p PatchFirst

PatchFirst · Latest vulnerabilities

Operating systems stack vulnerabilities · Page 87

Vulnerabilities published for Operating systems in the last 30 days: 6402. Listed in the KEV catalogue: 4.

RSS ↗ JSON ↗
Filter vulnerabilities
Operating systems

Vulnerabilities: 160373

  1. CVE-2026-114645

    Medium · CVSS 5.7EPSS 0.17%Fix available

    Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping

    A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side configuration, in conjunction with the affected authentication mechanism, can cause the driver to write outside the bounds of the allocated buffer. This may result in corruption of client process memory and denial of service of the client application. The issue affects only client builds compiled with the Windows-native authentication backend.

    c driver mongo-c-driver mongo-c-driver mongo-c-driver mongo-c-driver mongo-c-driverOperating systems
    • Update to 1.30.14
    • Update to 2.5.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-115381

    Medium · CVSS 5.9EPSS 0.21%Fix available

    Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroes

    Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configured. A malicious WebAssembly guest can request huge zero-filled writes, exhausting host memory and causing denial of service.

    wasmtime rust-wasmtime rust-wasmtime rust-wasmtime rust-wasmtime rust-wasmtimeOperating systems
    • Update to 36.0.17
    • Update to 48.0.4
    • Update to 49.0.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-115380

    Medium · CVSS 5.1EPSS 0.12%Fix available

    Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff

    Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming or checking fuel. Malicious guest modules can pass many subscriptions to force long-running host computation that ignores configured fuel limits.

    wasmtime rust-wasmtime rust-wasmtime rust-wasmtime rust-wasmtime rust-wasmtimeOperating systems
    • Update to 36.0.17
    • Update to 48.0.4
    • Update to 49.0.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2026-115379

    Medium · CVSS 6.9EPSS 0.28%Fix available

    Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call

    Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call unrooted when compiling Wasm modules. Attackers can supply Wasm modules whose callee triggers garbage collection, leaving stale or dangling references that cause GC heap corruption or incorrect execution.

    wasmtime rust-wasmtime rust-wasmtime rust-wasmtimeOperating systems
    • Update to 48.0.4
    • Update to 49.0.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2026-115378

    Medium · CVSS 6.9EPSS 0.29%Fix available

    Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull

    Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.

    incus incus incus incus incus incusOperating systems
    • Update to 6.0.7
    • Update to 7.0.1-5
    • Update to 7.0.2
    • Update to 7.5.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2026-115377

    Critical · CVSS 9.4EPSS 0.4%Fix available

    Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream

    Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.

    incus incus incus incus incus incusOperating systems
    • Update to 6.0.4-2+deb13u11
    • Update to 6.0.7
    • Update to 7.0.1-5
    • Update to 7.0.2
    • Update to 7.5.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2026-115376

    High · CVSS 8.3EPSS 0.27%Fix available

    Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy

    Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read other projects' volumes, snapshots, and configuration.

    incus incus incus incus incus incusOperating systems
    • Update to 6.0.4-2+deb13u11
    • Update to 7.0.1-5
    • Update to 7.0.2
    • Update to 7.5.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2026-115375

    Critical · CVSS 9.4EPSS 0.4%Fix available

    Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes

    Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.

    incus incus incus incus incusOperating systems
    • Update to 7.0.1-5
    • Update to 7.0.2
    • Update to 7.5.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2026-115374

    High · CVSS 7.1EPSS 0.18%Fix available

    Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs

    Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL to copy other bucket objects onto the granted key, disclosing their contents and ETags.

    incus incus incus incus incusOperating systems
    • Update to 7.0.1-5
    • Update to 7.0.2
    • Update to 7.5.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2026-115373

    High · CVSS 7EPSS 0.29%Fix available

    Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}

    Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens.

    incus incus incus incus incus incusOperating systems
    • Update to 6.0.4-2+deb13u11
    • Update to 6.0.7
    • Update to 7.0.1-5
    • Update to 7.0.2
    • Update to 7.5.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2026-115372

    Critical · CVSS 9EPSS 0.36%Fix available

    Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options

    Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.

    incus incus incus incus incus incusOperating systems
    • Update to 6.0.4-2+deb13u11
    • Update to 7.0.1-5
    • Update to 7.5.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2026-115371

    High · CVSS 7.1EPSS 0.22%Fix available

    LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints

    Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.

    incus incus incus incus incus incusOperating systems
    • Update to 6.0.4-2+deb13u11
    • Update to 6.0.7
    • Update to 7.0.1-5
    • Update to 7.0.2
    • Update to 7.5.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2026-115370

    Medium · CVSS 5.3EPSS 0.36%Fix available

    Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh

    Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project users to use pull mode migration via clustered refresh requests. Attackers with instance creation rights can send a refresh migration request for an existing instance to make the server open outbound TLS websocket connections and probe reachable services.

    incus incus incus incus incusOperating systems
    • Update to 6.0.7
    • Update to 7.0.1-5
    • Update to 7.0.2
    • Update to 7.5.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2026-115355

    High · CVSS 8.7EPSS 0.46%Fix available

    Mistune before 3.3.0 Path Traversal and XSS via Include Directive

    Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set.

    mistune mistune mistune mistune mistune mistune mistune mistune mistune mistune mistune mistuneOperating systems Python
    • Update to 3.3.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2026-115354

    High · CVSS 7.1EPSS 0.47%Fix available

    Mistune before 3.3.0 Arbitrary Local File Read via Include Directive

    Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output.

    mistune mistune mistune mistune mistune mistune mistune mistune mistune mistune mistuneOperating systems
    • Update to 3.3.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2026-115353

    Critical · CVSS 9.2EPSS 0.39%Fix available

    Mistune before 3.3.0 Path Traversal via include Directive

    Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.

    mistune mistune mistune mistune mistune mistune mistune mistune mistune mistune mistuneOperating systems
    • Update to 3.3.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2026-115352

    High · CVSS 8.7EPSS 0.44%Fix available

    Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser

    Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label probing, occupying rendering workers for 30+ seconds per 16 KB input.

    mistune mistune mistune mistune mistune mistune mistune mistune mistune mistune mistuneOperating systems
    • Update to 3.3.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2026-115351

    Medium · CVSS 5.3EPSS 0.22%Fix available

    Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option

    Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url() to the rendered figure style attribute, forcing victim browsers to send requests to attacker servers and leak attribute values.

    mistune mistune mistune mistune mistune mistune mistune mistune mistune mistune mistuneOperating systems
    • Update to 3.3.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2026-115350

    Medium · CVSS 5.3EPSS 0.19%Fix available

    Mistune before 3.3.0 Stored XSS via Include Directive HTML Files

    Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content as raw block_html tokens. Attackers who can plant an HTML file readable by the renderer can reference it via an include directive, combined with path traversal, to execute stored scripts when escape=False is set.

    mistune mistune mistune mistune mistune mistune mistune mistune mistune mistune mistuneOperating systems
    • Update to 3.3.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2026-115349

    High · CVSS 8.7EPSS 0.34%Fix available

    Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing

    Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.

    mistune mistune mistune mistune mistune mistune mistune mistune mistune mistune mistuneOperating systems
    • Update to 3.3.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →