmq-toolsOperating systems
    • Update to 0.14.0-3.el10_2.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. ALSA-2026:84753

    Not ratedFix available

    Moderate: glibc security update

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117) * glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489) * glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374) * glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration

    glibc glibc-all-langpacks glibc-benchtests glibc-common glibc-devel glibc-doc glibc-gconv-extra glibc-langpack-aa glibc-langpack-af glibc-langpack-agr glibc-langpack-ak glibc-langpack-amOperating systems
    • Update to 2.39-145.el10_2.alma.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. ALSA-2026:84744

    Not ratedFix available

    Important: gimp:2.8 security update

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947) * gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948) * gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248) * gimp: gimp: out-of-bounds write i

    gimp gimp-devel gimp-devel-tools gimp-libs pygobject2 pygobject2-codegen pygobject2-devel pygobject2-doc pygtk2 pygtk2-codegen pygtk2-devel pygtk2-docOperating systems
    • Update to 2.24.0-25.module_el8.9.0+3725+d1441900
    • Update to 2.28.7-5.module_el8.10.0+4267+35168c80
    • Update to 2:2.8.22-26.module_el8.10.0+4306+69430cd5.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. ALSA-2026:84721

    Not ratedFix available

    Important: wireshark security update

    The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76886) * wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write (CVE-2026-76880) * wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector (CVE-2026-76919) * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76879) * wireshark: Wireshark: Denial of Service via X.509IF protocol dissector crash (CVE-2026-769

    wireshark wireshark-cli wireshark-develOperating systems
    • Update to 1:4.4.2-10.el10_2.8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. ALSA-2026:84595

    Not ratedFix available

    Moderate: cockpit-files security update

    A filesystem browser for Cockpit Security Fix(es): * cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste (CVE-2026-91202) * cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race (CVE-2026-91205) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    cockpit-filesOperating systems
    • Update to 36.1-1.el9_8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. ALSA-2026:84594

    Not ratedFix available

    Moderate: environment-modules security update

    The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "module" utility, which interprets module files. Security Fix(es): * environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters (CVE-2026-85013) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related informati

    environment-modulesOperating systems
    • Update to 5.3.0-2.el9_8.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. ALSA-2026:84591

    Not ratedFix available

    Important: emacs security update

    GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219) * emacs: emacs: Command injection via crafted filenames in TRAMP (CVE-2026-79992) * emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the Ref

    emacs emacs-common emacs-filesystem emacs-lucid emacs-nwOperating systems
    • Update to 1:29.4-14.el10_2.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. ALSA-2026:84590

    Not ratedFix available

    Moderate: perl-URI security update

    This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 (and updated by RFC 2732). Security Fix(es): * URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization (CVE-2026-19953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    perl-uriOperating systems
    • Update to 1.73-4.el8_10
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. ALSA-2026:84588

    Not ratedFix available

    Moderate: perl-URI security update

    This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 (and updated by RFC 2732). Security Fix(es): * URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization (CVE-2026-19953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    perl-uriOperating systems
    • Update to 5.09-3.el9_8.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. ALSA-2026:84587

    Not ratedFix available

    Moderate: perl-URI security update

    This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 (and updated by RFC 2732). Security Fix(es): * URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization (CVE-2026-19953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    perl-uriOperating systems
    • Update to 5.27-3.el10_2.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. ALSA-2026:84586

    Not ratedFix available

    Important: libsoup security update

    The libsoup packages provide an HTTP client and server library for GNOME. Security Fix(es): * libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion (CVE-2026-102556) * libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly (CVE-2026-102557) * libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth (CVE-2026-102558) * libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking (CVE-2026-102559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page

    libsoup libsoup-develOperating systems
    • Update to 2.62.3-19.el8_10
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →