PatchFirst · Свежие уязвимости
За последние 30 дней в Операционные системы опубликовано уязвимостей: 6808; в каталоге KEV: 4.
Уязвимостей: 160891
This update for python-oauthlib fixes the following issue: - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation (bsc#1283526).
This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493): - CVE-2026-109704: Privilege escalation in the Application Update component. - CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. - CVE-2026-109706: Use-after-free in the Storage: IndexedDB component. - CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component. - CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component. - CVE-2026-109709: Information disclosu
This update for perl-DBI fixes the following issues: - CVE-2026-88815: numeric value incorrectly treated as strings in `sql_type_cast_svpv` allows for process crash (bsc#1283055). - CVE-2026-88816: numeric value incorrectly treated as strings in `FetchHashKeyName` allows for process crash (bsc#1283056).
This update for pgvector fixes the following issue: - CVE-2026-103484: database users with the ability to create an IVFFlat index can write data out-of-bounds, which can lead to arbitrary code execution (bsc#1284129). Changes for pgvector: - Updated to version 0.8.7
This update for cups-filters fixes the following issue: - CVE-2026-95511: `lpadmin` user can escalate privileges to `root` via printers that uses a privileged serial backend (bsc#1282291).
This update for cyrus-sasl fixes the following issue: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST-MD5 clients (bsc#1284687).
This update for libpng16 fixes the following issues: - CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression (bsc#1283183). Changes for libpng16: - version update to 1.6.59 (jsc#PED-16190): * Fixed a regression introduced in version 1.6.47 that caused libpng to reject hIST chunks in their correct position, after PLTE. * Prevented a double free of `png_struct` members after an allocation failure. * Applied fixes and updates to the CMake build. * Adopted the REUSE Specification for licensing the CI files.
This update for ImageMagick fixes the following issues: - CVE-2026-93586: use-after-free in the `ImagesToBlob` method can lead to a process crash (bsc#1281912). - CVE-2026-93587: policy bypass in the PCD, CUBE and HALD coders can lead to extra memory allocation and a denial of service (bsc#1281909). - CVE-2026-93588: NULL pointer dereference in the PNM coder can lead to a denial of service (bsc#1281910). - CVE-2026-93589: division-by-zero flaw in the FLIF encoder can lead to a denial of service (bsc#1281911). - CVE-2026-105083: security policy not applied when a user changes the DOCTYPE in the `policy.xml` file to something else that is
This update for busybox fixes the following issues: - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted `ClientKeyExchange` message (bsc#1282575). - CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550). - CVE-2026-88832: romfs volume ID parsing uses unbounded `strlen` on attacker-controlled metadata and allows for a heap buffer overflow when crafted filesystem images are processed (bsc#1282576). - CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-
This update for bouncycastle fixes the following issues: - CVE-2026-17507: negative signed leaf_index values from unsigned wire encodings can cause heap exhaustion (bsc#1284075). - CVE-2026-17508: unbounded KDF iteration and memory parameters can cause resource exhaustion (bsc#1284073). - CVE-2026-18036: variable-time modulo and division operations in NTRU implementation can allow timing side-channel attacks (bsc#1284065). - CVE-2026-18040: table lookups and variable-time duplicate scanning in HQC can cause cache side-channel leaks (bsc#1284205). - CVE-2026-71885: unbound X.509 certificates in MLS LeafNode verification can cause identi
This update for libpng16 fixes the following issue: - CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression (bsc#1283183). Changes for libpng16: - version update to 1.6.59: * Fixed a regression introduced in version 1.6.47 that caused libpng to reject hIST chunks in their correct position, after PLTE. * Prevented a double free of `png_struct` members after an allocation failure. * Applied fixes and updates to the CMake build. * Adopted the REUSE Specification for licensing the CI files.
This update for cyrus-sasl fixes the following issue: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST-MD5 clients (bsc#1284687).
This update for python-soupsieve fixes the following issues: - CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex `RE_WS_END` can lead to DoS (bsc#1281119). - CVE-2026-86000: quadratic complexity when running the `IDENTIFIER` / `VALUE` selector sub-patterns can lead to a DoS (bsc#1281120).
This update for the SUSE Linux Enterprise Kernel 4.12.14-122.280 fixes various security issues: The following security issues were fixed: - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269775). - CVE-2026-63794: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (bsc#1271965). - CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272386). - CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1276303).
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a "daemon" program that runs in the back-ground and acts as the backend component controlling authentication. hostapd supports separate frontend programs and an example text-based frontend, hostapd_cli, is included with hostapd. Security Fix(es): * hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request (CVE-2026-58374) For more details about the security issue(s), includin
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588) * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752) * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) * kernel: sctp: stop processing a packet once it
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588) * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752) * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) * kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479) * kernel: perf
Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Arbitrary file deletion via race condition during temporary directory cleanup (CVE-2026-12345) * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-1944
Сопоставьте установленный стек и версии со свежими базами уязвимостей.