Report Name: Linux Patch Wednesday August 2026
Generated: 2026-08-26 01:37:12

Product Name	Prevalence	U	C	H	M	L	A	Comment
Angular	0.95				3		3	Angular is a development platform for building mobile and desktop web applications using TypeScript, JavaScript, and other languages. It provides a component-based architecture, declarative templates, dependency injection, powerful tooling, and extensive ecosystem support for creating scalable, high-performance web apps.
Vim	0.95			3	4		7	Highly configurable command-line text editor used in development and system administration.
pip	0.95			1	2		3	pip is the standard package installer for Python, used to install and manage software packages from the Python Package Index (PyPI) and other repositories.
systemd	0.95			1	6		7	System and service manager for Linux, including udev device management subsystem.
Active Directory	0.9				1		1	Active Directory is a directory service developed by Microsoft for Windows domain networks
Apache Log4j	0.9			1			1	Apache Log4j is a Java-based logging utility
Django	0.9			1	5		6	Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides built-in tools for database models, authentication, URL routing, templates, and security features, making it one of the most widely used frameworks for building scalable and maintainable web applications.
GLib	0.9			4	1		5	GLib is a widely used low-level core library for the GNOME ecosystem and many Linux applications, providing data structures, utility APIs, event loops, IPC facilities, and GDBus for D-Bus communication.
HTTP/2	0.9			1			1	HTTP/2 is a major revision of the HTTP network protocol used by the World Wide Web
Intel(R) Processor	0.9			1	3		4	Intel's processors from the pioneering 4-bit 4004 (1971) to the present high-end offerings
Linux Kernel	0.9		1	40	900	413	1354	The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel
Rust	0.9			2			2	Rust is a modern, high-performance systems programming language focused on safety, concurrency, and memory management.
WordPress	0.9	1	1				2	WordPress is a widely-used open source content management system (CMS) for building websites and blogs. It provides a plugin and theme architecture and is written in PHP, typically paired with MySQL/MariaDB for storage.
nghttp2	0.9			1			1	nghttp2 is an implementation of HTTP/2 and its header compression algorithm HPACK in C
Grafana	0.85				3		3	Grafana is an open-source analytics and monitoring platform that provides dashboards and visualization tools for metrics collected from various data sources.
.NET Core	0.8			1			1	.NET Core
.NET Framework	0.8			3			3	.NET Framework
APT	0.8			1	1		2	A free-software user interface that works with core libraries to handle the installation and removal of software on Debian
Action Pack	0.8		1				1	Action Pack is a component of Ruby on Rails that provides web request handling, routing, controller, and response functionality. The affected functionality involves Active Storage and libvips image processing.
Binutils	0.8				2		2	The GNU Binary Utilities, or binutils, are a set of programming tools for creating and managing binary programs, object files, libraries, profile data, and assembly source code
CUPS	0.8				1		1	CUPS is a modular printing system for Unix-like computer operating systems which allows a computer to act as a print server
Chromium	0.8		1	188	257	1	447	Chromium is a free and open-source web browser project, mainly developed and maintained by Google
GNOME desktop	0.8			1	1		2	GNOME originally an acronym for GNU Network Object Model Environment, is a free and open-source desktop environment for Linux and other Unix-like operating systems
GNU C Library	0.8			1	3	1	5	The GNU C Library, commonly known as glibc, is the GNU Project's implementation of the C standard library
Keycloak	0.8		1	1	1	2	5	Keycloak is an open‑source identity and access management (IAM) solution that provides single sign‑on (SSO), user federation, identity brokering, and access control for applications and services.
Mozilla Firefox	0.8			31	56		87	Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation
Netty	0.8		4	11	8		23	Netty is a non-blocking I/O client-server framework for the development of Java network applications such as protocol servers and clients
Node.js	0.8			2	15	1	18	Node.js is a cross-platform, open-source server environment that can run on Windows, Linux, Unix, macOS, and more
OpenSSH	0.8			1	2	2	5	OpenSSH is a suite of secure networking utilities based on the Secure Shell protocol, which provides a secure channel over an unsecured network in a client–server architecture
OpenSSL	0.8			6	3		9	A software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end
PHP	0.8		2	2	6		10	PHP is a general-purpose scripting language geared towards web development. It was originally created by Danish-Canadian programmer Rasmus Lerdorf in 1993 and released in 1995.
RPC	0.8				2		2	Remote Procedure Call Runtime
Safari	0.8				1		1	Safari is a web browser developed by Apple. It is built into Apple's operating systems, including macOS, iOS, iPadOS and their upcoming VisionOS, and uses Apple's open-source browser engine WebKit, which was derived from KHTML.
Samba	0.8			2	2		4	Samba is a free software re-implementation of the SMB networking protocol, and was originally developed by Andrew Tridgell
TCG TPM 2.0 Reference Implementation	0.8				2		2	The TCG TPM 2.0 Reference Implementation is the reference implementation of the Trusted Platform Module 2.0 specification, providing TPM functionality including cryptographic operations such as RSA OAEP decryption and serving as a code base for TPM implementations in hardware, firmware, and software.
The Qt Company Qt	0.8				2		2	Qt is a cross-platform application development framework used to build graphical user interfaces and applications for desktop, mobile, and embedded systems. It provides a comprehensive set of libraries, tools, and APIs, including Qt Quick for declarative UI development using QML. The vulnerability affects the Qt Quick Text component, where improper validation of width and height attributes in the tag can lead to excessive resource allocation and application unresponsiveness.
WinRAR	0.8	1		1			2	WinRAR is a trialware file archiver utility for Windows, developed by Eugene Roshal of win.rar GmbH
Windows NTFS	0.8				1		1	The default file system of the Windows NT family
Windows Resilient File System (ReFS)	0.8			1			1	Windows component
go-archive	0.8		1				1	moby/go-archive is a Go library used by the Moby and Docker ecosystem for creating, extracting, and applying filesystem archive layers.
Gitea	0.75			3	6		9	Gitea is a lightweight self-hosted Git service that provides source code hosting, pull requests, issue tracking, CI integrations, and user management through a web interface.
Apache Tomcat	0.7				2		2	Apache Tomcat is a free and open-source implementation of the Jakarta Servlet, Jakarta Expression Language, and WebSocket technologies
Apache Traffic Server	0.7		1	12	24	1	38	The Apache Traffic Server is a modular, high-performance reverse proxy and forward proxy server, generally comparable to Nginx and Squid
Apple iOS	0.7				1		1	iOS is an operating system developed and marketed by Apple Inc
BIND	0.7				10		10	BIND is a suite of software for interacting with the Domain Name System
Calibre	0.7				2		2	Calibre is a cross-platform free and open-source suite of e-book software
FFmpeg	0.7		1	6	11	3	21	FFmpeg is a free and open-source software project consisting of a suite of libraries and programs for handling video, audio, and other multimedia files and streams
JupyterHub	0.7				1		1	Multi-user server for Jupyter notebooks used in education and data science environments.
Kubernetes	0.7		1	1	2	1	5	Kubernetes is an open-source container orchestration system for automating software deployment, scaling, and management
Open Asset Import Library Assimp	0.7				5		5	Open Asset Import Library is a library that loads various 3D file formats into a shared, in-memory format
Oracle MySQL	0.7			4	25		29	MySQL is an open-source relational database management system
Oracle VM VirtualBox	0.7				15		15	Oracle VM VirtualBox is a hosted hypervisor for x86 virtualization developed by Oracle Corporation
QEMU	0.7			1	3		4	QEMU is a generic and open source machine & userspace emulator and virtualizer
SQLite	0.7				2		2	SQLite is a database engine written in the C programming language
Apache ActiveMQ	0.6			2			2	Apache ActiveMQ is an open source message broker written in Java together with a full Java Message Service (JMS) client
Axios	0.6			6			6	axios is a promise based HTTP client for the browser and node.js
Bouncy Castle	0.6			1	32		33	Bouncy Castle is a collection of APIs used in cryptography
ClamAV	0.6				7		7	ClamAV (Clam AntiVirus) is a free software, cross-platform antimalware toolkit able to detect many types of malware, including viruses
Exim	0.6				2		2	Exim is a mail transfer agent (MTA) used on Unix-like operating systems
FreeRDP	0.6		1	15	11		27	FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license
GNU Screen	0.6				1	1	2	GNU Screen is a terminal multiplexer that allows multiple virtual terminal sessions to be accessed and controlled from a single physical terminal. It supports session detaching/reattaching, multiple windows, logging, and scripting — and historically is distributed as part of the GNU Project for use on Unix-like systems. When run with setuid-root privileges (as in CVE-2025-23395), Screen may perform privileged file operations on user-supplied paths without dropping elevated privileges, enabling unprivileged users to create root-owned files and potentially escalate to root.
Jenkins	0.6	1			5	2	8	Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery.
Libsoup	0.6				9		9	libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop to integrate well with GNOME applications and also has a synchronous API for use in CLI tools.
MongoDB	0.6				6		6	MongoDB is a source-available, cross-platform, document-oriented database program
Nokogiri	0.6				2		2	Nokogiri is an open source XML and HTML library for the Ruby programming language
Oracle Java SE	0.6				13	1	14	Oracle Java SE
Perl	0.6			2	11		13	Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages
PostgreSQL	0.6				4		4	PostgreSQL also known as Postgres, is a free and open-source relational database management system emphasizing extensibility and SQL compliance.
PyTorch	0.6			1	1		2	PyTorch is a machine learning library based on the Torch library, used for applications such as computer vision and natural language processing, originally developed by Meta AI and now part of the Linux Foundation umbrella
Python	0.6			5	16	1	22	Python is a high-level, general-purpose programming language
Rclone	0.6				4	1	5	Rclone is a command-line program to sync files and directories to and from different cloud storage providers, supporting over 40 cloud storage products including S3, Google Drive, Dropbox, OneDrive, and many more.
Redis	0.6		2		1		3	Redis is an open-source in-memory storage, used as a distributed, in-memory key–value database, cache and message broker, with optional durability
Roundcube	0.6			2	7	1	10	Roundcube is a web-based IMAP email client
Snapd	0.6				1	1	2	snapd is the background service that manages Snap packages on Linux, providing installation, updates, confinement, and runtime environment for snaps.
UDisks	0.6				1		1	UDisks is a system service daemon that provides interfaces to enumerate, query, and manage storage devices such as hard drives, SSDs, removable media, and loop devices. It exposes functionality over the D-Bus system bus, allowing unprivileged applications to perform safe disk operations while privileged actions are mediated by PolicyKit.
Vault	0.6				1		1	Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets critical in modern computing
gdk-pixbuf	0.6				1		1	gdk-pixbuf is an open source image loading and manipulation library used primarily in GNOME-based applications for handling various image formats, including JPEG, PNG, and GIF.
libheif	0.6				2		2	libheif is an open source HEIF and AVIF image file format decoder and encoder library, supporting modern image codecs and container features.
pgAdmin	0.6			2	3		5	pgAdmin is the most popular and feature rich Open Source administration and development platform for PostgreSQL, the most advanced Open Source database in the world
389 Directory Server	0.5				6		6	389 Directory Server is a highly usable, fully featured, reliable and secure LDAP server implementation
ABRT	0.5					1	1	Product detected by a:abrt_project:abrt (exists in CPE dict)
APR-util	0.5				4		4	Product detected by a:apache:apr-util (exists in CPE dict)
Cacti	0.5				1		1	Cacti is an open source operational monitoring and fault management framework
Capstone	0.5			1			1	Product detected by a:capstone-engine:capstone (exists in CPE dict)
CoreDNS	0.5		2	4	1		7	Product detected by a:coredns.io:coredns (exists in CPE dict)
Crypto-js	0.5				1		1	Product detected by a:crypto-js_project:crypto-js (exists in CPE dict)
DNSSEC	0.5				3		3	The Domain Name System Security Extensions (DNSSEC) is a feature of the Domain Name System (DNS) that authenticates responses to domain name lookups
DOMPurify	0.5			10	2		12	DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG
Dompdf	0.5			6			6	Product detected by a:dompdf_project:dompdf (exists in CPE dict)
ExifTool	0.5		1				1	Product detected by a:exiftool_project:exiftool (exists in CPE dict)
GIMP	0.5		1	2	2		5	GIMP is an open-source image manipulation program used for photo editing, graphic design, and digital art creation.
HttpClient	0.5				1	1	2	Product detected by a:apache:httpclient (exists in CPE dict)
Jena Fuseki	0.5				1		1	Product detected by a:apache:jena_fuseki (exists in CPE dict)
Jetty	0.5		1	1	1		3	Product detected by a:eclipse:jetty (exists in CPE dict)
Libarchive	0.5				1		1	Multi-format archive and compression library
MINA SSHD	0.5				3		3	Product detected by a:apache:mina_sshd (exists in CPE dict)
OMR	0.5				1		1	Product detected by a:eclipse:omr (exists in CPE dict)
OpenJ9	0.5				2		2	Product detected by a:eclipse:openj9 (exists in CPE dict)
OpenNLP	0.5				1		1	Product detected by a:apache:opennlp (exists in CPE dict)
Pillow	0.5			2			2	Pillow is a Python imaging library that adds image processing capabilities to Python, supporting formats such as PNG, JPEG, GIF, TIFF, and BMP.
Pypdf	0.5				2		2	PyPDF is a Python library for reading, manipulating, and writing PDF files, including extraction, splitting, merging, and encryption features.
SPIP	0.5	1			1		2	SPIP is an open-source software content management system designed for web site publishing, oriented towards online collaborative editing
Tar	0.5				1	1	2	Product detected by a:gnu:tar (exists in CPE dict)
Thrift	0.5				10	1	11	Product detected by a:apache:thrift (exists in CPE dict)
Traefik	0.5			1	2		3	Product detected by a:traefik:traefik (exists in CPE dict)
VBScript	0.5				1		1	VBScript
Visual Studio 2022	0.5				4		4	Product detected by a:microsoft:visual_studio_2022 (exists in CPE dict)
WPAD	0.5					1	1	WPAD
Websphere Application Server	0.5				1		1	Product detected by a:ibm:websphere_application_server (exists in CPE dict)
body-parser	0.5				1		1	Product detected by a:openjsf:body-parser (does NOT exist in CPE dict)
brace-expansion	0.5			1			1	Product detected by a:juliangruber:brace-expansion (does NOT exist in CPE dict)
buildkit	0.5				3	1	4	Product detected by a:mobyproject:buildkit (exists in CPE dict)
cilium	0.5				1		1	Product detected by a:cilium:cilium (exists in CPE dict)
cjson	0.5			3			3	Product detected by a:davegamble:cjson (does NOT exist in CPE dict)
data::entropy	0.5					1	1	Product detected by a:rrwo:dataentropy (does NOT exist in CPE dict)
dolibarr_erp\\/crm	0.5		1				1	Product detected by a:dolibarr:dolibarr_erp\\/crm (does NOT exist in CPE dict)
domoticz	0.5				1		1	Product detected by a:domoticz:domoticz (exists in CPE dict)
dr_libs	0.5			1			1	Product detected by a:mackron:dr_libs (does NOT exist in CPE dict)
erlang\\/otp	0.5				1		1	Product detected by a:erlang:erlang\\/otp (does NOT exist in CPE dict)
gobgp	0.5			1			1	Product detected by a:osrg:gobgp (does NOT exist in CPE dict)
gopacket	0.5			1			1	Product detected by a:gopacket:gopacket (does NOT exist in CPE dict)
grafana	0.5				1		1	Product detected by a:grafana:grafana (exists in CPE dict)
gstreamer	0.5				2		2	Product detected by a:gstreamer:gstreamer (exists in CPE dict)
hardened_images	0.5			2	1		3	Product detected by a:redhat:hardened_images (does NOT exist in CPE dict)
hdf5	0.5			1	1		2	Product detected by a:hdfgroup:hdf5 (exists in CPE dict)
home-assistant	0.5			1			1	Product detected by a:home-assistant:home-assistant (exists in CPE dict)
libcupsfilters	0.5			1			1	libcupsfilters is a library from the OpenPrinting project that provides filtering and printer-related functionality used in the CUPS printing ecosystem.
libssh	0.5			1	9		10	Product detected by a:libssh:libssh (exists in CPE dict)
libssh2	0.5				2		2	Product detected by a:libssh2:libssh2 (exists in CPE dict)
libucl	0.5			1			1	Product detected by a:vstakhov:libucl (does NOT exist in CPE dict)
messagepack	0.5			1			1	Product detected by a:msgpack:messagepack (does NOT exist in CPE dict)
mongodb	0.5				5	4	9	Product detected by a:mongodb:mongodb (exists in CPE dict)
nanoid	0.5				2		2	Product detected by a:nanoid_project:nanoid (exists in CPE dict)
nltk	0.5			1			1	Product detected by a:nltk:nltk (exists in CPE dict)
pgx	0.5				1		1	Product detected by a:jackc:pgx (does NOT exist in CPE dict)
postcss	0.5			2			2	Product detected by a:postcss:postcss (exists in CPE dict)
postgresql	0.5		1	10	11	5	27	Product detected by a:postgresql:postgresql (exists in CPE dict)
satellite	0.5				2	2	4	Product detected by a:redhat:satellite (exists in CPE dict)
sssd	0.5			1	1	1	3	Product detected by a:fedoraproject:sssd (exists in CPE dict)
unbound	0.5				15	8	23	Product detected by a:nlnetlabs:unbound (exists in CPE dict)
undici	0.5				2	3	5	Product detected by a:nodejs:undici (exists in CPE dict)
wolfSSL	0.5				1	1	2	wolfSSL is a small, portable, embedded SSL/TLS library targeted for use by embedded systems developers
wolfssl	0.5				4		4	Product detected by a:wolfssl:wolfssl (exists in CPE dict)
Apache Tika	0.4				1		1	Apache Tika is an open source content analysis toolkit that detects and extracts metadata and structured text content from a wide range of file formats such as PDF, Microsoft Office, and multimedia files.
Erlang/OTP	0.4			1	3	1	5	Erlang/OTP is a set of libraries for the Erlang programming language
Flatpak	0.4				1		1	Flatpak is a utility for software deployment and package management for Linux
GPAC	0.4					2	2	GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity)
Git	0.4		3	8	4	5	20	Git
Keras	0.4			1	2		3	High-level neural networks API, running on top of TensorFlow, allowing model building and training
JOSE	0.3				1		1	JavaScript module for JSON Object Signing and Encryption (JOSE)
tiny-http	0.25			2			2	tiny-http is a lightweight HTTP server library for Rust applications, providing request parsing, response handling, and HTTP connection management.
GitHub	0.2				1	2	3	GitHub, Inc. is an Internet hosting service for software development and version control using Git
Unknown Product	0				205	232	437	Unknown Product

Vulnerability Type	Criticality	U	C	H	M	L	A
Remote Code Execution	1.0	3	9	98	38		148
Authentication Bypass	0.98		3	23	80	1	107
Code Injection	0.97	1	1	4	14		20
Command Injection	0.97		4	13	6		23
Arbitrary File Writing	0.95		1	2	2		5
Security Feature Bypass	0.9		3	154	234		391
Server-Side Request Forgery	0.87			2	10		12
Elevation of Privilege	0.85		1	3	24		28
Arbitrary File Reading	0.83			2	3		5
Information Disclosure	0.83			17	50	3	70
Cross Site Scripting	0.8			10	28		38
Open Redirect	0.75				4		4
Denial of Service	0.7		4	48	225	9	286
Path Traversal	0.7			7	26	2	35
Incorrect Calculation	0.5		1	3	31	5	40
Memory Corruption	0.5		1	49	449	26	525
Spoofing	0.4			1	35	1	37
Tampering	0.3			4	1		5
Unknown Vulnerability Type	0				622	659	1281

Source	U	C	H	M	L	A
almalinux		2	36	108	9	155
altlinux	1	12	253	542	80	888
debian	2	19	392	1663	616	2692
oraclelinux		2	41	138	10	191
redhat		1	30	101	11	143
redos	1	3	17	46	16	83
ubuntu		2	22	93	49	166

Urgent (4)

1. Code Injection - WordPress (CVE-2026-60137) - Urgent [966]

Description: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

debian: CVE-2026-60137 was patched at 2026-07-23, 2026-07-30

2. Remote Code Execution - WinRAR (CVE-2025-8088) - Urgent [954]

Description: A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.

altlinux: CVE-2025-8088 was patched at 2026-08-08, 2026-08-13

3. Remote Code Execution - Jenkins (CVE-2026-53435) - Urgent [921]

Description: In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Console to run arbitrary code, or to read arbitrary files from the Jenkins controller.

redos: CVE-2026-53435 was patched at 2026-08-12

4. Remote Code Execution - SPIP (CVE-2026-77647) - Urgent [892]

Description: SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of <?php blocks, and var_export's mishandling of certain cases such as presence of a '<' character.

debian: CVE-2026-77647 was patched at 2026-08-18, 2026-08-25

Critical (28)

5. Command Injection - PHP (CVE-2024-3566) - Critical [735]

Description: A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

altlinux: CVE-2024-3566 was patched at 2026-07-27

6. Remote Code Execution - Action Pack (CVE-2026-66066) - Critical [716]

Description: Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1.

debian: CVE-2026-66066 was patched at 2026-07-30

7. Remote Code Execution - WordPress (CVE-2026-64638) - Critical [709]

Description: WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).

debian: CVE-2026-64638 was patched at 2026-08-10, 2026-08-19

8. Remote Code Execution - dolibarr_erp\\/crm (CVE-2018-25357) - Critical [678]

Description: Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.

ubuntu: CVE-2018-25357 was patched at 2026-07-30

9. Code Injection - PHP (CVE-2026-17543) - Critical [675]

Description: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

almalinux: CVE-2026-17543 was patched at 2026-08-19, 2026-08-20

altlinux: CVE-2026-17543 was patched at 2026-08-05, 2026-08-12, 2026-08-13

debian: CVE-2026-17543 was patched at 2026-07-31, 2026-08-12, 2026-08-19

oraclelinux: CVE-2026-17543 was patched at 2026-08-19, 2026-08-21

redhat: CVE-2026-17543 was patched at 2026-08-20

10. Command Injection - ExifTool (CVE-2026-3102) - Critical [673]

Description: A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.

altlinux: CVE-2026-3102 was patched at 2026-08-12

11. Remote Code Execution - Chromium (CVE-2026-76036) - Critical [669]

Description: Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

altlinux: CVE-2026-76036 was patched at 2026-08-19

debian: CVE-2026-76036 was patched at 2026-08-20, 2026-08-21

12. Authentication Bypass - Jetty (CVE-2026-10050) - Critical [632]

Description: In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`. An attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters. Recent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.

altlinux: CVE-2026-10050 was patched at 2026-08-18, 2026-08-19, 2026-08-20, 2026-08-24

debian: CVE-2026-10050 was patched at 2026-08-19

13. Command Injection - Git (CVE-2026-67325) - Critical [632]

Description: GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.

debian: CVE-2026-67325 was patched at 2026-08-19

14. Remote Code Execution - postgresql (CVE-2026-14669) - Critical [630]

Description: Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

altlinux: CVE-2026-14669 was patched at 2026-08-14, 2026-08-16, 2026-08-17, 2026-08-20, 2026-08-23, 2026-08-24

debian: CVE-2026-14669 was patched at 2026-08-13, 2026-08-14, 2026-08-19

ubuntu: CVE-2026-14669 was patched at 2026-08-20, 2026-08-25

15. Remote Code Execution - FFmpeg (CVE-2026-66041) - Critical [628]

Description: FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data exceeding the initial allocation size into the undersized libquirc grayscale image buffer, resulting in heap corruption and process crash with potential for code execution.

debian: CVE-2026-66041 was patched at 2026-07-30

16. Remote Code Execution - Redis (CVE-2026-66373) - Critical [623]

Description: Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

altlinux: CVE-2026-66373 was patched at 2026-08-14, 2026-08-17, 2026-08-23

debian: CVE-2026-66373 was patched at 2026-07-30, 2026-08-06

17. Security Feature Bypass - Apache Traffic Server (CVE-2026-33267) - Critical [622]

Description: Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

debian: CVE-2026-33267 was patched at 2026-07-30

18. Incorrect Calculation - Redis (CVE-2024-55656) - Critical [617]

Description: RedisBloom adds a set of probabilistic data structures to Redis. There is an integer overflow vulnerability in RedisBloom, which is a module used in Redis. The integer overflow vulnerability allows an attacker (a redis client which knows the password) to allocate memory in the heap lesser than the required memory due to wraparound. Then read and write can be performed beyond this allocated memory, leading to info leak and OOB write. The integer overflow is in CMS.INITBYDIM command, which initialize a Count-Min Sketch to dimensions specified by user. It accepts two values (width and depth) and uses them to allocate memory in NewCMSketch(). This vulnerability is fixed in 2.2.19, 2.4.12, 2.6.14, and 2.8.2.

redos: CVE-2024-55656 was patched at 2026-08-03

19. Security Feature Bypass - Netty (CVE-2026-56820) - Critical [615]

Description: Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

debian: CVE-2026-56820 was patched at 2026-07-30

20. Security Feature Bypass - CoreDNS (CVE-2026-26018) - Critical [613]

Description: CoreDNS is a DNS server that chains plugins. Prior to version 1.14.2, a denial of service vulnerability exists in CoreDNS's loop detection plugin that allows an attacker to crash the DNS server by sending specially crafted DNS queries. The vulnerability stems from the use of a predictable pseudo-random number generator (PRNG) for generating a secret query name, combined with a fatal error handler that terminates the entire process. This issue has been patched in version 1.14.2.

redos: CVE-2026-26018 was patched at 2026-07-29

21. Command Injection - Git (CVE-2026-67323) - Critical [608]

Description: GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.

debian: CVE-2026-67323 was patched at 2026-08-19

22. Memory Corruption - Linux Kernel (CVE-2026-64564) - Critical [608]

Description: In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source. The DEL-IP for L passes the D8 check and calls sctp_assoc_rm_peer() on the transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping only the pointer that is no longer on the list, removes every real transport, leaving the association with a transport_count of 0 and primary_path/active_path pointing at freed memory. Reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard, so the wildcard branch can never reuse a freed transport.

altlinux: CVE-2026-64564 was patched at 2026-08-12

debian: CVE-2026-64564 was patched at 2026-08-06, 2026-08-18, 2026-08-19

23. Remote Code Execution - GIMP (CVE-2026-59090) - Critical [607]

Description: A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

debian: CVE-2026-59090 was patched at 2026-08-19

24. Elevation of Privilege - Keycloak (CVE-2026-4629) - Critical [606]

Description: A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `realm-admin` role into generated tokens, resulting in privilege escalation and full administrative access to the realm.

altlinux: CVE-2026-4629 was patched at 2026-08-07, 2026-08-11, 2026-08-13, 2026-08-14

25. Denial of Service - FreeRDP (CVE-2026-64620) - Critical [605]

Description: FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The function writes the modular-exponentiation result into the caller's output buffer via BN_bn2bin() and only afterward checks output_length > out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.

almalinux: CVE-2026-64620 was patched at 2026-08-13

altlinux: CVE-2026-64620 was patched at 2026-07-28, 2026-07-31

debian: CVE-2026-64620 was patched at 2026-07-30

oraclelinux: CVE-2026-64620 was patched at 2026-08-13

26. Authentication Bypass - CoreDNS (CVE-2026-35579) - Critical [603]

Description: CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the TSIG key name exists in the configuration but never calls dns.TsigVerify() to validate the HMAC. If the key name matches a configured key, the tsigStatus field remains nil and the tsig plugin treats the request as successfully authenticated regardless of the MAC value. For DoH and DoH3, the issue is more severe: the DoHWriter.TsigStatus() method unconditionally returns nil, and the server never inspects the TSIG record at all. Any request containing a TSIG record is treated as authenticated over DoH and DoH3, even if the key name is invalid and the MAC is arbitrary. An unauthenticated network attacker can exploit this to bypass TSIG-protected functionality such as AXFR/IXFR zone transfers, dynamic DNS updates, or other TSIG-gated plugin behavior. The DoH and DoH3 variants have a lower exploitation bar because the attacker does not need to know a valid TSIG key name. This issue has been fixed in version 1.14.3. As a workaround, disable gRPC, QUIC, DoH, and DoH3 listeners where TSIG authentication is required, or restrict network-level access to affected transport ports to trusted sources only.

redos: CVE-2026-35579 was patched at 2026-07-29

27. Denial of Service - Netty (CVE-2026-55831) - Critical [603]

Description: Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

debian: CVE-2026-55831 was patched at 2026-07-30

28. Denial of Service - Netty (CVE-2026-55833) - Critical [603]

Description: Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

debian: CVE-2026-55833 was patched at 2026-07-30

29. Denial of Service - Netty (CVE-2026-56816) - Critical [603]

Description: Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

debian: CVE-2026-56816 was patched at 2026-07-30

30. Remote Code Execution - Git (CVE-2026-73625) - Critical [602]

Description: GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.

debian: CVE-2026-73625 was patched at 2026-08-19

31. Authentication Bypass - Kubernetes (CVE-2026-54761) - Critical [601]

Description: Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.21 and 3.7.5, there is a high severity vulnerability in Traefik's Kubernetes Gateway provider affecting the crossProviderNamespaces allowlist. For HTTPRoute rules that declare multiple (WRR) backendRefs, Traefik evaluates the allowlist against the target backendRef.namespace instead of the route's own namespace. As a result, an HTTPRoute created in a namespace that is not allow-listed can reference a cross-provider TraefikService such as api@internal, dashboard@internal or rest@internal by pointing backendRef.namespace at an allow-listed namespace covered by a Gateway API ReferenceGrant, exposing internal Traefik services on the data plane. Exploitation requires the ability to create an accepted HTTPRoute and a matching ReferenceGrant from an allow-listed namespace; it does not require any change to Traefik static configuration, RBAC, or the deployment itself. This vulnerability is fixed in 3.6.21 and 3.7.5.

altlinux: CVE-2026-54761 was patched at 2026-08-03, 2026-08-04

32. Arbitrary File Writing - go-archive (CVE-2026-17106) - Critical [600]

Description: The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

altlinux: CVE-2026-17106 was patched at 2026-07-31

High (440)

33. Command Injection - Git (CVE-2026-67324) - High [597]

Description: GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.

debian: CVE-2026-67324 was patched at 2026-08-19

34. Command Injection - Git (CVE-2026-73623) - High [597]

Description: GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository.

debian: CVE-2026-73623 was patched at 2026-08-19

35. Memory Corruption - nghttp2 (CVE-2026-56848) - High [596]

Description: A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

debian: CVE-2026-56848 was patched at 2026-07-30

36. Denial of Service - Gitea (CVE-2026-58053) - High [595]

Description: Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-opt unchanged. A user who can run a workflow on a Docker-backed runner can create a job container with host namespaces and broad capabilities and escape to the host as root despite privileged mode being disabled.

redos: CVE-2026-58053 was patched at 2026-08-03

37. Elevation of Privilege - systemd (CVE-2026-16742) - High [595]

Description: systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user

debian: CVE-2026-16742 was patched at 2026-08-19

ubuntu: CVE-2026-16742 was patched at 2026-08-10, 2026-08-19

38. Security Feature Bypass - FreeRDP (CVE-2026-67296) - High [594]

Description: FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory allocation on the server.

debian: CVE-2026-67296 was patched at 2026-08-19

39. Authentication Bypass - CoreDNS (CVE-2026-33190) - High [591]

Description: CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer's TsigStatus() instead of performing verification itself. The DoH and DoH3 writer's TsigStatus() always returns nil, the DoT server does not set TsigSecret on the dns.Server, and the DoQ and gRPC writers also unconditionally return nil. This allows an unauthenticated remote client to bypass TSIG-based authentication and access resources intended to be restricted behind a tsig require all policy. Plain DNS over TCP and UDP are not affected. This issue has been fixed in version 1.14.3.

redos: CVE-2026-33190 was patched at 2026-07-29

40. Authentication Bypass - libssh (CVE-2026-59851) - High [591]

Description: A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.

almalinux: CVE-2026-59851 was patched at 2026-08-17

oraclelinux: CVE-2026-59851 was patched at 2026-08-17

41. Denial of Service - Mozilla Firefox (CVE-2026-16372) - High [591]

Description: Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

altlinux: CVE-2026-16372 was patched at 2026-07-23, 2026-08-06

42. Denial of Service - Netty (CVE-2026-56819) - High [591]

Description: Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

debian: CVE-2026-56819 was patched at 2026-07-30

43. Memory Corruption - PHP (CVE-2026-17544) - High [591]

Description: Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

almalinux: CVE-2026-17544 was patched at 2026-08-19

altlinux: CVE-2026-17544 was patched at 2026-08-05, 2026-08-12

debian: CVE-2026-17544 was patched at 2026-07-31, 2026-08-19

oraclelinux: CVE-2026-17544 was patched at 2026-08-19

44. Memory Corruption - WinRAR (CVE-2026-14191) - High [591]

Description: An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file's own TotalCount field but never against the actual size of RecItems. A crafted set of two or more .rev files can therefore write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum] at an attacker-controlled offset up to 65534 * sizeof(RecVolItem) bytes past the allocation, corrupting adjacent heap objects. Triggering requires the victim to run a recovery/test operation on an attacker-supplied .rev set (for example 'unrar t x.part1.rev', WinRAR 'Repair archive', or auto-recovery when extracting a volume set with a missing .rar part). This is the RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR3 path only in WinRAR 6.23). Fixed in WinRAR / RAR 7.23.

altlinux: CVE-2026-14191 was patched at 2026-08-10, 2026-08-13, 2026-08-14, 2026-08-18

debian: CVE-2026-14191 was patched at 2026-08-19

45. Path Traversal - Traefik (CVE-2026-48020) - High [589]

Description: Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a PathPrefix rule and applies the StripPrefix middleware, a request path containing .. or its percent-encoded form %2e%2e can match the public route at routing time and then, after the prefix is stripped and the path is normalized, resolve to a path served by a separate, authenticated router. As a result, an attacker can reach protected backend paths — such as admin or internal configuration endpoints — without satisfying the authentication middleware attached to the protected router. This vulnerability is fixed in 2.11.48, 3.6.19, and 3.7.3.

altlinux: CVE-2026-48020 was patched at 2026-08-03, 2026-08-04

46. Remote Code Execution - PyTorch (CVE-2026-12484) - High [588]

Description: A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode.

debian: CVE-2026-12484 was patched at 2026-07-30

47. Security Feature Bypass - Netty (CVE-2026-56821) - High [579]

Description: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

debian: CVE-2026-56821 was patched at 2026-07-30

48. Path Traversal - postcss (CVE-2026-45623) - High [577]

Description: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.

debian: CVE-2026-45623 was patched at 2026-07-30

49. Information Disclosure - Dompdf (CVE-2026-55555) - High [576]

Description: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. Because Dompdf behaves differently depending on whether a referenced local file exists (an existing file is processed repeatedly until it triggers an "Allowed memory size exhausted" crash, whereas a missing file fails fast or is ignored and never hits the memory limit), an attacker can use this observable discrepancy as an oracle to enumerate sensitive files on the server regardless of CHROOT restrictions. Exploitation requires the attacker to supply unrestricted or unsanitized HTML in a request that permits large data, plus a configuration where Dompdf's memory limit is low enough to be exhausted (with $_dompdf_show_warnings=true making the overflow easier to reach). This issue has been fixed in version 3.16.

debian: CVE-2026-55555 was patched at 2026-07-30

50. Command Injection - Python (CVE-2026-69243) - High [570]

Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.

debian: CVE-2026-69243 was patched at 2026-08-19

51. Command Injection - Python (CVE-2026-71554) - High [570]

Description: h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

debian: CVE-2026-71554 was patched at 2026-08-19

52. Arbitrary File Writing - Git (CVE-2026-73620) - High [569]

Description: GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.

debian: CVE-2026-73620 was patched at 2026-08-19

53. Information Disclosure - Jetty (CVE-2026-10051) - High [569]

Description: In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the union of trailers of the first request and the current request.

altlinux: CVE-2026-10051 was patched at 2026-08-24

debian: CVE-2026-10051 was patched at 2026-07-30

54. Denial of Service - OpenSSH (CVE-2026-55653) - High [567]

Description: A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).

almalinux: CVE-2026-55653 was patched at 2026-07-29

oraclelinux: CVE-2026-55653 was patched at 2026-07-30, 2026-07-31, 2026-08-06

redhat: CVE-2026-55653 was patched at 2026-07-29, 2026-07-30

55. Code Injection - nltk (CVE-2025-71408) - High [566]

Description: NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the __main__ block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or sanitization, enabling an attacker to supply a Python expression that escapes the intended attribute lookup and executes arbitrary code including OS commands via the os module.

debian: CVE-2025-71408 was patched at 2026-07-30

56. Denial of Service - CoreDNS (CVE-2026-32936) - High [565]

Description: CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs URL query parsing, base64 decoding, and DNS message unpacking before rejecting the request. Unlike the POST path, which applies a bounded read via http.MaxBytesReader limited to 65536 bytes, the GET path has no equivalent size validation before expensive processing. A remote, unauthenticated attacker can repeatedly send oversized DoH GET requests to force high CPU usage, large transient memory allocations, and elevated garbage-collection pressure, leading to denial of service. This issue has been fixed in version 1.14.3.

redos: CVE-2026-32936 was patched at 2026-07-29

57. Denial of Service - Dompdf (CVE-2026-59941) - High [565]

Description: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor($width, $height) (and PHP's native BMP decoder) to allocate the full pixel canvas. A payload can fit in a single HTTP request: the BMP can be inlined as a data:image/bmp;base64,… URI inside attacker-controlled HTML, so no upload, no remote fetch, and no chroot-reachable file is required. I measured a 169-byte request driving a dompdf render to ~412 MB peak RSS and ~4.8 s of CPU/wall time, versus ~34 MB for an identically-sized benign request — roughly a 12× memory amplification per request, repeatable and unauthenticated. This issue has been fixed in version 3.16.

debian: CVE-2026-59941 was patched at 2026-07-30

58. Security Feature Bypass - Dompdf (CVE-2026-55554) - High [565]

Description: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with realpath() . Because normalization strips the trailing directory separator from $chrootPath , the check only verifies that $chrootPath is a string prefix of $realfile, so a chroot of /var/www also matches sibling directories like /var/www2 , /var/www-admin, or /var/www_backup. An attacker who controls part of the rendered HTML could exploit this to escape the chroot and read sensitive files outside the allowed directory. This issue has been fixed in version 3.16.

debian: CVE-2026-55554 was patched at 2026-07-30

59. Information Disclosure - CoreDNS (CVE-2026-33489) - High [564]

Description: CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3.

redos: CVE-2026-33489 was patched at 2026-07-29

60. Denial of Service - FreeRDP (CVE-2026-67297) - High [558]

Description: FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering the configured size limit.

debian: CVE-2026-67297 was patched at 2026-08-19

61. Denial of Service - FreeRDP (CVE-2026-67304) - High [558]

Description: FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard device control request cleanup when reader-state decoding fails. Attackers can send malformed smartcard IRP requests with non-zero cReaders and truncated reader-state data to crash the process via null pointer access in free_reader_states functions.

debian: CVE-2026-67304 was patched at 2026-08-19

62. Arbitrary File Writing - Git (CVE-2026-73624) - High [557]

Description: GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process privilege level.

debian: CVE-2026-73624 was patched at 2026-08-19

63. Denial of Service - Windows Resilient File System (ReFS) (CVE-2026-53587) - High [555]

Description: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can make bytes after the pkt-line complete object-format=, causing format_str to advance beyond the pkt-line and the following memchr length calculation to underflow. The resulting heap out-of-bounds walk can crash a client during the first refs-advertisement packet over HTTP, HTTPS, SSH, or the Git protocol. This issue is fixed in versions 1.8.6 and 1.9.5.

altlinux: CVE-2026-53587 was patched at 2026-07-21, 2026-07-30

debian: CVE-2026-53587 was patched at 2026-08-19, 2026-08-20

ubuntu: CVE-2026-53587 was patched at 2026-08-12, 2026-08-19

64. Elevation of Privilege - QEMU (CVE-2026-12080) - High [554]

Description: A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

debian: CVE-2026-12080 was patched at 2026-07-30

65. Denial of Service - CoreDNS (CVE-2026-32934) - High [553]

Description: CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory growth by a remote client that opens many QUIC streams and sends only 1 byte per stream. When the worker pool is full, CoreDNS still spawns a goroutine per accepted stream to wait for a worker token. Additionally, active workers block indefinitely in io.ReadFull() with no per-stream read deadline, allowing an attacker to pin all workers by sending a single byte so the read blocks waiting for the second byte of the DoQ length prefix. This enables an unauthenticated remote attacker to cause memory exhaustion and OOM-kill. This issue has been fixed in version 1.14.3. No known workarounds exist.

redos: CVE-2026-32934 was patched at 2026-07-29

66. Denial of Service - Dompdf (CVE-2026-59942) - High [553]

Description: Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service (DoS) attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions (e.g., 30,000x30,000 pixels). While Dompdf implements internal checks to validate image dimensions, these can be bypassed by using a high-entropy image (such as random noise) encoded in Base64 and wrapped in specific CSS containers. The vulnerability exists because the dimension validation happens early, but the resource allocation for calculating the object's bounding box and internal buffers during the rendering phase does not strictly limit the cumulative CPU time or memory usage for a single object that has passed the initial check. An unauthenticated remote attacker can cause a complete Denial of Service on the web server by submitting a crafted HTML string. This affects any application that allows users to provide HTML content or URLs that are subsequently converted to PDF using Dompdf. This issue has been fixed in version 3.16.

debian: CVE-2026-59942 was patched at 2026-07-30

67. Denial of Service - gobgp (CVE-2026-42285) - High [553]

Description: GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. When the server receives a message with inconsistent attribute lengths, it improperly handles the internal state transition to a "withdraw" action, leading to a nil pointer dereference in the AdjRib.Update function. This causes the entire GoBGP process to crash, resulting in a complete loss of service availability. This issue has been patched in version 4.5.0.

redos: CVE-2026-42285 was patched at 2026-08-19

68. Denial of Service - gopacket (CVE-2026-54332) - High [553]

Description: gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.

debian: CVE-2026-54332 was patched at 2026-07-30

69. Security Feature Bypass - Dompdf (CVE-2026-56722) - High [553]

Description: Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not enforce the same protections as the first. When rendering, dompdf hands the SVG to the separate php-svg-lib library with external references forced on, and that library has no knowledge of the chroot directory, blocks only the phar:// scheme, and ultimately reads the referenced file with no path or protocol validation. This lets an external, unauthenticated attacker read arbitrary image files from the server's file system in the default configuration. This issue has been fixed in version 3.16.

debian: CVE-2026-56722 was patched at 2026-07-30

70. Security Feature Bypass - hardened_images (CVE-2026-71225) - High [553]

Description: A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vector (IV) for each internal data chunk. A remote attacker could potentially exploit this by making an application that uses libkcapi process specially crafted large inputs. This can lead to a significant weakening of data confidentiality, as the repeated IV use can expose relationships in encrypted plaintext, and may also affect data integrity by causing incorrect cryptographic processing.

debian: CVE-2026-71225 was patched at 2026-08-19

71. Information Disclosure - home-assistant (CVE-2026-54317) - High [552]

Description: Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTTP endpoint, KonnectedView (homeassistant/components/konnected/__init__.py), that is marked as not requiring authentication (requires_auth = False). A comment next to that line says auth is instead handled "via the access token from configuration." That promise is only half true. Write requests (POST and PUT) are handled by update_sensor(), which does check the request's Authorization: Bearer <token> header against the integration's stored access tokens (using hmac.compare_digest). Read requests (GET) are handled by a separate get() method that has no authentication check at all. This vulnerability is fixed in 2026.6.0.

altlinux: CVE-2026-54317 was patched at 2026-07-24

72. Remote Code Execution - Python (CVE-2026-12372) - High [552]

Description: A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed.

debian: CVE-2026-12372 was patched at 2026-08-19

73. Denial of Service - GLib (CVE-2026-15588) - High [548]

Description: A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

almalinux: CVE-2026-15588 was patched at 2026-08-17, 2026-08-19

altlinux: CVE-2026-15588 was patched at 2026-07-30

debian: CVE-2026-15588 was patched at 2026-07-30

oraclelinux: CVE-2026-15588 was patched at 2026-08-17, 2026-08-19

redhat: CVE-2026-15588 was patched at 2026-08-17

74. Memory Corruption - Linux Kernel (CVE-2026-64561) - High [548]

Description: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages. Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately.

almalinux: CVE-2026-64561 was patched at 2026-07-24

debian: CVE-2026-64561 was patched at 2026-08-06, 2026-08-18, 2026-08-19

oraclelinux: CVE-2026-64561 was patched at 2026-08-05, 2026-08-06, 2026-08-08, 2026-08-11

redhat: CVE-2026-64561 was patched at 2026-07-24, 2026-07-29, 2026-07-31

75. Denial of Service - FreeRDP (CVE-2026-68580) - High [546]

Description: FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.

almalinux: CVE-2026-68580 was patched at 2026-08-13

debian: CVE-2026-68580 was patched at 2026-08-19

oraclelinux: CVE-2026-68580 was patched at 2026-08-13

redhat: CVE-2026-68580 was patched at 2026-08-13

76. Denial of Service - Python (CVE-2026-69249) - High [546]

Description: python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.

debian: CVE-2026-69249 was patched at 2026-08-19

77. Remote Code Execution - Git (CVE-2026-69097) - High [542]

Description: GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

debian: CVE-2026-69097 was patched at 2026-08-19

78. Denial of Service - Pillow (CVE-2026-59203) - High [541]

Description: Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.