PatchFirst · Свежие уязвимости
Следите за новыми уязвимостями по стеку, продукту и установленной версии. Уязвимостей, опубликованных или эскалированных за последние 30 дней: 20688; из них в KEV: 90.
Свежие сообщения об уязвимостях из анонсов разработчиков и новостей безопасности. Предупреждения не меняют рейтинг защищённости.
По данным OpenNet, в Node.js найдена уязвимость — удалённое выполнение кода (CVE-2026-111497). Точные затронутые версии не указаны. Версия с исправлением в сообщении не указана.
Что сделать сейчас: Проверьте, вышло ли обновление Node.js с исправлением, и установите его.
CVE-2026-111497
По данным GitHub Advisory Database, в Node.js найдена уязвимость — отказ в обслуживании (CVE-2026-109932). Точные затронутые версии не указаны. Версия с исправлением в сообщении не указана.
Что сделать сейчас: Проверьте, вышло ли обновление Node.js с исправлением, и установите его.
CVE-2026-109932
По данным OpenNet, в PHP найдена уязвимость — удалённое выполнение кода (CVE-2026-115560). Точные затронутые версии не указаны. Версия с исправлением в сообщении не указана.
Что сделать сейчас: Проверьте, вышло ли обновление PHP с исправлением, и установите его.
CVE-2026-115560
По данным alpinelinux.org, в OpenSSH найдена уязвимость — обход аутентификации. Затронуты все поддерживаемые версии. Затронутые ОС: alpine. Исправленные пакеты: alpine edge openssh 10.6_p2-r0; alpine 3.24 openssh 10.3_p1-r2; alpine 3.23 openssh 10.2_p1-r1; alpine 3.22 openssh 10.0_p1-r11; alpine 3.21 openssh 9.9_p2-r1; alpine 3.20 openssh 9.7_p1-r6; alpine 3.19 openssh 9.6_p1-r3; alpine 3.18 openssh 9.3_p2-r4; alpine 3.17 openssh 9.1_p1-r7; alpine 3.16 openssh 9.0_p1-r6. Исправленные версии: 10.6p2. Подробности и временные меры см. в первоисточнике.
Что сделать сейчас: Обновите OpenSSH до 10.6p2 или новее. Временное смягчение по сообщению alpinelinux.org: установите PasswordAuthentication = no в sshd_config до обновления.
Дистрибутивы: Alpine
Исправленные пакеты:
Проверьте условия эксплуатации:
Уязвимостей: 496988
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Use after free in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Out of bounds write in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Incorrect authorization in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Improper input validation in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: High)
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Information loss in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Сопоставьте установленный стек и версии со свежими базами уязвимостей.