Report Name: Linux Patch Wednesday June 2026
Generated: 2026-06-26 17:14:12

Product Name	Prevalence	U	C	H	M	L	A	Comment
Vim	0.95			5	2		7	Highly configurable command-line text editor used in development and system administration.
pip	0.95				1		1	pip is the standard package installer for Python, used to install and manage software packages from the Python Package Index (PyPI) and other repositories.
Apache HTTP Server	0.9			3	8		11	Apache HTTP Server is a free and open-source web server that delivers web content through the internet
Django	0.9		1		4	1	6	Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides built-in tools for database models, authentication, URL routing, templates, and security features, making it one of the most widely used frameworks for building scalable and maintainable web applications.
Linux Kernel	0.9		2	4	218	100	324	The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel
Rust	0.9			2	1		3	Rust is a modern, high-performance systems programming language focused on safety, concurrency, and memory management.
Grafana	0.85				1		1	Grafana is an open-source analytics and monitoring platform that provides dashboards and visualization tools for metrics collected from various data sources.
Ruby on Rails	0.85		1		1		2	Full-stack Ruby web framework with MVC architecture and built-in view helpers and storage system.
.NET Core	0.8		1	2	1		4	.NET Core
Chromium	0.8	1		427	299	1	728	Chromium is a free and open-source web browser project, mainly developed and maintained by Google
FreeIPA	0.8			1			1	FreeIPA is a free and open source identity management system
GLPI	0.8			2			2	GLPI is an open source IT Asset Management, issue tracking system and service desk system
Keycloak	0.8		1	6	16	1	24	Keycloak is an open‑source identity and access management (IAM) solution that provides single sign‑on (SSO), user federation, identity brokering, and access control for applications and services.
Mozilla Firefox	0.8			23	41		64	Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation
Netty	0.8			7	14		21	Netty is a non-blocking I/O client-server framework for the development of Java network applications such as protocol servers and clients
Node.js	0.8		1	1			2	Node.js is a cross-platform, open-source server environment that can run on Windows, Linux, Unix, macOS, and more
OpenSSH	0.8			2			2	OpenSSH is a suite of secure networking utilities based on the Secure Shell protocol, which provides a secure channel over an unsecured network in a client–server architecture
OpenSSL	0.8			7	8		15	A software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end
RPC	0.8				2		2	Remote Procedure Call Runtime
Safari	0.8			2	14		16	Safari is a web browser developed by Apple. It is built into Apple's operating systems, including macOS, iOS, iPadOS and their upcoming VisionOS, and uses Apple's open-source browser engine WebKit, which was derived from KHTML.
Samba	0.8		1	1			2	Samba is a free software re-implementation of the SMB networking protocol, and was originally developed by Andrew Tridgell
The Qt Company Qt	0.8			1			1	Qt is a cross-platform application development framework used to build graphical user interfaces and applications for desktop, mobile, and embedded systems. It provides a comprehensive set of libraries, tools, and APIs, including Qt Quick for declarative UI development using QML. The vulnerability affects the Qt Quick Text component, where improper validation of width and height attributes in the tag can lead to excessive resource allocation and application unresponsiveness.
Varnish Cache	0.8				1		1	High-performance HTTP accelerator and reverse proxy for caching web content.
.NET	0.7			2	3		5	.NET
Apache Traffic Server	0.7			1			1	The Apache Traffic Server is a modular, high-performance reverse proxy and forward proxy server, generally comparable to Nginx and Squid
BIND	0.7			1			1	BIND is a suite of software for interacting with the Domain Name System
Babel	0.7				1		1	Babel is a free and open-source JavaScript transcompiler that is mainly used to convert ECMAScript 2015+ code into backwards-compatible JavaScript code that can be run by older JavaScript engines
Envoy	0.7				1		1	Envoy is a cloud-native, open-source edge and service proxy
JupyterHub	0.7			1			1	Multi-user server for Jupyter notebooks used in education and data science environments.
Kubernetes	0.7		3	1			4	Kubernetes is an open-source container orchestration system for automating software deployment, scaling, and management
MariaDB	0.7			1	6	2	9	MariaDB is a community-developed, commercially supported fork of the MySQL relational database management system, intended to remain free and open-source software under the GNU General Public License
Oracle MySQL	0.7				25		25	MySQL is an open-source relational database management system
Oracle VM VirtualBox	0.7			2	7		9	Oracle VM VirtualBox is a hosted hypervisor for x86 virtualization developed by Oracle Corporation
QEMU	0.7				1		1	QEMU is a generic and open source machine & userspace emulator and virtualizer
SQLite	0.7			2			2	SQLite is a database engine written in the C programming language
cpp-httplib	0.7			3			3	cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library
BIRD Internet Routing Daemon	0.65			1			1	BIRD Internet Routing Daemon is an open source dynamic routing daemon that implements routing protocols such as BGP, OSPF, RIP, and Babel. It is widely used by Internet service providers, data centers, IXPs, and advanced network operators for routing infrastructure.
idna	0.65			1	1		2	idna is a Python library implementing Internationalized Domain Names in Applications (IDNA), providing support for Unicode domain name encoding and decoding according to the IDNA standard. It is widely used by Python networking, HTTP, and DNS-related software.
Apache ActiveMQ	0.6		1	2	1	2	6	Apache ActiveMQ is an open source message broker written in Java together with a full Java Message Service (JMS) client
Axios	0.6		1	6	1		8	axios is a promise based HTTP client for the browser and node.js
Exim	0.6					1	1	Exim is a mail transfer agent (MTA) used on Unix-like operating systems
FreeRDP	0.6		3	2			5	FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license
ImageMagick	0.6		1		21	4	26	ImageMagick, invoked from the command line as magick, is a free and open-source cross-platform software suite for displaying, creating, converting, modifying, and editing raster images
Jenkins	0.6				2		2	Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery.
Libsoup	0.6			1			1	libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop to integrate well with GNOME applications and also has a synchronous API for use in CLI tools.
MongoDB	0.6		1		7	1	9	MongoDB is a source-available, cross-platform, document-oriented database program
Nextcloud	0.6			2	11	3	16	Nextcloud server is a self hosted personal cloud system
Perl	0.6			5	10	4	19	Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages
Python	0.6			1	3		4	Python is a high-level, general-purpose programming language
Roundcube	0.6			3	4	1	8	Roundcube is a web-based IMAP email client
Undertow	0.6			2			2	Undertow is a lightweight, high-performance Java web server and servlet container designed for both embedded and standalone deployments. It is the default web server in WildFly and is also used by Red Hat products including JBoss EAP and builds of Apache Camel.
Vault	0.6				2		2	Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets critical in modern computing
Wireshark	0.6				1		1	Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education
shell-quote	0.55		1				1	shell-quote is a JavaScript/Node.js library for safely parsing and quoting POSIX shell commands. It is commonly used by CLI tools, build systems, and developer utilities to construct and parse shell command lines.
389 Directory Server	0.5				10	2	12	389 Directory Server is a highly usable, fully featured, reliable and secure LDAP server implementation
ARM processor	0.5				1		1	Processor
Authlib	0.5			1			1	Authlib is a Python library for building OAuth and OpenID Connect clients and servers, providing tools for secure authentication, token management, and authorization flows.
Caddy	0.5			2			2	Product detected by a:caddyserver:caddy (exists in CPE dict)
Cargo	0.5					2	2	Product detected by a:rust-lang:cargo (exists in CPE dict)
Cfengine	0.5			1			1	Product detected by a:northern.tech:cfengine (exists in CPE dict)
Cockpit	0.5				1		1	Cockpit is a web-based server administration tool for Linux systems that allows users to manage servers, containers, storage, and network configurations through a browser interface.
Crypto	0.5			1	9	1	11	Product detected by a:golang:crypto (exists in CPE dict)
DBI	0.5				2		2	Product detected by a:perl:dbi (exists in CPE dict)
DCMTK	0.5				2		2	DCMTK (DICOM Toolkit) is an open-source collection of libraries and applications implementing large parts of the DICOM standard, including image processing, storage, and network services for medical imaging.
Devise	0.5				1		1	Product detected by a:heartcombo:devise (exists in CPE dict)
Directory LDAP API	0.5			1		1	2	Product detected by a:apache:directory_ldap_api (exists in CPE dict)
Docker	0.5				1		1	Docker
Engine	0.5				2		2	Product detected by a:docker:engine (exists in CPE dict)
FRRouting	0.5				1		1	FRRouting (FRR) is an IP routing protocol suite for Linux and Unix platforms, supporting BGP, OSPF, RIP, IS-IS, and other routing protocols for network infrastructure.
Flask	0.5			1			1	Flask is a lightweight WSGI web application framework
GDAL	0.5			2	1		3	Product detected by a:osgeo:gdal (exists in CPE dict)
Go	0.5				1		1	Product detected by a:golang:go (exists in CPE dict)
HTTP Server	0.5				1		1	Product detected by a:apache:http_server (exists in CPE dict)
Ironic	0.5				2	1	3	Product detected by a:openstack:ironic (exists in CPE dict)
Jackson-databind	0.5			1			1	Product detected by a:fasterxml:jackson-databind (exists in CPE dict)
Kafka	0.5				1	1	2	Product detected by a:apache:kafka (exists in CPE dict)
Keystone	0.5			3			3	Product detected by a:openstack:keystone (exists in CPE dict)
Libgcrypt	0.5				1		1	Product detected by a:gnupg:libgcrypt (exists in CPE dict)
Libheif	0.5			2			2	Product detected by a:struktur:libheif (exists in CPE dict)
Libinput	0.5			1			1	Product detected by a:freedesktop:libinput (exists in CPE dict)
Libxls	0.5			2			2	Product detected by a:libxls_project:libxls (exists in CPE dict)
Linux Imaging And Printing	0.5			2			2	Product detected by a:hp:linux_imaging_and_printing (exists in CPE dict)
MINA SSHD	0.5				1		1	Product detected by a:apache:mina_sshd (exists in CPE dict)
MapServer	0.5			1			1	Product detected by a:osgeo:mapserver (exists in CPE dict)
Mermaid	0.5				2		2	Product detected by a:mermaid_project:mermaid (exists in CPE dict)
Mistune	0.5			4	1		5	Product detected by a:mistune_project:mistune (exists in CPE dict)
Net	0.5				5		5	Product detected by a:golang:net (exists in CPE dict)
Node.js pbkdf2	0.5				1		1	The crypto.pbkdf2(), also known as Password-Based Key Derivation function, provides an asynchronous implementation of the derivative function. A key is derived by using the Hmac digest of a specified algorithm from password, salt and iterations.
OAuth2 Proxy	0.5			2	2	1	5	Product detected by a:oauth2_proxy_project:oauth2_proxy (exists in CPE dict)
OpenSC	0.5				1		1	OpenSC is a set of software tools and libraries to work with smart cards, with the focus on smart cards with cryptographic capabilities
OpenTelemetry	0.5			1	2		3	OpenTelemetry is a collection of APIs, SDKs, and tools. Use it to instrument, generate, collect, and export telemetry data (metrics, logs and traces) to help you analyze your software's performance and behavior
Pillow	0.5				1		1	Pillow is a Python imaging library that adds image processing capabilities to Python, supporting formats such as PNG, JPEG, GIF, TIFF, and BMP.
PrusaSlicer	0.5			1			1	Product detected by a:prusa3d:prusaslicer (exists in CPE dict)
Psr-7	0.5				2		2	Product detected by a:guzzlephp:psr-7 (exists in CPE dict)
PyJWT	0.5			4		1	5	Product detected by a:pyjwt_project:pyjwt (exists in CPE dict)
Pypdf	0.5				2	1	3	PyPDF is a Python library for reading, manipulating, and writing PDF files, including extraction, splitting, merging, and encryption features.
Quic-go	0.5				1		1	Product detected by a:quic-go_project:quic-go (exists in CPE dict)
SPIP	0.5				1		1	SPIP is an open-source software content management system designed for web site publishing, oriented towards online collaborative editing
Shiro	0.5				1	1	2	Product detected by a:apache:shiro (exists in CPE dict)
Squid	0.5			1			1	Squid is a caching and forwarding HTTP proxy supporting web acceleration, content filtering, and caching for HTTP, HTTPS, and FTP.
Squirrel	0.5			1			1	Product detected by a:squirrel-lang:squirrel (exists in CPE dict)
Starlette	0.5		1				1	Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit
TLS	0.5				1		1	TLS
Twig	0.5			1			1	Twig is a template language for PHP
Ubuntu Linux	0.5				7	5	12	Product detected by o:canonical:ubuntu_linux (exists in CPE dict)
UltraJSON	0.5			1			1	Product detected by a:ultrajson_project:ultrajson (exists in CPE dict)
X Server	0.5				9		9	Product detected by a:x.org:x_server (exists in CPE dict)
Znuny	0.5				2		2	Znuny/Znuny LTS is a fork of the ((OTRS)) Community Edition, one of the most flexible web-based ticketing systems used for Customer Service, Help Desk, IT Service Management
aiohttp	0.5				2		2	Product detected by a:aiohttp:aiohttp (exists in CPE dict)
archive::tar	0.5				3		3	Product detected by a:archivetar_project:archivetar (does NOT exist in CPE dict)
async-http-client	0.5			1			1	Product detected by a:asynchttpclient_project:async-http-client (exists in CPE dict)
brace-expansion	0.5				1		1	Product detected by a:juliangruber:brace-expansion (does NOT exist in CPE dict)
cpanel::json::xs	0.5				1	1	2	Product detected by a:rurban:cpaneljsonxs (does NOT exist in CPE dict)
daphne	0.5				2		2	Product detected by a:djangoproject:daphne (does NOT exist in CPE dict)
distribution	0.5			1			1	Product detected by a:distribution:distribution (does NOT exist in CPE dict)
dolibarr_erp\\/crm	0.5		1				1	Product detected by a:dolibarr:dolibarr_erp\\/crm (does NOT exist in CPE dict)
dr_libs	0.5			1			1	Product detected by a:mackron:dr_libs (does NOT exist in CPE dict)
ebpf	0.5			1			1	Product detected by a:cilium:ebpf (does NOT exist in CPE dict)
erl_interface	0.5				1		1	Product detected by a:erlang:erl_interface (does NOT exist in CPE dict)
erlang\\/inets	0.5				1		1	Product detected by a:erlang:erlang\\/inets (does NOT exist in CPE dict)
erlang\\/otp	0.5				4		4	Product detected by a:erlang:erlang\\/otp (does NOT exist in CPE dict)
fastnetmon	0.5		2	2	9		13	Product detected by a:pavel-odintsov:fastnetmon (does NOT exist in CPE dict)
go-git	0.5				2	1	3	Product detected by a:go-git_project:go-git (does NOT exist in CPE dict)
html::entities	0.5				1		1	Product detected by a:oalders:htmlentities (does NOT exist in CPE dict)
json	0.5				1		1	Product detected by a:ruby-lang:json (does NOT exist in CPE dict)
jupyter_server	0.5			1			1	Product detected by a:jupyter:jupyter_server (exists in CPE dict)
kafka-python	0.5				1		1	Product detected by a:dpkp:kafka-python (does NOT exist in CPE dict)
kitty	0.5		1	5	1		7	Product detected by a:kovidgoyal:kitty (does NOT exist in CPE dict)
ldns	0.5				1		1	Product detected by a:nlnetlabs:ldns (exists in CPE dict)
lexbor	0.5				2		2	Product detected by a:lexbor:lexbor (does NOT exist in CPE dict)
libexpat	0.5				1		1	Product detected by a:libexpat_project:libexpat (exists in CPE dict)
libsolv	0.5			1	2		3	Product detected by a:opensuse:libsolv (exists in CPE dict)
libusb	0.5				2		2	Product detected by a:libusb:libusb (exists in CPE dict)
net::cidr::set	0.5				1	2	3	Product detected by a:rrwo:netcidrset (does NOT exist in CPE dict)
net::statsd	0.5					1	1	Product detected by a:cosimo:netstatsd (does NOT exist in CPE dict)
nginx_open_source	0.5			1			1	Product detected by a:f5:nginx_open_source (does NOT exist in CPE dict)
njs	0.5				1		1	Product detected by a:f5:njs (exists in CPE dict)
op-tee	0.5			3			3	Product detected by o:trustedfirmware:op-tee (does NOT exist in CPE dict)
openbao	0.5				2		2	Product detected by a:openbao:openbao (does NOT exist in CPE dict)
openssl	0.5					1	1	Product detected by a:openssl:openssl (exists in CPE dict)
perl	0.5			1			1	Product detected by a:perl:perl (exists in CPE dict)
prometheus	0.5				1		1	Product detected by a:prometheus:prometheus (exists in CPE dict)
protocol::http2	0.5				1		1	Product detected by a:crux:protocolhttp2 (does NOT exist in CPE dict)
putty	0.5				2	1	3	Product detected by a:putty:putty (exists in CPE dict)
rabbitmq_server	0.5					1	1	Product detected by a:broadcom:rabbitmq_server (does NOT exist in CPE dict)
sqlfluff	0.5				2		2	Product detected by a:sqlfluff:sqlfluff (exists in CPE dict)
systeminformation	0.5		3				3	Product detected by a:systeminformation:systeminformation (exists in CPE dict)
tmp	0.5			1			1	Product detected by a:raszi:tmp (does NOT exist in CPE dict)
Azure	0.4					1	1	Azure
Erlang/OTP	0.4				2	1	3	Erlang/OTP is a set of libraries for the Erlang programming language
Flatpak	0.4					1	1	Flatpak is a utility for software deployment and package management for Linux
GPAC	0.4			12	2	1	15	GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity)
Git	0.4				1		1	Git
Keras	0.4				1		1	High-level neural networks API, running on top of TensorFlow, allowing model building and training
Spring Framework	0.4				16	1	17	The Spring Framework is an application framework and inversion of control container for the Java platform
WeasyPrint	0.3			1			1	Python library to generate PDF documents from HTML/CSS
Wasmtime	0.25				1		1	Standalone WebAssembly runtime written in Rust
form-data	0.25					1	1	JavaScript library for constructing multipart form-data
Unknown Product	0				44	169	213	Unknown Product

Vulnerability Type	Criticality	U	C	H	M	L	A
Remote Code Execution	1.0	1	9	202	19		231
Authentication Bypass	0.98		1	32	42		75
Code Injection	0.97			11	10		21
Command Injection	0.97		5	10	4		19
Arbitrary File Writing	0.95			1	1		2
Security Feature Bypass	0.9		2	257	177		436
Server-Side Request Forgery	0.87		1	2	5		8
Elevation of Privilege	0.85		3	7	21		31
Arbitrary File Reading	0.83		1				1
Information Disclosure	0.83		1	16	29		46
Cross Site Scripting	0.8			7	19		26
Open Redirect	0.75			1	4		5
Denial of Service	0.7		3	33	106	6	148
Path Traversal	0.7		1	2	11		14
Incorrect Calculation	0.5			1	25	8	34
Memory Corruption	0.5			20	263	26	309
Spoofing	0.4			2	16	1	19
Tampering	0.3			1	2		3
Unknown Vulnerability Type	0				180	280	460

Source	U	C	H	M	L	A
almalinux		2	21	89	1	113
altlinux		9	49	224	37	319
debian	1	19	561	795	291	1667
oraclelinux		1	17	78		96
redhat		2	29	92	2	125
redos		6	10	16	1	33
ubuntu		7	34	63	18	122

Urgent (1)

1. Remote Code Execution - Chromium (CVE-2026-11645) - Urgent [919]

Description: Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

debian: CVE-2026-11645 was patched at 2026-06-10, 2026-06-17

Critical (27)

2. Remote Code Execution - FreeRDP (CVE-2026-44420) - Critical [695]

Description: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution because it corrupts heap memory. This vulnerability is fixed in 3.26.0.

altlinux: CVE-2026-44420 was patched at 2026-05-26, 2026-05-27, 2026-05-30

debian: CVE-2026-44420 was patched at 2026-06-17

3. Command Injection - systeminformation (CVE-2025-68154) - Critical [673]

Description: systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.

debian: CVE-2025-68154 was patched at 2026-06-17

4. Remote Code Execution - Node.js (CVE-2024-56334) - Critical [669]

Description: systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter to cmd.exe in the `getWindowsIEEE8021x` function. This means that malicious content in the SSID can be executed as OS commands. This vulnerability may enable an attacker, depending on how the package is used, to perform remote code execution or local privilege escalation. This issue has been addressed in version 5.23.7 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

debian: CVE-2024-56334 was patched at 2026-06-17

5. Denial of Service - Django (CVE-2025-64458) - Critical [667]

Description: An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect` were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

altlinux: CVE-2025-64458 was patched at 2026-05-27

6. Remote Code Execution - dolibarr_erp\\/crm (CVE-2018-25357) - Critical [666]

Description: Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.

ubuntu: CVE-2018-25357 was patched at 2026-06-17

7. Denial of Service - .NET Core (CVE-2026-25667) - Critical [663]

Description: ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing.

redos: CVE-2026-25667 was patched at 2026-06-03

8. Authentication Bypass - Kubernetes (CVE-2026-44774) - Critical [660]

Description: Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider accepts any TraefikService backend reference whose name ends with @internal, making it possible to route traffic to rest@internal in addition to the intended api@internal. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services. This vulnerability is fixed in 2.11.46, 3.6.17, and 3.7.1.

altlinux: CVE-2026-44774 was patched at 2026-05-22

9. Security Feature Bypass - Samba (CVE-2026-2340) - Critical [651]

Description: A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.

almalinux: CVE-2026-2340 was patched at 2026-06-03, 2026-06-10

debian: CVE-2026-2340 was patched at 2026-05-26, 2026-05-30

redhat: CVE-2026-2340 was patched at 2026-06-03, 2026-06-10, 2026-06-15, 2026-06-23

ubuntu: CVE-2026-2340 was patched at 2026-05-26

10. Remote Code Execution - FreeRDP (CVE-2026-40033) - Critical [647]

Description: FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

altlinux: CVE-2026-40033 was patched at 2026-05-26, 2026-05-27, 2026-05-30

debian: CVE-2026-40033 was patched at 2026-06-17

11. Remote Code Execution - fastnetmon (CVE-2026-48689) - Critical [642]

Description: FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an incorrect bounds check of the form 'if (offset + length > maximum_internal_storage_size + 1)' instead of the correct 'if (offset + length > maximum_internal_storage_size)'. This allows writing exactly one byte past the end of the heap-allocated buffer. The class is used pervasively in BGP message encoding/decoding, NetFlow template processing, and Flow Spec NLRI construction. An attacker who can send network traffic (NetFlow, sFlow, IPFIX, or BGP) to a FastNetMon instance can trigger this overflow, potentially achieving arbitrary code execution by corrupting heap metadata. Notably, the append_byte() method uses the correct bounds check, confirming the inconsistency.

debian: CVE-2026-48689 was patched at 2026-05-30

ubuntu: CVE-2026-48689 was patched at 2026-06-15

12. Command Injection - fastnetmon (CVE-2026-48687) - Critical [637]

Description: FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() function in src/juniper_plugin/fastnetmon_juniper.php (lines 117-118) constructs shell commands by concatenating the $msg parameter directly into exec() calls: exec("echo `date` \"- {FASTNETMON] - " . $msg . " \" >> " . $FILE_LOG_TMP). The $msg variable contains unsanitized data derived from command-line arguments argv[1] through argv[3], which represent the attack IP address, direction, and power. While FastNetMon's C++ core currently passes IP addresses via inet_ntoa() (which only produces safe dotted-decimal notation), the PHP script performs no input validation or shell escaping. If the script is invoked directly, by another orchestration system, or if future code changes pass string-sourced IPs, arbitrary commands can be injected. The correct fix is to replace exec() with file_put_contents() or use escapeshellarg() on all parameters.

debian: CVE-2026-48687 was patched at 2026-05-30

ubuntu: CVE-2026-48687 was patched at 2026-06-15

13. Command Injection - systeminformation (CVE-2026-26318) - Critical [637]

Description: systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.

debian: CVE-2026-26318 was patched at 2026-06-17

14. Remote Code Execution - MongoDB (CVE-2026-8053) - Critical [635]

Description: An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution. This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

altlinux: CVE-2026-8053 was patched at 2026-05-22, 2026-05-25

15. Information Disclosure - Keycloak (CVE-2026-7504) - Critical [626]

Description: A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the "Valid Redirect URIs" field and requires user interaction to be successfully exploited. The issue stems from a discrepancy in how Keycloak and the underlying Java URI implementation handle the user-info component of a URL. If a malicious redirect URL is constructed using multiple @ characters in the user-info section, Java's URI parser fails to extract the user-info, leaving only the raw authority field. Consequently, Keycloak's validation check fails to detect the malformed user-info, falls back to a wildcard comparison, and incorrectly permits the malicious redirect.

altlinux: CVE-2026-7504 was patched at 2026-05-25, 2026-06-01, 2026-06-12

16. Command Injection - systeminformation (CVE-2026-26280) - Critical [625]

Description: systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`. Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8 fixes the issue.

debian: CVE-2026-26280 was patched at 2026-06-17

17. Elevation of Privilege - Linux Kernel (CVE-2026-43494) - Critical [623]

Description: In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().

debian: CVE-2026-43494 was patched at 2026-05-28, 2026-05-30

redos: CVE-2026-43494 was patched at 2026-06-11

ubuntu: CVE-2026-43494 was patched at 2026-06-02, 2026-06-04, 2026-06-11, 2026-06-16, 2026-06-22

18. Elevation of Privilege - Linux Kernel (CVE-2026-46243) - Critical [623]

Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.

almalinux: CVE-2026-46243 was patched at 2026-06-04, 2026-06-08

altlinux: CVE-2026-46243 was patched at 2026-06-11, 2026-06-23

debian: CVE-2026-46243 was patched at 2026-06-17

oraclelinux: CVE-2026-46243 was patched at 2026-06-05

redhat: CVE-2026-46243 was patched at 2026-06-04, 2026-06-08, 2026-06-17, 2026-06-22

redos: CVE-2026-46243 was patched at 2026-06-08

19. Remote Code Execution - Apache ActiveMQ (CVE-2026-42588) - Critical [623]

Description: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter using the "masterslave:// " URL which can allow loading a Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

debian: CVE-2026-42588 was patched at 2026-06-17

20. Remote Code Execution - FreeRDP (CVE-2026-44421) - Critical [623]

Description: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs. The bug is in gdi_CacheToSurface: it validates a destination rectangle that is clamped to UINT16_MAX, but then performs the copy using the original cacheEntry->width/height. This can cause a large out-of-bounds heap write and may lead to client crashes or code execution. This bug is reachable from a malicious RDP server, but only when the client has RDPGFX enabled. This vulnerability is fixed in 3.26.0.

altlinux: CVE-2026-44421 was patched at 2026-05-26, 2026-05-27, 2026-05-30

debian: CVE-2026-44421 was patched at 2026-06-17

21. Arbitrary File Reading - Kubernetes (CVE-2026-44881) - Critical [622]

Description: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer supports deploying stacks from Git repositories. When a Git-backed stack is created or updated, Portainer clones the repository using go-git v5, which translates Git blob entries with mode 0o120000 (symlink) into real OS symlinks on the host filesystem via os.Symlink. The only entry blocked from becoming a symlink is .gitmodules; every other path is created as a symlink without validation. Portainer's GET /api/stacks/{id}/file endpoint then reads the stack entry point with os.ReadFile, which follows OS symlinks transparently. A repository containing docker-compose.yml as a symlink to an arbitrary filesystem path causes the symlink target's contents to be returned verbatim in the HTTP response. Any authenticated user with rights to create or update a Git-backed stack — the default configuration in Portainer CE — can read arbitrary files accessible to the Portainer process. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0.

redos: CVE-2026-44881 was patched at 2026-06-05

22. Command Injection - shell-quote (CVE-2026-9277) - Critical [622]

Description: shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`.

debian: CVE-2026-9277 was patched at 2026-05-26, 2026-05-30

ubuntu: CVE-2026-9277 was patched at 2026-06-09

23. Security Feature Bypass - Starlette (CVE-2026-48710) - Critical [613]

Description: Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

debian: CVE-2026-48710 was patched at 2026-05-27, 2026-05-30

24. Server-Side Request Forgery - Axios (CVE-2026-44492) - Critical [612]

Description: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.

debian: CVE-2026-44492 was patched at 2026-06-17

25. Remote Code Execution - kitty (CVE-2026-33633) - Critical [607]

Description: Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.

debian: CVE-2026-33633 was patched at 2026-05-28, 2026-05-30

ubuntu: CVE-2026-33633 was patched at 2026-06-17

26. Denial of Service - ImageMagick (CVE-2026-46522) - Critical [605]

Description: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue.

altlinux: CVE-2026-46522 was patched at 2026-06-08

debian: CVE-2026-46522 was patched at 2026-05-26, 2026-05-29, 2026-05-30

redos: CVE-2026-46522 was patched at 2026-06-05

27. Elevation of Privilege - Kubernetes (CVE-2026-44848) - Critical [601]

Description: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, The Docker plugin management endpoints (/plugins/*) were not registered with a handler, so standard users with endpoint access could call privileged plugin operations — including installing and enabling plugins — directly against the underlying Docker daemon. The vulnerability is exposed when a non-admin Portainer user (Standard User role, or any role granted endpoint-level access) has been given access to a Docker endpoint via Portainer RBAC. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0.

redos: CVE-2026-44848 was patched at 2026-06-05

28. Path Traversal - Ruby on Rails (CVE-2026-44837) - Critical [600]

Description: view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. This vulnerability is fixed in 4.9.0.

debian: CVE-2026-44837 was patched at 2026-05-30

High (605)

29. Security Feature Bypass - cpp-httplib (CVE-2026-45352) - High [598]

Description: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::read_payload function in cpp-httplib (httplib.h) parses the chunk-size field of HTTP chunked transfer encoding using std::strtoul(). Per the C standard (§7.22.1.4), strtoul silently accepts a leading minus sign, performing unsigned wrap-around: strtoul("-2", …, 16) returns ULONG_MAX − 1 (0xFFFFFFFFFFFFFFFE). The library's only guard (line 12833) rejects ULONG_MAX (the result of "-1"), but any other negative value such as "-2" passes validation. The resulting near-maximum value is stored in chunk_remaining and controls how many bytes the server's read loop consumes from the network. This vulnerability is fixed in 0.43.4.

debian: CVE-2026-45352 was patched at 2026-06-17

30. Authentication Bypass - Libsoup (CVE-2026-6324) - High [596]

Description: A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

debian: CVE-2026-6324 was patched at 2026-05-30

31. Authentication Bypass - Nextcloud (CVE-2026-45156) - High [596]

Description: Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This issue has been patched in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0 and 8.3.0.

altlinux: CVE-2026-45156 was patched at 2026-06-17, 2026-06-19

32. Authentication Bypass - Caddy (CVE-2026-30851) - High [591]

Description: Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.

altlinux: CVE-2026-30851 was patched at 2026-05-29

33. Authentication Bypass - Keystone (CVE-2026-42998) - High [591]

Description: An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.

debian: CVE-2026-42998 was patched at 2026-05-30, 2026-06-08

ubuntu: CVE-2026-42998 was patched at 2026-06-16

34. Command Injection - kitty (CVE-2026-42850) - High [589]

Description: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar program to connect to the attacker, or else listening for someone to connect. Once this condition is set, an attacker could pwn the computer of the victim using a special kitty's escape code that will run a command in the shell in use. Version 04.7.0 fixes the issue.

debian: CVE-2026-42850 was patched at 2026-06-17

35. Remote Code Execution - Perl (CVE-2026-48962) - High [588]

Description: IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.

debian: CVE-2026-48962 was patched at 2026-05-30

36. Information Disclosure - Kubernetes (CVE-2026-44883) - High [586]

Description: Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer's authentication middleware accepts JWT bearer tokens passed as the ?token=<JWT> URL query parameter on any authenticated API endpoint, in addition to the standard Authorization: Bearer header. URLs are recorded in reverse-proxy access logs, browser history, and HTTP Referer headers on outbound navigation, so any JWT passed this way can be harvested by anyone with access to those logs or by an external site the user subsequently visits. A leaked token grants the full privileges of the user it was issued to, until the token expires (default 8 hours, configurable). The ?token= parameter was used by Portainer's browser-based container attach, exec, and pod shell features, so any user with exec or attach rights on a container was exposed — not only administrators. This vulnerability is fixed in 2.33.8, 2.39.2, and 2.41.0.

redos: CVE-2026-44883 was patched at 2026-06-05

37. Remote Code Execution - PrusaSlicer (CVE-2023-47268) - High [583]

Description: In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.

debian: CVE-2023-47268 was patched at 2026-05-30

38. Information Disclosure - Axios (CVE-2026-44487) - High [581]

Description: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.

debian: CVE-2026-44487 was patched at 2026-06-17

39. Security Feature Bypass - Flask (CVE-2026-42999) - High [577]

Description: An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).

debian: CVE-2026-42999 was patched at 2026-05-30, 2026-06-08

ubuntu: CVE-2026-42999 was patched at 2026-06-16

40. Information Disclosure - Axios (CVE-2026-44486) - High [569]

Description: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.

debian: CVE-2026-44486 was patched at 2026-06-17

41. Elevation of Privilege - Keystone (CVE-2026-43000) - High [568]

Description: An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.

debian: CVE-2026-43000 was patched at 2026-05-30, 2026-06-08

ubuntu: CVE-2026-43000 was patched at 2026-06-16

42. Code Injection - kitty (CVE-2026-42851) - High [566]

Description: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.

debian: CVE-2026-42851 was patched at 2026-06-17

43. Code Injection - kitty (CVE-2026-54057) - High [566]

Description: Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.

debian: CVE-2026-54057 was patched at 2026-06-17

44. Memory Corruption - nginx_open_source (CVE-2026-9256) - High [565]

Description: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

altlinux: CVE-2026-9256 was patched at 2026-05-25, 2026-06-18

debian: CVE-2026-9256 was patched at 2026-05-30, 2026-06-07

redhat: CVE-2026-9256 was patched at 2026-06-23

redos: CVE-2026-9256 was patched at 2026-06-09

ubuntu: CVE-2026-9256 was patched at 2026-06-01, 2026-06-03

45. Security Feature Bypass - Keystone (CVE-2026-44394) - High [565]

Description: An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.

debian: CVE-2026-44394 was patched at 2026-05-30, 2026-06-08

ubuntu: CVE-2026-44394 was patched at 2026-06-16

46. Information Disclosure - Caddy (CVE-2026-30852) - High [564]

Description: Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the vars_regexp matcher in vars.go:337 double-expands user-controlled input through the Caddy replacer. When vars_regexp matches against a placeholder like {http.request.header.X-Input}, the header value gets resolved once (expected), then passed through repl.ReplaceAll() again (the bug). This means an attacker can put {env.DATABASE_URL} or {file./etc/passwd} in a request header and the server will evaluate it, leaking environment variables, file contents, and system info. This issue has been patched in version 2.11.2.

altlinux: CVE-2026-30852 was patched at 2026-05-29

47. Denial of Service - cpp-httplib (CVE-2026-46527) - High [563]

Description: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, When the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose value parses to no valid IP segments. The code path then executes get_client_ip(), which calls front() on an empty std::vector—undefined behavior in C++. On typical implementations this manifests as abnormal process termination (denial of service). With Sanitizers enabled, you get an explicit runtime diagnostic. This vulnerability is fixed in 0.44.0.

debian: CVE-2026-46527 was patched at 2026-06-17

48. Arbitrary File Writing - kitty (CVE-2026-54056) - High [562]

Description: Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a staged symlink and then send a same-name regular-file entry. The regular-file write uses `utils.CreateAt()` / `openat(O_RDWR|O_CREAT|O_TRUNC)` without `O_NOFOLLOW`, so it follows the attacker-created symlink and writes outside the staging directory before final overwrite confirmation runs. This appears related in class to the file-transfer symlink advisory, but it is a different bug: it affects `kitten dnd` remote drag-and-drop staging, uses different vulnerable code (`kittens/dnd/drop.go` and `tools/utils/file_at_fd.go`), and reproduces on commit `4aa4a5c0567a92553a8c20a88a4352da637fca5d`, after the file-transfer `O_NOFOLLOW` fix. Version 0.47.2 patches the issue.

debian: CVE-2026-54056 was patched at 2026-06-17

49. Denial of Service - Axios (CVE-2026-44488) - High [558]

Description: Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usage when a malicious or compromised server returns an oversized response, when an attacker can supply a large data: URL, or when an application forwards attacker-controlled request bodies through axios while relying on maxBodyLength as a boundary. This vulnerability is fixed in 0.32.0 and 1.16.0.

debian: CVE-2026-44488 was patched at 2026-06-17

50. Denial of Service - Axios (CVE-2026-44496) - High [558]

Description: Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the affected browser tab while axios prepares a request. The issue does not affect ordinary Node.js HTTP adapter usage, React Native, or web workers, where axios does not read document.cookie. This vulnerability is fixed in 0.32.0 and 1.16.0.

debian: CVE-2026-44496 was patched at 2026-06-17

51. Memory Corruption - FreeRDP (CVE-2026-45700) - High [558]

Description: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate nXDst against the caller-provided destination stride (nDstStep) even when it is writing into the internal temp buffer pTempData. An attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData. This vulnerability is fixed in 3.26.0.

altlinux: CVE-2026-45700 was patched at 2026-05-26, 2026-05-27, 2026-05-30

debian: CVE-2026-45700 was patched at 2026-06-17

ubuntu: CVE-2026-45700 was patched at 2026-06-16

52. Authentication Bypass - PyJWT (CVE-2026-48526) - High [555]

Description: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.

altlinux: CVE-2026-48526 was patched at 2026-06-02, 2026-06-05

debian: CVE-2026-48526 was patched at 2026-05-30

redhat: CVE-2026-48526 was patched at 2026-06-16

53. Security Feature Bypass - distribution (CVE-2026-41888) - High [553]

Description: Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.

debian: CVE-2026-41888 was patched at 2026-05-30

redos: CVE-2026-41888 was patched at 2026-05-26

54. Server-Side Request Forgery - WeasyPrint (CVE-2025-68616) - High [550]

Description: WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.

debian: CVE-2025-68616 was patched at 2026-06-17

55. Memory Corruption - Linux Kernel (CVE-2026-46275) - High [548]

Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY flag is set during TTY close. If a hangup occurs before setup completes, hci_uart_tty_close() skips the teardown of these workqueues and proceeds to free the `hu` struct. When the scheduled work executes later, it blindly dereferences the freed `hu` struct. Furthermore, several data races and UAFs were identified in the teardown sequence: 1. Calling hci_uart_flush() from hci_uart_close() without effectively disabling write_work causes a race condition where both can concurrently double-free hu->tx_skb. This happens because protocol timers can concurrently invoke hci_uart_tx_wakeup() and requeue write_work. 2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF when vendor specific protocol close callbacks dereference hu->hdev. 3. In the initialization error paths, failing to take the proto_lock write lock before clearing PROTO_READY leads to races with active readers. Additionally, hci_uart_tty_receive() accesses hu->hdev outside the read lock, leading to UAFs if the initialization error path frees hdev concurrently. Fix these synchronization and lifecycle issues by: 1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first, followed immediately by a cancel_work_sync(&hu->write_work). Clearing the flag locks out concurrent protocol timers from successfully invoking hci_uart_tx_wakeup(), effectively rendering the cancellation permanent and preventing the tx_skb double-free. 2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip hu->proto->flush(). This is perfectly safe in the tty_close path because hu->proto->close() executes shortly after, which intrinsically purges all protocol SKB queues and tears down the state. 3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev) across all close and error paths to prevent vendor-level UAFs. 4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive() inside the proto_lock read-side critical section to safely synchronize with device unregistration. 5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely flush the workqueue before hci_uart_flush() is invoked via the HCI core. 6. Utilizing cancel_work_sync() instead of disable_work_sync() across all paths to prevent permanently breaking user-space retry capabilities.

debian: CVE-2026-46275 was patched at 2026-06-17, 2026-06-21

56. Denial of Service - Axios (CVE-2026-44490) - High [546]

Description: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the merged headers and ride out on the wire. (2) lib/core/mergeConfig.js line 26 builds the hasOwnProperty descriptor as a plain-object literal. Object.defineProperty reads descriptor.get/descriptor.set via the prototype chain, so a polluted Object.prototype.get or Object.prototype.set makes the call throw TypeError synchronously on every axios request. This vulnerability is fixed in 0.32.0 and 1.16.0.

debian: CVE-2026-44490 was patched at 2026-06-17

57. Memory Corruption - Axios (CVE-2026-44494) - High [546]

Description: Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, which traverses the prototype chain. Because proxy is not present in Axios defaults, the merged config object has no own proxy property, making it trivially injectable via prototype pollution. Once injected, setProxy() routes all HTTP requests through the attacker's proxy server. This vulnerability is fixed in 1.16.0.

debian: CVE-2026-44494 was patched at 2026-06-17

58. Denial of Service - UltraJSON (CVE-2026-44660) - High [541]

Description: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a file-like object and the write operation raises an exception, the serialized JSON string object is not decremented, leaking memory. Each failed write operation leaks the full size of the serialized payload. This vulnerability is fixed in 5.12.1.

debian: CVE-2026-44660 was patched at 2026-05-30

59. Information Disclosure - async-http-client (CVE-2026-45300) - High [541]

Description: The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authorization` and `Proxy-Authorization` headers but does not strip the `Cookie` header, causing session cookies and other sensitive cookie values to be sent to attacker-controlled servers. Versions 2.15.0 and 3.0.10 patch the issue.

debian: CVE-2026-45300 was patched at 2026-06-17

60. Information Disclosure - libsolv (CVE-2026-48864) - High [541]

Description: A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.

debian: CVE-2026-48864 was patched at 2026-05-30

61. Path Traversal - jupyter_server (CVE-2026-5422) - High [541]

Description: A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments.

debian: CVE-2026-5422 was patched at 2026-06-17

62. Path Traversal - tmp (CVE-2026-44705) - High [541]

Description: tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.

debian: CVE-2026-44705 was patched at 2026-06-17

63. Security Feature Bypass - JupyterHub (CVE-2026-40864) - High [539]

Description: JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attackers could trigger server spawn (but not access the server) and if the attacker is a JupyterHub user permitted to share access to their server, cause a user to accept a share and have access to the attacker's server. This issue has been fixed in version 5.4.5. If developers are unable to immediately upgrade, they can temporarily mitigate this issue by dropping requests to JupyterHub with Sec-Fetch-Mode: no-cors if they are using a reverse proxy.

debian: CVE-2026-40864 was patched at 2026-05-30

64. Denial of Service - GPAC (CVE-2025-52292) - High [536]

Description: A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

debian: CVE-2025-52292 was patched at 2026-06-17

65. Denial of Service - GPAC (CVE-2025-52293) - High [536]

Description: A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying crafted HEVC SPS data.

debian: CVE-2025-52293 was patched at 2026-06-17

66. Denial of Service - GPAC (CVE-2025-55657) - High [536]

Description: A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

debian: CVE-2025-55657 was patched at 2026-06-17

67. Information Disclosure - Libxls (CVE-2026-26824) - High [529]

Description: libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processing a crafted XLS file

debian: CVE-2026-26824 was patched at 2026-06-17

68. Cross Site Scripting - Nextcloud (CVE-2025-59788) - High [528]

Description: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause of this Nextcloud issue is that the product exposes executable example code on a same-origin basis.

altlinux: CVE-2025-59788 was patched at 2026-05-27, 2026-06-19

redos: CVE-2025-59788 was patched at 2026-05-24

69. Memory Corruption - FreeRDP (CVE-2026-44422) - High [522]

Description: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object to both output fields. The generic destructor later walks each field independently and destroys/frees both pointers. This causes a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path. This vulnerability is fixed in 3.26.0.

altlinux: CVE-2026-44422 was patched at 2026-05-26, 2026-05-27, 2026-05-30

debian: CVE-2026-44422 was patched at 2026-06-17

70. Security Feature Bypass - Rust (CVE-2026-50010) - High [519]

Description: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

debian: CVE-2026-50010 was patched at 2026-06-17

71. Authentication Bypass - Oracle VM VirtualBox (CVE-2026-35250) - High [517]

Description: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 2.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).

altlinux: CVE-2026-35250 was patched at 2026-06-01

72. Denial of Service - Libheif (CVE-2026-41069) - High [517]

Description: libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, a malformed HEIF sequence file can trigger an out-of-bounds read in core sequence parsing logic, causing DoS. A malformed file can have stco.entry_count == 0 (creating no chunks) while still passing validation because saio.entry_count == 0 matches, but with saiz.sample_count > 0 the SampleAuxInfoReader constructor still enters its loop. This leads to an out-of-bounds dereference on the empty chunks[0] in chunked mode.

debian: CVE-2026-41069 was patched at 2026-05-30

ubuntu: CVE-2026-41069 was patched at 2026-06-18

73. Information Disclosure - Squid (CVE-2026-47729) - High [517]

Description: This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided.

debian: CVE-2026-47729 was patched at 2026-06-17, 2026-06-21

ubuntu: CVE-2026-47729 was patched at 2026-06-16

74. Memory Corruption - kitty (CVE-2026-33642) - High [517]

Description: Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.

debian: CVE-2026-33642 was patched at 2026-05-28, 2026-05-30

ubuntu: CVE-2026-33642 was patched at 2026-06-17

75. Tampering - cpp-httplib (CVE-2026-45372) - High [515]

Description: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.

debian: CVE-2026-45372 was patched at 2026-06-17

76. Remote Code Execution - OpenSSL (CVE-2026-45447) - High [514]

Description: Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

almalinux: CVE-2026-45447 was patched at 2026-06-11

debian: CVE-2026-45447 was patched at 2026-06-09, 2026-06-17

oraclelinux: CVE-2026-45447 was patched at 2026-06-16, 2026-06-18

redhat: CVE-2026-45447 was patched at 2026-06-11, 2026-06-16

ubuntu: CVE-2026-45447 was patched at 2026-06-09

77. Denial of Service - GPAC (CVE-2025-55659) - High [513]

Description: A NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

debian: CVE-2025-55659 was patched at 2026-06-17

78. Cross Site Scripting - Mistune (CVE-2026-44708) - High [511]

Description: Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, the mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the parser is explicitly created with escape=True, which is supposed to guarantee that all user-controlled text is sanitised before reaching the DOM. This vulnerability is fixed in 3.2.1.

debian: CVE-2026-44708 was patched at 2026-05-30

79. Cross Site Scripting - Mistune (CVE-2026-44897) - High [511]

Description: Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, HTMLRenderer.heading() builds the opening <hN> tag by string-concatenating the id attribute value directly into the HTML — with no call to escape(), safe_entity(), or any other sanitisation function. A double-quote character " in the id value terminates the attribute, allowing an attacker to inject arbitrary additional attributes (event handlers, src=, href=, etc.) into the heading element. This vulnerability is fixed in 3.2.1.