Report Name: Linux Patch Wednesday July 2026
Generated: 2026-07-31 15:39:02

Product Name	Prevalence	U	C	H	M	L	A	Comment
Angular	0.95			4	12		16	Angular is a development platform for building mobile and desktop web applications using TypeScript, JavaScript, and other languages. It provides a component-based architecture, declarative templates, dependency injection, powerful tooling, and extensive ecosystem support for creating scalable, high-performance web apps.
Vim	0.95		1	4	7		12	Highly configurable command-line text editor used in development and system administration.
pip	0.95		1				1	pip is the standard package installer for Python, used to install and manage software packages from the Python Package Index (PyPI) and other repositories.
Apache Log4j	0.9				1		1	Apache Log4j is a Java-based logging utility
Django	0.9				3		3	Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides built-in tools for database models, authentication, URL routing, templates, and security features, making it one of the most widely used frameworks for building scalable and maintainable web applications.
HTTP/2	0.9				2		2	HTTP/2 is a major revision of the HTTP network protocol used by the World Wide Web
Linux Kernel	0.9		2	19	425	93	539	The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel
Rust	0.9				1		1	Rust is a modern, high-performance systems programming language focused on safety, concurrency, and memory management.
Sudo	0.9				1		1	Sudo is a widely used Unix/Linux utility that allows permitted users to execute commands with elevated (typically root) privileges while providing extensive logging and fine-grained security controls. It is a foundational component in most Linux and BSD distributions.
Windows Kernel	0.9				1		1	Windows Kernel
nghttp2	0.9			1			1	nghttp2 is an implementation of HTTP/2 and its header compression algorithm HPACK in C
util-linux	0.9				1		1	Linux utility suite providing core system tools including mount. Vulnerability affects SUID mount binary due to TOCTOU race condition.
Grafana	0.85			1	2		3	Grafana is an open-source analytics and monitoring platform that provides dashboards and visualization tools for metrics collected from various data sources.
Chromium	0.8		2	247	254	1	504	Chromium is a free and open-source web browser project, mainly developed and maintained by Google
FreeIPA	0.8			1	1		2	FreeIPA is a free and open source identity management system
Keycloak	0.8			4	8		12	Keycloak is an open‑source identity and access management (IAM) solution that provides single sign‑on (SSO), user federation, identity brokering, and access control for applications and services.
Microsoft PowerShell	0.8			1			1	PowerShell or Microsoft PowerShell (formerly Windows PowerShell) is a task automation and configuration management program from Microsoft, consisting of a command-line shell and the associated scripting language
Mozilla Firefox	0.8			2	1		3	Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation
Netty	0.8			1			1	Netty is a non-blocking I/O client-server framework for the development of Java network applications such as protocol servers and clients
OpenSSH	0.8		1	3	7		11	OpenSSH is a suite of secure networking utilities based on the Secure Shell protocol, which provides a secure channel over an unsecured network in a client–server architecture
OpenSSL	0.8			1	8		9	A software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end
PHP	0.8				3	1	4	PHP is a general-purpose scripting language geared towards web development. It was originally created by Danish-Canadian programmer Rasmus Lerdorf in 1993 and released in 1995.
RPC	0.8				2		2	Remote Procedure Call Runtime
Safari	0.8			5	17		22	Safari is a web browser developed by Apple. It is built into Apple's operating systems, including macOS, iOS, iPadOS and their upcoming VisionOS, and uses Apple's open-source browser engine WebKit, which was derived from KHTML.
Samba	0.8				1		1	Samba is a free software re-implementation of the SMB networking protocol, and was originally developed by Andrew Tridgell
Windows Resilient File System (ReFS)	0.8				1		1	Windows component
Gitea	0.75		2	3	3	1	9	Gitea is a lightweight self-hosted Git service that provides source code hosting, pull requests, issue tracking, CI integrations, and user management through a web interface.
Apache Tomcat	0.7			2	4		6	Apache Tomcat is a free and open-source implementation of the Jakarta Servlet, Jakarta Expression Language, and WebSocket technologies
Apache Traffic Server	0.7				1		1	The Apache Traffic Server is a modular, high-performance reverse proxy and forward proxy server, generally comparable to Nginx and Squid
Asterisk	0.7			1	1		2	Asterisk is a free and open source framework for building communications applications and is sponsored by Sangoma
Babel	0.7				1		1	Babel is a free and open-source JavaScript transcompiler that is mainly used to convert ECMAScript 2015+ code into backwards-compatible JavaScript code that can be run by older JavaScript engines
Calibre	0.7				1		1	Calibre is a cross-platform free and open-source suite of e-book software
Envoy	0.7		1	11	1	1	14	Envoy is a cloud-native, open-source edge and service proxy
FFmpeg	0.7		1	1	1		3	FFmpeg is a free and open-source software project consisting of a suite of libraries and programs for handling video, audio, and other multimedia files and streams
Kubernetes	0.7			2	1		3	Kubernetes is an open-source container orchestration system for automating software deployment, scaling, and management
MediaWiki	0.7		1	1	6		8	MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL)
MinIO	0.7			1	1		2	MinIO is a high-performance, S3-compatible object storage system designed for large-scale data infrastructure. It supports cloud-native workloads and provides APIs for storing, retrieving, and managing unstructured data such as photos, videos, log files, and backups, with a focus on scalability, speed, and simplicity.
Minio	0.7				1		1	Minio is a Multi-Cloud Object Storage framework
Open Asset Import Library Assimp	0.7				3		3	Open Asset Import Library is a library that loads various 3D file formats into a shared, in-memory format
Oracle MySQL	0.7				1		1	MySQL is an open-source relational database management system
Oracle VM VirtualBox	0.7				11		11	Oracle VM VirtualBox is a hosted hypervisor for x86 virtualization developed by Oracle Corporation
QEMU	0.7				1		1	QEMU is a generic and open source machine & userspace emulator and virtualizer
SQLite	0.7				2		2	SQLite is a database engine written in the C programming language
cpp-httplib	0.7				1		1	cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library
musl libc	0.7				2		2	musl libc is a lightweight, fast, and standards-conformant implementation of the C standard library, commonly used in embedded systems and Linux distributions such as Alpine Linux.
idna	0.65			1			1	idna is a Python library implementing Internationalized Domain Names in Applications (IDNA), providing support for Unicode domain name encoding and decoding according to the IDNA standard. It is widely used by Python networking, HTTP, and DNS-related software.
Apache ActiveMQ	0.6			2	6		8	Apache ActiveMQ is an open source message broker written in Java together with a full Java Message Service (JMS) client
Canonical LXD	0.6			1			1	Canonical LXD is a system container and VM manager for Linux. LXD-UI is the web UI component of LXD that provides a browser-based interface for creating, managing and starting containers and instances.
ClamAV	0.6				7		7	ClamAV (Clam AntiVirus) is a free software, cross-platform antimalware toolkit able to detect many types of malware, including viruses
FreeRDP	0.6			4			4	FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license
ImageMagick	0.6				24	3	27	ImageMagick, invoked from the command line as magick, is a free and open-source cross-platform software suite for displaying, creating, converting, modifying, and editing raster images
Jetty	0.6			2	1		3	Jetty is a Java based web server and servlet engine
PHP Secure Communications Library	0.6			1			1	phpseclib provides pure-PHP implementations of SSH2, SFTP, RSA, DSA, Elliptic Curves, AES, ChaCha20, X. 509, CSR, CRL, SPKAC
Perl	0.6			1	27	2	30	Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages
Puma	0.6				2		2	Puma is a Ruby/Rack web server built for parallelism
Python	0.6			3	15	4	22	Python is a high-level, general-purpose programming language
Rclone	0.6			3			3	Rclone is a command-line program to sync files and directories to and from different cloud storage providers, supporting over 40 cloud storage products including S3, Google Drive, Dropbox, OneDrive, and many more.
Roundcube	0.6			1	5		6	Roundcube is a web-based IMAP email client
Undertow	0.6				1		1	Undertow is a lightweight, high-performance Java web server and servlet container designed for both embedded and standalone deployments. It is the default web server in WildFly and is also used by Red Hat products including JBoss EAP and builds of Apache Camel.
Wireshark	0.6			8	3		11	Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education
libxml2	0.6				2		2	libxml2 is an XML toolkit implemented in C, originally developed for the GNOME Project
pgAdmin	0.6			1	2		3	pgAdmin is the most popular and feature rich Open Source administration and development platform for PostgreSQL, the most advanced Open Source database in the world
shell-quote	0.55			1			1	shell-quote is a JavaScript/Node.js library for safely parsing and quoting POSIX shell commands. It is commonly used by CLI tools, build systems, and developer utilities to construct and parse shell command lines.
.NET	0.5				1		1	Product detected by a:microsoft:.net (exists in CPE dict)
389 Directory Server	0.5				2	2	4	389 Directory Server is a highly usable, fully featured, reliable and secure LDAP server implementation
7-Zip	0.5		1	1			2	7-Zip is a free and open-source file archiver, a utility used to place groups of files within compressed containers known as "archives"
Alinto SOGo	0.5				2		2	SOGo is an open source groupware and webmail server developed by Alinto, providing email, calendar, and contact management through a web-based interface and standard protocols.
Aptio V UEFI Firmware Integrator Tools	0.5				1		1	Product detected by a:intel:aptio_v_uefi_firmware_integrator_tools (exists in CPE dict)
Authlib	0.5			1			1	Authlib is a Python library for building OAuth and OpenID Connect clients and servers, providing tools for secure authentication, token management, and authorization flows.
Cacti	0.5		1	9	4	1	15	Cacti is an open source operational monitoring and fault management framework
Caddy	0.5			3			3	Product detected by a:caddyserver:caddy (exists in CPE dict)
CarrierWave	0.5			1			1	Product detected by a:carrierwave_project:carrierwave (exists in CPE dict)
Curl	0.5		5	12			17	Product detected by a:haxx:curl (exists in CPE dict)
DBI	0.5			1	2		3	Product detected by a:perl:dbi (exists in CPE dict)
DCMTK	0.5				2		2	DCMTK (DICOM Toolkit) is an open-source collection of libraries and applications implementing large parts of the DICOM standard, including image processing, storage, and network services for medical imaging.
DNSSEC	0.5				1		1	The Domain Name System Security Extensions (DNSSEC) is a feature of the Domain Name System (DNS) that authenticates responses to domain name lookups
DOMPurify	0.5			4			4	DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG
Electron	0.5			1	2		3	Product detected by a:electronjs:electron (exists in CPE dict)
Excon	0.5					1	1	Product detected by a:excon_project:excon (exists in CPE dict)
Faraday	0.5			1			1	Product detected by a:faraday_project:faraday (exists in CPE dict)
GIMP	0.5			2	2		4	GIMP is an open-source image manipulation program used for photo editing, graphic design, and digital art creation.
Gawk	0.5				4		4	Product detected by a:fossies:gawk (exists in CPE dict)
Go	0.5					2	2	Product detected by a:golang:go (exists in CPE dict)
Gpsd	0.5		1				1	Product detected by a:gpsd_project:gpsd (exists in CPE dict)
Guzzle	0.5				3		3	Product detected by a:guzzlephp:guzzle (exists in CPE dict)
Gzip	0.5				1	1	2	Product detected by a:gnu:gzip (exists in CPE dict)
HashiCorp Nomad	0.5			1		1	2	HashiCorp Nomad is a workload scheduler and orchestrator designed to deploy and manage applications, including containerized and non-containerized workloads, across various infrastructure platforms
Hugo	0.5				3		3	Product detected by a:gohugo:hugo (exists in CPE dict)
Jackson-databind	0.5		1		2	4	7	Product detected by a:fasterxml:jackson-databind (exists in CPE dict)
Kafka	0.5					1	1	Product detected by a:apache:kafka (exists in CPE dict)
Kotlin	0.5				2		2	Product detected by a:jetbrains:kotlin (exists in CPE dict)
LXD	0.5			2			2	Product detected by a:canonical:lxd (exists in CPE dict)
LibXFont	0.5			3			3	Product detected by a:x:libxfont (exists in CPE dict)
Libarchive	0.5				2		2	Multi-format archive and compression library
Libheif	0.5				1		1	Product detected by a:struktur:libheif (exists in CPE dict)
Mistune	0.5			6	1		7	Product detected by a:mistune_project:mistune (exists in CPE dict)
ModSecurity	0.5		1			1	2	ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx
NGINX	0.5		1		2		3	Nginx is an open-source web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache
Node.js	0.5			4	8		12	Product detected by a:nodejs:node.js (exists in CPE dict)
OpenTelemetry	0.5			1			1	OpenTelemetry is a collection of APIs, SDKs, and tools. Use it to instrument, generate, collect, and export telemetry data (metrics, logs and traces) to help you analyze your software's performance and behavior
Patch	0.5				2		2	Product detected by a:gnu:patch (exists in CPE dict)
Pillow	0.5			11			11	Pillow is a Python imaging library that adds image processing capabilities to Python, supporting formats such as PNG, JPEG, GIF, TIFF, and BMP.
ProFTPD	0.5			1	3		4	ProFTPD is a highly configurable and modular open-source FTP server designed for Unix-like systems, offering advanced features such as virtual hosting, authentication modules, and flexible configuration similar to Apache.
Psr-7	0.5					2	2	Product detected by a:guzzlephp:psr-7 (exists in CPE dict)
Pypdf	0.5				9	1	10	PyPDF is a Python library for reading, manipulating, and writing PDF files, including extraction, splitting, merging, and encryption features.
Setuptools	0.5			1			1	Setuptools is a fully-featured, actively-maintained, and stable library designed to facilitate packaging Python projects
Shiro	0.5				1		1	Product detected by a:apache:shiro (exists in CPE dict)
Spice-vdagent	0.5				2		2	Product detected by a:spice-space:spice-vdagent (exists in CPE dict)
Starlette	0.5				1	2	3	Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit
Symfony	0.5				1		1	Product detected by a:sensiolabs:symfony (exists in CPE dict)
TLS	0.5			1	2		3	TLS
Thunderbird	0.5				2		2	Product detected by a:mozilla:thunderbird (exists in CPE dict)
Twig	0.5				1		1	Twig is a template language for PHP
UltraJSON	0.5				1		1	Product detected by a:ultrajson_project:ultrajson (exists in CPE dict)
VBScript	0.5			1			1	VBScript
Wget	0.5				4		4	Product detected by a:gnu:wget (exists in CPE dict)
Ws	0.5			1			1	Product detected by a:ws_project:ws (exists in CPE dict)
X Server	0.5				2		2	Product detected by a:x.org:x_server (exists in CPE dict)
Xrdp	0.5			2	8		10	xrdp is an open source remote desktop protocol server
aardvark-dns	0.5				1		1	Product detected by a:containers:aardvark-dns (does NOT exist in CPE dict)
busybox	0.5				4		4	Product detected by a:busybox:busybox (exists in CPE dict)
concurrent_ruby	0.5			1	2		3	Product detected by a:rubyconcurrency:concurrent_ruby (does NOT exist in CPE dict)
containerd	0.5			1	1	1	3	Product detected by a:linuxfoundation:containerd (exists in CPE dict)
dos	0.5			1	1		2	Product detected by a:f5:dos (does NOT exist in CPE dict)
erlang\\/otp	0.5					1	1	Product detected by a:erlang:erlang\\/otp (does NOT exist in CPE dict)
etcd	0.5				1		1	Product detected by a:etcd:etcd (exists in CPE dict)
extract-zip	0.5			1			1	Product detected by a:max-mapper:extract-zip (does NOT exist in CPE dict)
fast-uri	0.5				1		1	Product detected by a:openjsf:fast-uri (does NOT exist in CPE dict)
freeswitch	0.5				8	1	9	Product detected by a:freeswitch:freeswitch (exists in CPE dict)
fzf	0.5				2		2	Product detected by a:junegunn:fzf (does NOT exist in CPE dict)
grafana	0.5				3		3	Product detected by a:grafana:grafana (exists in CPE dict)
gstreamer	0.5				2		2	Product detected by a:gstreamer:gstreamer (exists in CPE dict)
haproxy	0.5				2		2	Product detected by a:haproxy:haproxy (exists in CPE dict)
hardened_images	0.5					1	1	Product detected by a:redhat:hardened_images (does NOT exist in CPE dict)
httpcomponents_core	0.5				2		2	Product detected by a:apache:httpcomponents_core (does NOT exist in CPE dict)
httplib2	0.5			1			1	Product detected by a:httplib2_project:httplib2 (exists in CPE dict)
imager	0.5				1		1	Product detected by a:tonycoz:imager (does NOT exist in CPE dict)
immutable	0.5			2			2	Product detected by a:immutable-js:immutable (does NOT exist in CPE dict)
incus	0.5			1			1	Product detected by a:linuxcontainers:incus (does NOT exist in CPE dict)
js-yaml	0.5			2			2	Product detected by a:nodeca:js-yaml (does NOT exist in CPE dict)
jupyter_server	0.5				1		1	Product detected by a:jupyter:jupyter_server (exists in CPE dict)
libexpat	0.5				12		12	Product detected by a:libexpat_project:libexpat (exists in CPE dict)
libjpeg	0.5				1		1	libjpeg
libreswan	0.5			1	2		3	Product detected by a:libreswan:libreswan (exists in CPE dict)
libsoup	0.5			1			1	Product detected by a:gnome:libsoup (exists in CPE dict)
libssh2	0.5		1	3	1		5	Product detected by a:libssh2:libssh2 (exists in CPE dict)
libzypp	0.5		1		1		2	Product detected by a:opensuse:libzypp (exists in CPE dict)
loki_datasource	0.5				1		1	Product detected by a:grafana:loki_datasource (does NOT exist in CPE dict)
markdown-it	0.5			1			1	Product detected by a:markdown-it_project:markdown-it (exists in CPE dict)
mediawiki	0.5				2		2	Product detected by a:mediawiki:mediawiki (exists in CPE dict)
nats-server	0.5				3	4	7	Product detected by a:linuxfoundation:nats-server (exists in CPE dict)
njs	0.5				1		1	Product detected by a:f5:njs (exists in CPE dict)
nltk	0.5			3			3	Product detected by a:nltk:nltk (exists in CPE dict)
nmap	0.5			1			1	Product detected by a:nmap:nmap (exists in CPE dict)
nokogiri	0.5				7		7	Product detected by a:nokogiri:nokogiri (exists in CPE dict)
nsd	0.5			1	3		4	Product detected by a:nlnetlabs:nsd (exists in CPE dict)
onnx	0.5			1			1	Product detected by a:linuxfoundation:onnx (exists in CPE dict)
op-tee	0.5			1	3	3	7	Product detected by o:trustedfirmware:op-tee (does NOT exist in CPE dict)
openbao	0.5				1		1	Product detected by a:openbao:openbao (does NOT exist in CPE dict)
openvpn	0.5				2		2	Product detected by a:openvpn:openvpn (exists in CPE dict)
perl	0.5				2		2	Product detected by a:perl:perl (exists in CPE dict)
pgx	0.5			1			1	Product detected by a:jackc:pgx (does NOT exist in CPE dict)
postgresql_jdbc_driver	0.5					1	1	Product detected by a:postgresql:postgresql_jdbc_driver (exists in CPE dict)
prometheus	0.5				1		1	Product detected by a:prometheus:prometheus (exists in CPE dict)
pyasn1	0.5				3		3	Product detected by a:pyasn1:pyasn1 (does NOT exist in CPE dict)
pymdown_extensions	0.5			2			2	Product detected by a:facelessuser:pymdown_extensions (does NOT exist in CPE dict)
python-multipart	0.5					1	1	Product detected by a:fastapiexpert:python-multipart (does NOT exist in CPE dict)
rabbitmq_server	0.5		1	7	1		9	Product detected by a:broadcom:rabbitmq_server (does NOT exist in CPE dict)
rtklib	0.5		1	3			4	Product detected by a:rtklib:rtklib (does NOT exist in CPE dict)
sigstore-go	0.5				1		1	Product detected by a:sigstore:sigstore-go (does NOT exist in CPE dict)
sigstore_timestamp_authority	0.5				1		1	Product detected by a:linuxfoundation:sigstore_timestamp_authority (does NOT exist in CPE dict)
simplesamlphp	0.5				1		1	Product detected by a:simplesamlphp:simplesamlphp (exists in CPE dict)
socat	0.5				1		1	Product detected by a:dest-unreach:socat (exists in CPE dict)
soup_sieve	0.5			2			2	Product detected by a:facelessuser:soup_sieve (does NOT exist in CPE dict)
sssd	0.5				1		1	Product detected by a:fedoraproject:sssd (exists in CPE dict)
storable	0.5				1		1	Product detected by a:nwclark:storable (does NOT exist in CPE dict)
swift	0.5			1			1	Product detected by a:openstack:swift (exists in CPE dict)
tar	0.5			4			4	Product detected by a:isaacs:tar (does NOT exist in CPE dict)
tempo	0.5				1		1	Product detected by a:grafana:tempo (does NOT exist in CPE dict)
tiff	0.5				1		1	Product detected by a:golang:tiff (exists in CPE dict)
undici	0.5				4	3	7	Product detected by a:nodejs:undici (exists in CPE dict)
webob	0.5				1		1	Product detected by a:pylonsproject:webob (does NOT exist in CPE dict)
wireshark	0.5			1			1	Product detected by a:wireshark:wireshark (exists in CPE dict)
wolfSSL	0.5				2	1	3	wolfSSL is a small, portable, embedded SSL/TLS library targeted for use by embedded systems developers
wolfssl	0.5				14	1	15	Product detected by a:wolfssl:wolfssl (exists in CPE dict)
youtube-dl	0.5		1	1	2		4	youtube-dl is a free and open source software tool for downloading video and audio from YouTube and over 1,000 other video hosting websites
zeep	0.5				1		1	Product detected by a:python-zeep:zeep (does NOT exist in CPE dict)
Gogs	0.45	1	2	9	3	2	17	Gogs is a lightweight self-hosted Git service that provides repository hosting, user management, issue tracking, and collaboration features through a web interface.
dhcpcd	0.45			1	5		6	dhcpcd is an open-source DHCP and network configuration client used on Linux, BSD, and other Unix-like operating systems to automatically configure network interfaces, IP addresses, routes, and DNS settings.
Erlang/OTP	0.4				5		5	Erlang/OTP is a set of libraries for the Erlang programming language
Flatpak	0.4				1		1	Flatpak is a utility for software deployment and package management for Linux
GPAC	0.4				2	3	5	GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity)
Horde IMP	0.4				1		1	IMP is the Internet Messaging Program. It is written in PHP and provides webmail access to IMAP and POP3 accounts. It uses the best-of-class Horde/Imap_Client library to provide fast, robust connections to the remote IMAP/POP3 server.
Keras	0.4		1		2		3	High-level neural networks API, running on top of TensorFlow, allowing model building and training
Spring Framework	0.4				1		1	The Spring Framework is an application framework and inversion of control container for the Java platform
Oj	0.35			2	7	3	12	Oj (Optimized JSON) is a high-performance JSON parser and object serialization library packaged as a Ruby gem, designed to provide fast JSON encoding and decoding for Ruby applications.
JOSE	0.3				3		3	JavaScript module for JSON Object Signing and Encryption (JOSE)
gitoxide	0.3				1		1	gitoxide is an idiomatic, lean, fast & safe pure Rust implementation of Git, designed for correctness and performance, available both as a Rust library (gix crate) and command-line interface tools.
jqlang jq	0.3				1		1	jq is a lightweight and flexible command-line JSON processor, allowing powerful querying and manipulation of JSON data streams.
Wasmtime	0.25				2		2	Standalone WebAssembly runtime written in Rust
GitHub	0.2					1	1	GitHub, Inc. is an Internet hosting service for software development and version control using Git
libtiff	0.2				1		1	libtiff is a widely used library for reading and writing TIFF (Tagged Image File Format) files, offering tools like tiff2ps.
Unknown Product	0				89	141	230	Unknown Product

Vulnerability Type	Criticality	U	C	H	M	L	A
Remote Code Execution	1.0	1	11	98	22		132
Authentication Bypass	0.98		6	37	39		82
Code Injection	0.97		2	9	16		27
Command Injection	0.97		1	2	4		7
XXE Injection	0.97				1		1
Arbitrary File Writing	0.95		3		1		4
Security Feature Bypass	0.9		4	179	142		325
Server-Side Request Forgery	0.87			4	11	1	16
Elevation of Privilege	0.85		1	3	15		19
Arbitrary File Reading	0.83			2	3		5
Information Disclosure	0.83			10	32	1	43
Cross Site Scripting	0.8			13	37		50
Open Redirect	0.75			2	4		6
Denial of Service	0.7			53	155	7	215
Path Traversal	0.7		2	13	20		35
Incorrect Calculation	0.5			8	37	2	47
Memory Corruption	0.5		1	36	305	17	359
Spoofing	0.4			3	59		62
Tampering	0.3			1			1
Unknown Vulnerability Type	0				316	265	581

Source	U	C	H	M	L	A
almalinux		2	19	45	6	72
altlinux	1	15	354	569	35	974
debian		25	422	1111	271	1829
oraclelinux		3	23	51	11	88
redhat		4	30	55	5	94
redos		3	11	25	10	49
ubuntu		6	39	238	108	391

Urgent (1)

1. Remote Code Execution - Gogs (CVE-2025-8110) - Urgent [896]

Description: Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

altlinux: CVE-2025-8110 was patched at 2026-06-25

Critical (31)

2. Remote Code Execution - pip (CVE-2025-27607) - Critical [729]

Description: Python JSON Logger is a JSON Formatter for Python Logging. Between 30 December 2024 and 4 March 2025 Python JSON Logger was vulnerable to RCE through a missing dependency. This occurred because msgspec-python313-pre was deleted by the owner leaving the name open to being claimed by a third party. If the package was claimed, it would allow them RCE on any Python JSON Logger user who installed the development dependencies on Python 3.13 (e.g. pip install python-json-logger[dev]). This issue has been resolved with 3.3.0.

redos: CVE-2025-27607 was patched at 2026-07-13

3. Remote Code Execution - FFmpeg (CVE-2026-8461) - Critical [688]

Description: An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2.

debian: CVE-2026-8461 was patched at 2026-06-22, 2026-06-24

4. Command Injection - Gpsd (CVE-2026-58459) - Critical [673]

Description: gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.

debian: CVE-2026-58459 was patched at 2026-07-14

5. Remote Code Execution - NGINX (CVE-2026-42533) - Critical [666]

Description: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

altlinux: CVE-2026-42533 was patched at 2026-07-17, 2026-07-21, 2026-07-22

debian: CVE-2026-42533 was patched at 2026-07-14

6. Remote Code Execution - Gogs (CVE-2025-64111) - Critical [658]

Description: Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update files in the .git directory and achieve remote command execution. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

altlinux: CVE-2025-64111 was patched at 2026-06-25

7. Remote Code Execution - libssh2 (CVE-2026-55200) - Critical [654]

Description: libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

altlinux: CVE-2026-55200 was patched at 2026-07-09, 2026-07-13, 2026-07-14, 2026-07-15, 2026-07-17

debian: CVE-2026-55200 was patched at 2026-06-24, 2026-06-25

ubuntu: CVE-2026-55200 was patched at 2026-07-30

8. Elevation of Privilege - Linux Kernel (CVE-2026-64600) - Critical [647]

Description: In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle.

debian: CVE-2026-64600 was patched at 2026-07-30

oraclelinux: CVE-2026-64600 was patched at 2026-07-16

redhat: CVE-2026-64600 was patched at 2026-07-14, 2026-07-15, 2026-07-16, 2026-07-17, 2026-07-29

9. Authentication Bypass - Gitea (CVE-2026-28699) - Critical [645]

Description: Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

redos: CVE-2026-28699 was patched at 2026-07-14

10. Remote Code Execution - Chromium (CVE-2026-13036) - Critical [645]

Description: Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

debian: CVE-2026-13036 was patched at 2026-06-25, 2026-07-14

11. Remote Code Execution - Chromium (CVE-2026-14431) - Critical [645]

Description: Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

altlinux: CVE-2026-14431 was patched at 2026-07-03

debian: CVE-2026-14431 was patched at 2026-07-05, 2026-07-14

12. Code Injection - Vim (CVE-2026-59856) - Critical [641]

Description: Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.

altlinux: CVE-2026-59856 was patched at 2026-06-30, 2026-07-06

debian: CVE-2026-59856 was patched at 2026-07-14

redhat: CVE-2026-59856 was patched at 2026-07-29

ubuntu: CVE-2026-59856 was patched at 2026-07-30

13. Authentication Bypass - Curl (CVE-2026-11856) - Critical [639]

Description: Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.

altlinux: CVE-2026-11856 was patched at 2026-06-24, 2026-06-30

debian: CVE-2026-11856 was patched at 2026-06-24

14. Code Injection - MediaWiki (CVE-2026-58025) - Critical [635]

Description: Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

debian: CVE-2026-58025 was patched at 2026-07-05, 2026-07-14

15. Arbitrary File Writing - youtube-dl (CVE-2026-50023) - Critical [633]

Description: yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed in 2026.06.09.

altlinux: CVE-2026-50023 was patched at 2026-07-27

debian: CVE-2026-50023 was patched at 2026-07-14

16. Remote Code Execution - rtklib (CVE-2026-56786) - Critical [630]

Description: RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size, allowing up to 191-byte overflow into fixed 64-byte descriptor fields. An attacker controlling an NTRIP or serial RTCM3 correction stream can craft a valid CRC-bearing type-1033 message to corrupt adjacent rtcm_t object members, potentially achieving arbitrary code execution or denial of service.

debian: CVE-2026-56786 was patched at 2026-07-14

17. Authentication Bypass - Curl (CVE-2026-9079) - Critical [627]

Description: libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.

altlinux: CVE-2026-9079 was patched at 2026-06-24, 2026-06-30

debian: CVE-2026-9079 was patched at 2026-07-14

ubuntu: CVE-2026-9079 was patched at 2026-07-30

18. Authentication Bypass - rabbitmq_server (CVE-2026-57216) - Critical [627]

Description: RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend listener is loopback-bound because the loopback check uses the listener-side socket address instead of the real client source. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

debian: CVE-2026-57216 was patched at 2026-07-14

19. Arbitrary File Writing - Gogs (CVE-2026-25242) - Critical [625]

Description: Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance. This issue has been fixed in version 0.14.1.

altlinux: CVE-2026-25242 was patched at 2026-06-25

20. Memory Corruption - Linux Kernel (CVE-2026-53359) - Critical [620]

Description: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.

almalinux: CVE-2026-53359 was patched at 2026-07-09, 2026-07-14

altlinux: CVE-2026-53359 was patched at 2026-07-04, 2026-07-06, 2026-07-07, 2026-07-17, 2026-07-24, 2026-07-25

debian: CVE-2026-53359 was patched at 2026-07-05, 2026-07-14, 2026-07-30

oraclelinux: CVE-2026-53359 was patched at 2026-07-02, 2026-07-03, 2026-07-04, 2026-07-10, 2026-07-14

redhat: CVE-2026-53359 was patched at 2026-07-09, 2026-07-10, 2026-07-13, 2026-07-14, 2026-07-15, 2026-07-17, 2026-07-22, 2026-07-23

21. Remote Code Execution - 7-Zip (CVE-2026-14266) - Critical [619]

Description: 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.

debian: CVE-2026-14266 was patched at 2026-07-14

22. Security Feature Bypass - Gitea (CVE-2026-28744) - Critical [619]

Description: Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

redos: CVE-2026-28744 was patched at 2026-06-26

23. Remote Code Execution - Envoy (CVE-2026-48090) - Critical [616]

Description: Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, the HTTP OAuth2 filter (envoy.filters.http.oauth2) can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late AsyncClient completion can still invoke OAuth2Filter methods that use StreamDecoderFilterCallbacks after that object’s lifetime has ended, causing undefined behavior, worker crashes (availability loss), and use-after-free / invalid-vptr failures under AddressSanitizer. This is a memory-safety / lifetime issue in the data plane, not a trivial config bug. Remote code execution is not claimed here; the primary demonstrated impact is DoS via crash and UB; any further impact would be deployment- and allocator-dependent. This vulnerability is fixed in 1.37.5 and 1.38.3.

altlinux: CVE-2026-48090 was patched at 2026-06-25, 2026-07-02

24. Authentication Bypass - Curl (CVE-2026-8927) - Critical [615]

Description: When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.

altlinux: CVE-2026-8927 was patched at 2026-06-24, 2026-06-30

debian: CVE-2026-8927 was patched at 2026-07-14

ubuntu: CVE-2026-8927 was patched at 2026-07-30

25. Remote Code Execution - Keras (CVE-2026-12481) - Critical [614]

Description: A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard when `safe_mode` is set to `None`, which is the default value when `from_config()` is called outside of a `SafeModeScope` context. This logic error conflates `None` (unset/default-deny) with `False` (explicitly disabled), bypassing the guard and allowing attacker-controlled `marshal` bytecode to be deserialized. Affected call sites include `keras.layers.deserialize(config)`, `keras.models.clone_model(model)`, and any direct invocation of `Lambda.from_config(config)` without an enclosing `SafeModeScope(True)`. This vulnerability can be exploited to achieve arbitrary OS-level code execution in the context of the server or user process.

debian: CVE-2026-12481 was patched at 2026-07-14

26. Path Traversal - Cacti (CVE-2026-39938) - Critical [613]

Description: Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.

altlinux: CVE-2026-39938 was patched at 2026-07-25, 2026-07-29

debian: CVE-2026-39938 was patched at 2026-07-14

27. Arbitrary File Writing - libzypp (CVE-2026-44941) - Critical [610]

Description: A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.

debian: CVE-2026-44941 was patched at 2026-07-14

28. Authentication Bypass - Curl (CVE-2026-8926) - Critical [603]

Description: When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username(without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.

altlinux: CVE-2026-8926 was patched at 2026-06-24, 2026-06-30

debian: CVE-2026-8926 was patched at 2026-07-14

ubuntu: CVE-2026-8926 was patched at 2026-07-30

29. Path Traversal - OpenSSH (CVE-2026-45309) - Critical [603]

Description: AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and asyncssh/misc.py with the raw SSH username during pre-authentication server config reload, allowing a server configured with AuthorizedKeysFile authorized_keys/%u to read an authorized-keys file outside the intended directory when the SSH username contains /, \, or .. path traversal segments and authenticate with an attacker-selected key file. This issue is fixed in version 2.23.0.

debian: CVE-2026-45309 was patched at 2026-07-14

30. Security Feature Bypass - Curl (CVE-2026-8924) - Critical [601]

Description: A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

altlinux: CVE-2026-8924 was patched at 2026-06-24, 2026-06-30

debian: CVE-2026-8924 was patched at 2026-07-14

ubuntu: CVE-2026-8924 was patched at 2026-07-30

31. Security Feature Bypass - Jackson-databind (CVE-2026-54512) - Critical [601]

Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

almalinux: CVE-2026-54512 was patched at 2026-07-16, 2026-07-22

debian: CVE-2026-54512 was patched at 2026-07-14

oraclelinux: CVE-2026-54512 was patched at 2026-07-20, 2026-07-23

redhat: CVE-2026-54512 was patched at 2026-07-16, 2026-07-23

32. Security Feature Bypass - ModSecurity (CVE-2026-52747) - Critical [601]

Description: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead of appending the current buffer. This creates a parser differential between ModSecurity and backend applications that preserve line breaks in form fields, allowing rules that inspect ARGS or ARGS_POST to miss payloads whose dangerous syntax depends on a line break. This issue is fixed in version 3.0.16.

debian: CVE-2026-52747 was patched at 2026-07-14

High (473)

33. Path Traversal - Python (CVE-2026-44307) - High [594]

Description: Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \..\..\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.

redos: CVE-2026-44307 was patched at 2026-07-13

34. Denial of Service - Netty (CVE-2026-44891) - High [591]

Description: Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

debian: CVE-2026-44891 was patched at 2026-07-14

35. Authentication Bypass - Kubernetes (CVE-2026-55761) - High [589]

Description: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 through 2.39.3 and 2.40.0 until 2.43.0, unauthenticated restore and administrator initialization endpoints (/api/restore and /api/users/admin/init) remain accessible during the five-minute setup window for uninitialized instances, allowing a network attacker to restore a crafted backup or create the first administrator account and gain full administrative access. This issue is fixed in versions 2.39.4 and 2.43.0.

altlinux: CVE-2026-55761 was patched at 2026-06-25, 2026-07-02

36. Path Traversal - pymdown_extensions (CVE-2023-32309) - High [589]

Description: PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possible when using include file syntax. By using the syntax `--8<--"/etc/passwd"` or `--8<--"/proc/self/environ"` the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to render the content of a file outside the specified base paths: `--8<-- "../../../../etc/passwd"`. Within the Snippets extension, there exists a `base_path` option but the implementation is vulnerable to Directory Traversal. The vulnerable section exists in `get_snippet_path(self, path)` lines 155 to 174 in snippets.py. Any readable file on the host where the plugin is executing may have its content exposed. This can impact any use of Snippets that exposes the use of Snippets to external users. It is never recommended to use Snippets to process user-facing, dynamic content. It is designed to process known content on the backend under the control of the host, but if someone were to accidentally enable it for user-facing content, undesired information could be exposed. This issue has been addressed in version 10.0. Users are advised to upgrade. Users unable to upgrade may restrict relative paths by filtering input.

debian: CVE-2023-32309 was patched at 2026-07-14

37. Security Feature Bypass - Curl (CVE-2026-11564) - High [589]

Description: libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

altlinux: CVE-2026-11564 was patched at 2026-06-24, 2026-06-30

ubuntu: CVE-2026-11564 was patched at 2026-07-30

38. Security Feature Bypass - rabbitmq_server (CVE-2026-57215) - High [589]

Description: RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

debian: CVE-2026-57215 was patched at 2026-07-14

39. Security Feature Bypass - Envoy (CVE-2026-48743) - High [586]

Description: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request that is complete at the transport layer (HEADERS with FIN / headers-only close) but still carries a nonzero Content-Length into a complete upstream HTTP/1 request with unresolved body debt. In an HTTP/1 upstream deployment where the origin replies before reading the declared body and keeps the connection reusable, the beginning of the next Envoy-generated upstream request can be consumed as the first request's body. The remaining bytes are then parsed by the origin as a new HTTP/1 request. This was reproduced as a route-bypass/desync: direct /pwn was denied by Envoy, but the second downstream H3 stream received the response for backend-parsed GET /pwn HTTP/1.1. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

altlinux: CVE-2026-48743 was patched at 2026-06-25, 2026-07-02

40. Security Feature Bypass - nghttp2 (CVE-2026-58055) - High [584]

Description: nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

debian: CVE-2026-58055 was patched at 2026-07-14

ubuntu: CVE-2026-58055 was patched at 2026-07-30

41. Elevation of Privilege - Gogs (CVE-2026-25232) - High [583]

Description: Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a direct POST request, completely bypassing the branch protection mechanism. This vulnerability in the DeleteBranchPost function eenables privilege escalation from Write to Admin level, allowing low-privilege users to perform dangerous operations that should be restricted to administrators only. Although Git Hook layer correctly prevents protected branch deletion via SSH push, the web interface deletion operation does not trigger Git Hooks, resulting in complete bypass of protection mechanisms. In oder to exploit this vulnerability, attackers must have write permissions to the target repository, protected branches configured to the target repository and access to the Gogs web interface. This issue has been fixed in version 0.14.1.

altlinux: CVE-2026-25232 was patched at 2026-06-25

42. Remote Code Execution - GIMP (CVE-2026-58380) - High [583]

Description: A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

almalinux: CVE-2026-58380 was patched at 2026-07-16

debian: CVE-2026-58380 was patched at 2026-07-14

oraclelinux: CVE-2026-58380 was patched at 2026-07-16

redhat: CVE-2026-58380 was patched at 2026-07-16

43. Remote Code Execution - GIMP (CVE-2026-58384) - High [583]

Description: A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

almalinux: CVE-2026-58384 was patched at 2026-07-16

debian: CVE-2026-58384 was patched at 2026-07-14

oraclelinux: CVE-2026-58384 was patched at 2026-07-16

redhat: CVE-2026-58384 was patched at 2026-07-16

44. Command Injection - Gogs (CVE-2026-26194) - High [581]

Description: Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.14.2.

altlinux: CVE-2026-26194 was patched at 2026-06-25

45. Security Feature Bypass - Gogs (CVE-2026-25921) - High [580]

Description: Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2.

altlinux: CVE-2026-25921 was patched at 2026-06-25

46. Authentication Bypass - Caddy (CVE-2026-52845) - High [579]

Description: Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.

altlinux: CVE-2026-52845 was patched at 2026-07-02, 2026-07-03

debian: CVE-2026-52845 was patched at 2026-07-14

47. Code Injection - Cacti (CVE-2026-40083) - High [577]

Description: Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selected_items by calling cacti_unserialize(stripslashes(gnrv('selected_graphs_array'))). The cacti_unserialize() function calls unserialize() with allowed_classes set to false, which prevents object injection but still allows arbitrary string arrays to be deserialized. Then, at lines 760 to 766, the deserialized array values are passed directly into db_execute('DELETE FROM snmpagent_managers WHERE id IN (' . implode(',', $selected_items) . ')'), where they are imploded into the SQL statement without any integer validation, resulting in SQL Injection when using SNMP agent management permissions. This issue has been fixed in version 1.2.31.

altlinux: CVE-2026-40083 was patched at 2026-07-25, 2026-07-29

debian: CVE-2026-40083 was patched at 2026-07-14

48. Denial of Service - libssh2 (CVE-2026-55199) - High [577]

Description: libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.

altlinux: CVE-2026-55199 was patched at 2026-07-09, 2026-07-13, 2026-07-14, 2026-07-15, 2026-07-17

debian: CVE-2026-55199 was patched at 2026-06-24, 2026-06-25

ubuntu: CVE-2026-55199 was patched at 2026-07-30

49. Incorrect Calculation - dos (CVE-2026-42055) - High [577]

Description: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

almalinux: CVE-2026-42055 was patched at 2026-07-07, 2026-07-08, 2026-07-13

altlinux: CVE-2026-42055 was patched at 2026-06-23, 2026-06-25, 2026-06-26

debian: CVE-2026-42055 was patched at 2026-06-24, 2026-06-30

oraclelinux: CVE-2026-42055 was patched at 2026-07-09, 2026-07-13, 2026-07-14, 2026-07-16

redhat: CVE-2026-42055 was patched at 2026-07-07, 2026-07-08, 2026-07-13

redos: CVE-2026-42055 was patched at 2026-07-14

ubuntu: CVE-2026-42055 was patched at 2026-07-30

50. Security Feature Bypass - Curl (CVE-2026-12064) - High [577]

Description: When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.

altlinux: CVE-2026-12064 was patched at 2026-06-24, 2026-06-30

debian: CVE-2026-12064 was patched at 2026-06-24

ubuntu: CVE-2026-12064 was patched at 2026-07-30

51. Security Feature Bypass - Curl (CVE-2026-8932) - High [577]

Description: libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

altlinux: CVE-2026-8932 was patched at 2026-06-24, 2026-06-30

debian: CVE-2026-8932 was patched at 2026-07-14

52. Arbitrary File Reading - nltk (CVE-2026-12243) - High [576]

Description: NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` checks for literal `../` sequences but fails to account for percent-encoded traversal sequences such as `..%2f`. The `url2pathname()` function decodes these sequences after the validation step, allowing an attacker to bypass the protection. This vulnerability enables an attacker to read arbitrary files accessible to the Python process by controlling the resource name parameter passed to `nltk.data.load()` or `nltk.data.find()`. The issue affects applications that rely on NLTK for resource loading, including NLP web applications, Jupyter notebooks, and CLI tools. The default `pathsec.ENFORCE=False` setting exacerbates the impact by not blocking the file read at the `open()` stage.

debian: CVE-2026-12243 was patched at 2026-07-14

53. Arbitrary File Reading - nltk (CVE-2026-54293) - High [576]

Description: NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to bypass the protection documented in NLTK's SECURITY.md and read arbitrary files from the filesystem. While literal traversal strings such as ../../../etc/passwd are correctly blocked, encoded variants such as %2fetc%2fpasswd, %2e%2e%2f..., and ..%2f..%2f slip past the regex and are subsequently decoded into a real filesystem path. This vulnerability is fixed in 3.10.0-rc1.

debian: CVE-2026-54293 was patched at 2026-06-24

54. Denial of Service - Asterisk (CVE-2026-59925) - High [575]

Description: Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.

debian: CVE-2026-59925 was patched at 2026-07-14

55. Denial of Service - Envoy (CVE-2026-47220) - High [575]

Description: Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3.

altlinux: CVE-2026-47220 was patched at 2026-06-25, 2026-07-02

56. Denial of Service - Envoy (CVE-2026-47221) - High [575]

Description: Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null pointer dereference vulnerability when handling HTTP 303 (See Other) internal redirects for body-less non-GET/HEAD requests. When a POST, PUT, DELETE, or PATCH request without a body is sent to a route configured with internal redirect policy that includes 303 in redirect_response_codes, and the upstream responds with HTTP 303, the redirect handling code attempts to drain a request body buffer that was never allocated. This results in a segmentation fault that crashes the entire Envoy process. When route configured with internal_redirect_policy including 303 in redirect_response_codes and upstream must return HTTP 303 response, an unauthenticated attacker can exploit this to cause complete denial of service, terminating all active connections. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

altlinux: CVE-2026-47221 was patched at 2026-06-25, 2026-07-02

57. Denial of Service - Envoy (CVE-2026-48042) - High [575]

Description: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O(100K) nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

altlinux: CVE-2026-48042 was patched at 2026-06-25, 2026-07-02

58. Remote Code Execution - nltk (CVE-2026-12252) - High [571]

Description: In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute them via the `java()` function, which invokes `subprocess.Popen()` without integrity verification. This vulnerability is identical to CVE-2026-0848, which was fixed for StanfordSegmenter by adding SHA256 verification. However, the fix was not applied to these additional classes, leaving them susceptible to arbitrary code execution when loading untrusted JAR files.

debian: CVE-2026-12252 was patched at 2026-07-14

59. Path Traversal - Rclone (CVE-2026-59733) - High [570]

Description: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delete another user's private repository on backends that clean path components. This issue is fixed in version 1.74.4.

altlinux: CVE-2026-59733 was patched at 2026-07-13, 2026-07-16

debian: CVE-2026-59733 was patched at 2026-07-14

60. Denial of Service - Ws (CVE-2026-48779) - High [565]

Description: ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.

debian: CVE-2026-48779 was patched at 2026-06-24

61. Security Feature Bypass - Curl (CVE-2026-8286) - High [565]

Description: A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.

altlinux: CVE-2026-8286 was patched at 2026-06-24, 2026-06-30

debian: CVE-2026-8286 was patched at 2026-07-14

ubuntu: CVE-2026-8286 was patched at 2026-07-30

62. Security Feature Bypass - rabbitmq_server (CVE-2026-57217) - High [565]

Description: RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ topic authorization can allow restricted topic writes and binds during metadata-store failures because topic-permission lookup errors from Khepri can collapse to undefined, which the internal backend treats as allow. This issue is fixed in versions 3.13.15, 4.0.21, 4.1.11, and 4.2.6.

debian: CVE-2026-57217 was patched at 2026-07-14

63. Security Feature Bypass - rabbitmq_server (CVE-2026-57218) - High [565]

Description: RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.update_secret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after the channel user state changes. This issue is fixed in version 4.2.6.

debian: CVE-2026-57218 was patched at 2026-07-14

64. Information Disclosure - Curl (CVE-2026-9546) - High [564]

Description: A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.

altlinux: CVE-2026-9546 was patched at 2026-06-24, 2026-06-30

65. Denial of Service - Envoy (CVE-2026-48044) - High [563]

Description: Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl). When zstd decompression is enabled, processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause severe memory exhaustion, potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

altlinux: CVE-2026-48044 was patched at 2026-06-25, 2026-07-02

66. Information Disclosure - Envoy (CVE-2026-47775) - High [562]

Description: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAuth2 HTTP filter's encrypt()/decrypt() functions use AES-256-CBC without an authentication tag (no HMAC, no AEAD). The /callback endpoint returns HTTP 302 on successful decryption and HTTP 401 on padding failure, creating a padding oracle. An attacker who obtains the encrypted CodeVerifier cookie can recover the plaintext PKCE code_verifier in ~6,200 requests (~100 seconds), then exchange it with a stolen authorization code to obtain the victim's access token. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

altlinux: CVE-2026-47775 was patched at 2026-06-25, 2026-07-02

67. Memory Corruption - Linux Kernel (CVE-2026-53362) - High [560]

Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. The non-paged branch sets alloclen to fraglen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES case, remove the MSG_SPLICE_PAGES exception from the negative copy check.

almalinux: CVE-2026-53362 was patched at 2026-07-02

altlinux: CVE-2026-53362 was patched at 2026-07-04, 2026-07-06, 2026-07-07, 2026-07-17, 2026-07-24, 2026-07-25

debian: CVE-2026-53362 was patched at 2026-07-05, 2026-07-14, 2026-07-30

oraclelinux: CVE-2026-53362 was patched at 2026-07-15

68. Authentication Bypass - Gogs (CVE-2026-25229) - High [559]

Description: Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks. The vulnerability exists in the Web UI's label update endpoint POST /:username/:reponame/labels/edit. The handler function UpdateLabel uses an incorrect database query function that bypasses repository ownership validation. This issue has been fixed in version 0.14.1.

altlinux: CVE-2026-25229 was patched at 2026-06-25

69. Path Traversal - Rclone (CVE-2026-54572) - High [558]

Description: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4.

altlinux: CVE-2026-54572 was patched at 2026-07-13, 2026-07-16

debian: CVE-2026-54572 was patched at 2026-07-14

70. Path Traversal - Gogs (CVE-2026-24135) - High [557]

Description: Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitrary files on the server by manipulating the old_title parameter in the wiki editing form. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

altlinux: CVE-2026-24135 was patched at 2026-06-25