p PatchFirst

PatchFirst · Latest vulnerabilities

Operating systems stack vulnerabilities · Page 99

Vulnerabilities published for Operating systems in the last 30 days: 6428. Listed in the KEV catalogue: 4.

RSS ↗ JSON ↗
Filter vulnerabilities
Operating systems

Vulnerabilities: 160400

  1. CVE-2026-113786

    Low · CVSS 2.3EPSS 0.4%Fix available

    pypdf: Unvalidated JPEG image data loading

    pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.

    pypdf pypdf pypdf pypdf pypdf2 pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2Operating systems Python
    • Update to 6.21.1
    • Update to 6.21.1-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-109619

    Critical · CVSS 9.2EPSS 100%In KEVPublic exploitFix available

    RCE via stale global state

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

    php php8.2 php8.4 php8.4 php5 php7.0 php7.2 php7.4 php8.1 php8.3 php8.5 php8.5Operating systems PHP
    • Update to 5.5.9+dfsg-1ubuntu4.29+esm18
    • Update to 7.0.33-0ubuntu0.16.04.16+esm22
    • Update to 7.2.24-0ubuntu0.18.04.17+esm14
    • Update to 7.4.3-4ubuntu2.29+esm5
    • Update to 8.1.2-1ubuntu2.28
    • Update to 8.2.35
    • Update to 8.2.35-1~deb12u1
    • Update to 8.3.36
    • Update to 8.3.6-0ubuntu0.24.04.13
    • Update to 8.4.27
    • Update to 8.4.27-1
    • Update to 8.4.27-1~deb13u1
    • Update to 8.5.12
    • Update to 8.5.4-0ubuntu1.5
    • Update to 8.5.9-0ubuntu2.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2026-114437

    Medium · CVSS 6.3EPSS 0.13%Public exploitFix available

    Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For

    In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.

    chi golang-github-go-chi-chi golang-github-go-chi-chi golang-github-go-chi-chi golang-github-go-chi-chi golang-github-go-chi-chi golang-github-go-chi-chi golang-github-go-chi-chiOperating systems
    • Update to 5.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2026-109618

    Critical · CVSS 9.2EPSS 100%In KEVPublic exploitFix available

    RCE via OOM corruption

    PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

    php php8.2 php8.4 php8.4 php5 php7.0 php7.2 php7.4 php8.1 php8.3 php8.5 php8.5Operating systems PHP
    • Update to 5.5.9+dfsg-1ubuntu4.29+esm18
    • Update to 7.0.33-0ubuntu0.16.04.16+esm22
    • Update to 7.2.24-0ubuntu0.18.04.17+esm14
    • Update to 7.4.3-4ubuntu2.29+esm5
    • Update to 8.1.2-1ubuntu2.28
    • Update to 8.2.35
    • Update to 8.2.35-1~deb12u1
    • Update to 8.3.36
    • Update to 8.3.6-0ubuntu0.24.04.13
    • Update to 8.4.27
    • Update to 8.4.27-1
    • Update to 8.4.27-1~deb13u1
    • Update to 8.5.12
    • Update to 8.5.4-0ubuntu1.5
    • Update to 8.5.9-0ubuntu2.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. ALPINE-CVE-2026-97313

    High · CVSS 7.5Fix available

    ALPINE-CVE-2026-97313

    A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

    bind bind bindOperating systems
    • Update to 9.20.30-r0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. ALPINE-CVE-2026-96888

    High · CVSS 7.5Fix available

    ALPINE-CVE-2026-96888

    A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

    bind bind bindOperating systems
    • Update to 9.20.30-r0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. ALPINE-CVE-2026-94300

    High · CVSS 8.1Fix available

    ALPINE-CVE-2026-94300

    Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

    bind bind bindOperating systems
    • Update to 9.20.30-r0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. ALPINE-CVE-2026-19630

    High · CVSS 7.5Fix available

    ALPINE-CVE-2026-19630

    In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

    bind bind bindOperating systems
    • Update to 9.20.30-r0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. SUSE-SU-2026:4836-1

    Not ratedFix available

    Security update for cyrus-sasl

    This update for cyrus-sasl fixes the following issue: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST-MD5 clients (bsc#1284687).

    cyrus-sasl cyrus-sasl-saslauthd cyrus-sasl-bdb cyrus-sasl-saslauthd-bdb cyrus-sasl-bdb cyrus-sasl-saslauthd cyrus-sasl cyrus-sasl-bdb cyrus-sasl-saslauthd cyrus-sasl-saslauthd-bdb cyrus-sasl cyrus-sasl-bdbOperating systems
    • Update to 2.1.28-150600.7.17.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. SUSE-SU-2026:4835-1

    Not ratedFix available

    Security update for xwayland

    This update for xwayland fixes the following issues: - CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213). - CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218). - CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220). - CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225). - CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227). - CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233). - CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236). - CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer O

    xwaylandOperating systems
    • Update to 24.1.5-150700.3.25.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. SUSE-SU-2026:4834-1

    Not ratedFix available

    Security update for MozillaFirefox

    This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493): - CVE-2026-109704: Privilege escalation in the Application Update component. - CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. - CVE-2026-109706: Use-after-free in the Storage: IndexedDB component. - CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component. - CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component. - CVE-2026-109709: Information disclosure

    mozillafirefox mozillafirefox mozillafirefox mozillafirefox mozillafirefox mozillafirefox mozillafirefox mozillafirefox mozillafirefox mozillafirefox mozillafirefoxOperating systems
    • Update to 153.5.0-150400.157.16.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2026-97313

    High · CVSS 7.5EPSS 0.45%Fix available

    Specific RPZ configurations and query patterns may result in an unexpected exit

    A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

    bind 9 bind9 bind9 bind9 bind9 bind9 bind9 isc-dhcp bind9 bind9-libs bind9 bind9-libsOperating systems
    • Update to 1:9.20.30-1
    • Update to 1:9.20.30-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2026-96888

    High · CVSS 7.5EPSS 0.46%Fix available

    Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization

    A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

    bind 9 bind9 bind9 bind9 bind9 bind9 bind9 isc-dhcp bind9 bind9-libs bind9 bind9-libsOperating systems
    • Update to 1:9.20.30-1
    • Update to 1:9.20.30-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2026-94300

    High · CVSS 8.1EPSS 0.95%Public exploitFix available

    Concurrent GSS-TSIG messages corrupt memory

    Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

    bind 9 bind9 bind9 bind9 bind9 isc-dhcp bind9 bind9-libs bind9 bind9-libs bind9 isc-dhcpOperating systems
    • Update to 1:9.20.30-1
    • Update to 1:9.20.30-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2026-19630

    High · CVSS 7.5EPSS 0.45%Fix available

    Amplified resource exhaustion in inbound message processing

    In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

    bind 9 bind9 bind9 bind9 bind9 bind9 bind9 isc-dhcp bind9 bind9-libs bind9 bind9-libsOperating systems
    • Update to 1:9.20.30-1
    • Update to 1:9.20.30-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. SUSE-SU-2026:24371-1

    Not ratedFix available

    Security update for the Linux Kernel

    The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531). - CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267). - CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851). - CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694). - CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730). - CVE-2026-53108: powerpc/64s: Fix unmap race

    kernel-default kernel-default-base kernel-kvmsmall kernel-sourceOperating systems
    • Update to 6.4.0-159998.54.1
    • Update to 6.4.0-159998.54.1.159998.21.40
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. RLSA-2026:85308

    High · CVSS 8.8Fix available

    Important: bubblewrap security update

    Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    bubblewrapOperating systems
    • Update to 0:0.10.0-5.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. RLSA-2026:85848

    High · CVSS 7.5Fix available

    Important: rust-sequoia-sq security update

    Command-line frontends for Sequoia. Security Fix(es): * hickory-resolver: hickory-resolver: DNSSEC validation bypass allows forged DNS records (CVE-2026-93657) * rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List (CVE-2026-93599) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    rust-sequoia-sqOperating systems
    • Update to 0:1.4.0.1-4.el10_2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →