Report Name: Linux Patch Wednesday September 2026
Generated: 2026-10-02 13:20:20

Product Name	Prevalence	U	C	H	M	L	A	Comment
Angular	0.95			4	1		5	Angular is a development platform for building mobile and desktop web applications using TypeScript, JavaScript, and other languages. It provides a component-based architecture, declarative templates, dependency injection, powerful tooling, and extensive ecosystem support for creating scalable, high-performance web apps.
Vim	0.95			1	1		2	Highly configurable command-line text editor used in development and system administration.
Active Directory	0.9			1			1	Active Directory is a directory service developed by Microsoft for Windows domain networks
GLib	0.9				1		1	GLib is a widely used low-level core library for the GNOME ecosystem and many Linux applications, providing data structures, utility APIs, event loops, IPC facilities, and GDBus for D-Bus communication.
Linux Kernel	0.9		1	45	495	271	812	The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel
Polkit	0.9			1			1	polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes
Rust	0.9			2			2	Rust is a modern, high-performance systems programming language focused on safety, concurrency, and memory management.
Sudo	0.9			1	1		2	Sudo is a widely used Unix/Linux utility that allows permitted users to execute commands with elevated (typically root) privileges while providing extensive logging and fine-grained security controls. It is a foundational component in most Linux and BSD distributions.
Windows Kernel	0.9		1		1		2	Windows Kernel
WordPress	0.9			1			1	WordPress is a widely-used open source content management system (CMS) for building websites and blogs. It provides a plugin and theme architecture and is written in PHP, typically paired with MySQL/MariaDB for storage.
nghttp2	0.9				1		1	nghttp2 is an implementation of HTTP/2 and its header compression algorithm HPACK in C
util-linux	0.9		1		1		2	Linux utility suite providing core system tools including mount. Vulnerability affects SUID mount binary due to TOCTOU race condition.
Dovecot	0.85			1	2		3	Open-source IMAP and POP3 email server with authentication and indexing features.
Grafana	0.85				1		1	Grafana is an open-source analytics and monitoring platform that provides dashboards and visualization tools for metrics collected from various data sources.
Ruby on Rails	0.85			1			1	Full-stack Ruby web framework with MVC architecture and built-in view helpers and storage system.
.NET Framework	0.8			1			1	.NET Framework
Binutils	0.8			3	9		12	The GNU Binary Utilities, or binutils, are a set of programming tools for creating and managing binary programs, object files, libraries, profile data, and assembly source code
CUPS	0.8				2		2	CUPS is a modular printing system for Unix-like computer operating systems which allows a computer to act as a print server
Chromium	0.8	2	15	283	301	43	644	Chromium is a free and open-source web browser project, mainly developed and maintained by Google
Expat	0.8		1				1	Expat is a lightweight stream-oriented XML parser library written in C, widely embedded in applications and other software that needs to parse XML documents.
FreeIPA	0.8		1	2	3		6	FreeIPA is a free and open source identity management system
GNOME desktop	0.8			1	4		5	GNOME originally an acronym for GNU Network Object Model Environment, is a free and open-source desktop environment for Linux and other Unix-like operating systems
GNU C Library	0.8				6		6	The GNU C Library, commonly known as glibc, is the GNU Project's implementation of the C standard library
Keycloak	0.8	1		4	16	3	24	Keycloak is an open‑source identity and access management (IAM) solution that provides single sign‑on (SSO), user federation, identity brokering, and access control for applications and services.
Mozilla Firefox	0.8			21	100	3	124	Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation
Netty	0.8		1	1	6		8	Netty is a non-blocking I/O client-server framework for the development of Java network applications such as protocol servers and clients
Node.js	0.8			1	5		6	Node.js is a cross-platform, open-source server environment that can run on Windows, Linux, Unix, macOS, and more
OpenSSL	0.8			8	4	1	13	A software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end
PHP	0.8		4	7	4		15	PHP is a general-purpose scripting language geared towards web development. It was originally created by Danish-Canadian programmer Rasmus Lerdorf in 1993 and released in 1995.
RPC	0.8		1	1	3		5	Remote Procedure Call Runtime
Safari	0.8			2	5		7	Safari is a web browser developed by Apple. It is built into Apple's operating systems, including macOS, iOS, iPadOS and their upcoming VisionOS, and uses Apple's open-source browser engine WebKit, which was derived from KHTML.
The Qt Company Qt	0.8			1			1	Qt is a cross-platform application development framework used to build graphical user interfaces and applications for desktop, mobile, and embedded systems. It provides a comprehensive set of libraries, tools, and APIs, including Qt Quick for declarative UI development using QML. The vulnerability affects the Qt Quick Text component, where improper validation of width and height attributes in the tag can lead to excessive resource allocation and application unresponsiveness.
Windows Resilient File System (ReFS)	0.8				1		1	Windows component
Zabbix	0.8				3		3	Zabbix is an open-source software tool to monitor IT infrastructure such as networks, servers, virtual machines, and cloud services
jackson-databind	0.8		1	2	2		5	Jackson Databind is a widely used Java library for converting JSON data to and from Java objects, providing data-binding functionality within the Jackson JSON processing ecosystem.
BusyBox	0.75			1			1	BusyBox combines many common Unix utilities into a small executable and is widely used in embedded Linux systems, appliances, containers, and recovery environments.
Gitea	0.75	2	3	6	1		12	Gitea is a lightweight self-hosted Git service that provides source code hosting, pull requests, issue tracking, CI integrations, and user management through a web interface.
xmldom	0.75		6	6	3		15	JavaScript XML parser and serializer implementing W3C DOM standards.
Apache Tomcat	0.7			3	4	1	8	Apache Tomcat is a free and open-source implementation of the Jakarta Servlet, Jakarta Expression Language, and WebSocket technologies
Asterisk	0.7				1		1	Asterisk is a free and open source framework for building communications applications and is sponsored by Sangoma
BIND	0.7				1	3	4	BIND is a suite of software for interacting with the Domain Name System
Envoy	0.7				8	3	11	Envoy is a cloud-native, open-source edge and service proxy
FFmpeg	0.7			1	7		8	FFmpeg is a free and open-source software project consisting of a suite of libraries and programs for handling video, audio, and other multimedia files and streams
MinIO	0.7			3	1		4	MinIO is a high-performance, S3-compatible object storage system designed for large-scale data infrastructure. It supports cloud-native workloads and provides APIs for storing, retrieving, and managing unstructured data such as photos, videos, log files, and backups, with a focus on scalability, speed, and simplicity.
Open Asset Import Library Assimp	0.7				1		1	Open Asset Import Library is a library that loads various 3D file formats into a shared, in-memory format
Oracle MySQL	0.7				2		2	MySQL is an open-source relational database management system
Oracle VM VirtualBox	0.7			3	18		21	Oracle VM VirtualBox is a hosted hypervisor for x86 virtualization developed by Oracle Corporation
RPM	0.7			2	2		4	RPM is a package management system and software packaging format widely used by Linux distributions in the Red Hat ecosystem and related systems, including tools for building RPM packages.
SQLite	0.7		1	1			2	SQLite is a database engine written in the C programming language
cpp-httplib	0.7				1	1	2	cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library
qs	0.7				2	1	3	qs is a popular JavaScript library for parsing and serializing URL query strings. It supports nested objects, arrays, custom parsing options, and is widely used in Node.js frameworks and middleware to handle HTTP query parameters and form-encoded data.
alsa-lib	0.65			1			1	alsa-lib is the user-space library for the Advanced Linux Sound Architecture (ALSA), providing APIs for audio and MIDI device access and configuration on Linux systems.
idna	0.65				1		1	idna is a Python library implementing Internationalized Domain Names in Applications (IDNA), providing support for Unicode domain name encoding and decoding according to the IDNA standard. It is widely used by Python networking, HTTP, and DNS-related software.
Bouncy Castle	0.6					1	1	Bouncy Castle is a collection of APIs used in cryptography
FreeRDP	0.6		1	6	15		22	FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license
GNU Screen	0.6				1		1	GNU Screen is a terminal multiplexer that allows multiple virtual terminal sessions to be accessed and controlled from a single physical terminal. It supports session detaching/reattaching, multiple windows, logging, and scripting — and historically is distributed as part of the GNU Project for use on Unix-like systems. When run with setuid-root privileges (as in CVE-2025-23395), Screen may perform privileged file operations on user-supplied paths without dropping elevated privileges, enabling unprivileged users to create root-owned files and potentially escalate to root.
ImageMagick	0.6				4	3	7	ImageMagick, invoked from the command line as magick, is a free and open-source cross-platform software suite for displaying, creating, converting, modifying, and editing raster images
Jetty	0.6				3		3	Jetty is a Java based web server and servlet engine
Libsoup	0.6				1	1	2	libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop to integrate well with GNOME applications and also has a synchronous API for use in CLI tools.
MongoDB	0.6				41	7	48	MongoDB is a source-available, cross-platform, document-oriented database program
Nokogiri	0.6					1	1	Nokogiri is an open source XML and HTML library for the Ruby programming language
PHP Secure Communications Library	0.6					1	1	phpseclib provides pure-PHP implementations of SSH2, SFTP, RSA, DSA, Elliptic Curves, AES, ChaCha20, X. 509, CSR, CRL, SPKAC
Perl	0.6			2	14	1	17	Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages
Puma	0.6			1			1	Puma is a Ruby/Rack web server built for parallelism
Python	0.6			2	4	3	9	Python is a high-level, general-purpose programming language
Rclone	0.6			1	8	6	15	Rclone is a command-line program to sync files and directories to and from different cloud storage providers, supporting over 40 cloud storage products including S3, Google Drive, Dropbox, OneDrive, and many more.
Redis	0.6			3			3	Redis is an open-source in-memory storage, used as a distributed, in-memory key–value database, cache and message broker, with optional durability
TuneD	0.6				1		1	Tuned is a daemon that uses udev to monitor connected devices and statically and dynamically tunes system settings according to a selected profile
Vault	0.6					1	1	Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets critical in modern computing
ajv	0.6					2	2	ajv (Another JSON Schema Validator) is a high-performance JavaScript library for validating JSON data against JSON Schema specifications, widely used in Node.js applications and APIs.
gdk-pixbuf	0.6				2		2	gdk-pixbuf is an open source image loading and manipulation library used primarily in GNOME-based applications for handling various image formats, including JPEG, PNG, and GIF.
libheif	0.6				1	2	3	libheif is an open source HEIF and AVIF image file format decoder and encoder library, supporting modern image codecs and container features.
libxml2	0.6			2	7		9	libxml2 is an XML toolkit implemented in C, originally developed for the GNOME Project
pgAdmin	0.6			1			1	pgAdmin is the most popular and feature rich Open Source administration and development platform for PostgreSQL, the most advanced Open Source database in the world
strongSwan	0.6				7	2	9	strongSwan is an open source IPsec-based VPN solution that provides secure network connectivity using IKEv1 and IKEv2 protocols, widely used on Linux systems for site-to-site and remote access VPN deployments.
wpa_supplicant	0.6				1		1	wpa_supplicant is a free software implementation of an IEEE 802.11i supplicant for Linux, FreeBSD, NetBSD, QNX, AROS, Microsoft Windows, Solaris, OS/2 (including ArcaOS and eComStation) and Haiku
.NET	0.5			1	3		4	Product detected by a:microsoft:.net (exists in CPE dict)
389 Directory Server	0.5		1	3	2		6	389 Directory Server is a highly usable, fully featured, reliable and secure LDAP server implementation
Ant	0.5				1		1	Product detected by a:apache:ant (exists in CPE dict)
Cockpit	0.5				1		1	Cockpit is a web-based server administration tool for Linux systems that allows users to manage servers, containers, storage, and network configurations through a browser interface.
CommonMark	0.5			1	3		4	Product detected by a:thephpleague:commonmark (exists in CPE dict)
Crypto	0.5				2		2	Product detected by a:golang:crypto (exists in CPE dict)
Curl	0.5		5	2			7	Product detected by a:haxx:curl (exists in CPE dict)
DOMPurify	0.5				1		1	DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG
Elasticsearch	0.5				2		2	Product detected by a:elastic:elasticsearch (exists in CPE dict)
FRRouting	0.5					1	1	FRRouting (FRR) is an IP routing protocol suite for Linux and Unix platforms, supporting BGP, OSPF, RIP, IS-IS, and other routing protocols for network infrastructure.
FreeMarker	0.5				1		1	Product detected by a:apache:freemarker (exists in CPE dict)
GIMP	0.5		1	2	7		10	GIMP is an open-source image manipulation program used for photo editing, graphic design, and digital art creation.
GPU Display Driver	0.5				11		11	Product detected by a:nvidia:gpu_display_driver (exists in CPE dict)
GitPython	0.5		4	9			13	Product detected by a:gitpython_project:gitpython (exists in CPE dict)
Hostapd	0.5				1	1	2	Product detected by a:w1.fi:hostapd (exists in CPE dict)
IMAP	0.5				2	3	5	Product detected by a:cyrus:imap (exists in CPE dict)
Kamailio	0.5			2	1		3	Kamailio is an open-source SIP server used for building scalable VoIP, instant messaging, and real-time communications systems.
KeePass	0.5			1			1	KeePass is a free open source password manager, which helps you to manage your passwords in a secure way
LXD	0.5		1				1	Product detected by a:canonical:lxd (exists in CPE dict)
Libraw	0.5			1			1	Product detected by a:libraw:libraw (exists in CPE dict)
Morgan	0.5					2	2	Product detected by a:morgan_project:morgan (exists in CPE dict)
NGINX	0.5			1	3		4	Nginx is an open-source web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache
NVIDIA GPU Display Driver	0.5				1		1	A NVIDIA driver is a software program that enables communication between your computer and the NVIDIA graphics processor installed in your system
Nodemailer	0.5			3	3	2	8	Nodemailer is a Node.js module for sending email, supporting SMTP, message composition, attachments, and multiple transport mechanisms.
NumPy	0.5		1				1	NumPy is a library for the Python programming language, adding support for large, multi-dimensional arrays and matrices, along with a large collection of high-level mathematical functions
OpenEXR	0.5			5	13		18	OpenEXR is an open source high-dynamic-range image file format and reference implementation widely used in computer graphics, visual effects, animation, and motion picture production.
OpenNLP	0.5				1		1	Product detected by a:apache:opennlp (exists in CPE dict)
OpenTelemetry	0.5				4		4	OpenTelemetry is a collection of APIs, SDKs, and tools. Use it to instrument, generate, collect, and export telemetry data (metrics, logs and traces) to help you analyze your software's performance and behavior
Pcre2	0.5			4	1	1	6	Product detected by a:pcre:pcre2 (exists in CPE dict)
Pypdf	0.5			3		1	4	PyPDF is a Python library for reading, manipulating, and writing PDF files, including extraction, splitting, merging, and encryption features.
RDF4J	0.5			1			1	Product detected by a:eclipse:rdf4j (exists in CPE dict)
SPIP	0.5	1		1	2		4	SPIP is an open-source software content management system designed for web site publishing, oriented towards online collaborative editing
Suricata	0.5				6	2	8	Suricata is an open-source intrusion detection and prevention system (IDS/IPS) and network security monitoring engine that supports deep packet inspection and threat detection.
TLS	0.5			1	8	1	10	TLS
Thunderbird	0.5				5		5	Product detected by a:mozilla:thunderbird (exists in CPE dict)
TimescaleDB	0.5				3		3	Product detected by a:timescale:timescaledb (exists in CPE dict)
Traefik	0.5		1	2	4		7	Product detected by a:traefik:traefik (exists in CPE dict)
Visual Studio 2022	0.5				4		4	Product detected by a:microsoft:visual_studio_2022 (exists in CPE dict)
Xeon Bronze 3408U	0.5				3		3	Product detected by h:intel:xeon_bronze_3408u (exists in CPE dict)
Znuny	0.5				1		1	Znuny/Znuny LTS is a fork of the ((OTRS)) Community Edition, one of the most flexible web-based ticketing systems used for Customer Service, Help Desk, IT Service Management
authelia	0.5			1			1	Product detected by a:authelia:authelia (exists in CPE dict)
canvg	0.5		1				1	Product detected by a:canvg:canvg (does NOT exist in CPE dict)
dart_software_development_kit	0.5				1		1	Product detected by a:dart:dart_software_development_kit (exists in CPE dict)
fast-uri	0.5				4	2	6	Product detected by a:openjsf:fast-uri (does NOT exist in CPE dict)
gobgp	0.5			1			1	Product detected by a:osrg:gobgp (does NOT exist in CPE dict)
haproxy	0.5			1			1	Product detected by a:haproxy:haproxy (exists in CPE dict)
helm	0.5			1			1	Product detected by a:helm:helm (exists in CPE dict)
libevent	0.5		1	6	1		8	libevent is a portable event notification library that provides an asynchronous event loop and networking primitives for applications using sockets, timers, signals, DNS, and HTTP.
libexpat	0.5				2		2	Product detected by a:libexpat_project:libexpat (exists in CPE dict)
libmongocrypt	0.5				1		1	Product detected by a:mongodb:libmongocrypt (exists in CPE dict)
n8n	0.5			1			1	Product detected by a:n8n:n8n (exists in CPE dict)
nltk	0.5		1	22	1		24	Product detected by a:nltk:nltk (exists in CPE dict)
nokogiri	0.5				2	1	3	Product detected by a:nokogiri:nokogiri (exists in CPE dict)
nsd	0.5			1	2		3	Product detected by a:nlnetlabs:nsd (exists in CPE dict)
onnx	0.5			1			1	Product detected by a:linuxfoundation:onnx (exists in CPE dict)
openCryptoki	0.5			1			1	Product detected by a:opencryptoki_project:opencryptoki (exists in CPE dict)
openssl	0.5				1		1	Product detected by a:openssl:openssl (exists in CPE dict)
tesseract_ocr	0.5			7	1		8	Product detected by a:tesseract-ocr:tesseract_ocr (does NOT exist in CPE dict)
trivy	0.5				1		1	Product detected by a:aquasec:trivy (does NOT exist in CPE dict)
undici	0.5				9	2	11	Product detected by a:nodejs:undici (exists in CPE dict)
wolfSSL	0.5			1			1	wolfSSL is a small, portable, embedded SSL/TLS library targeted for use by embedded systems developers
xeon_6315p	0.5				1		1	Product detected by h:intel:xeon_6315p (does NOT exist in CPE dict)
Apache Tika	0.4				1		1	Apache Tika is an open source content analysis toolkit that detects and extracts metadata and structured text content from a wide range of file formats such as PDF, Microsoft Office, and multimedia files.
Azure	0.4					1	1	Azure
Erlang/OTP	0.4				6	3	9	Erlang/OTP is a set of libraries for the Erlang programming language
Flatpak	0.4				1		1	Flatpak is a utility for software deployment and package management for Linux
GPAC	0.4			1	4		5	GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity)
GVfs	0.4				4	1	5	GVfs (GNOME Virtual File System) is userspace virtual filesystem software for GNOME that provides backends (including FTP) to access different remote and local file systems transparently.
Git	0.4				1		1	Git
Horde IMP	0.4			1			1	IMP is the Internet Messaging Program. It is written in PHP and provides webmail access to IMAP and POP3 accounts. It uses the best-of-class Horde/Imap_Client library to provide fast, robust connections to the remote IMAP/POP3 server.
Net-SNMP	0.4			1			1	Net-SNMP is a suite of applications and libraries implementing the Simple Network Management Protocol (SNMP), used for monitoring and managing networked systems and devices.
Spring Framework	0.4			1	10	2	13	The Spring Framework is an application framework and inversion of control container for the Java platform
U-Boot	0.4			2			2	Das U-Boot (U-Boot) is an open-source universal boot loader used on many embedded boards and SoCs to initialize hardware, provide low-level diagnostics, and load an operating system kernel. It is implemented primarily in C with board-specific assembly.
Oj	0.35				1		1	Oj (Optimized JSON) is a high-performance JSON parser and object serialization library packaged as a Ruby gem, designed to provide fast JSON encoding and decoding for Ruby applications.
JOSE	0.3				3	1	4	JavaScript module for JSON Object Signing and Encryption (JOSE)
WeasyPrint	0.3				1		1	Python library to generate PDF documents from HTML/CSS
gitoxide	0.3			1	4	3	8	gitoxide is an idiomatic, lean, fast & safe pure Rust implementation of Git, designed for correctness and performance, available both as a Rust library (gix crate) and command-line interface tools.
zstd-jni	0.25			4	5		9	zstd-jni provides Java Native Interface bindings for the Zstandard lossless compression library, enabling high-performance compression and decompression from Java, Android, and other JVM languages.
GitHub	0.2					1	1	GitHub, Inc. is an Internet hosting service for software development and version control using Git
Incus	0.2			3			3	Incus is an open source system container and virtual machine manager used to create, manage, and operate Linux containers and virtual machines.
libtiff	0.2			1	2	1	4	libtiff is a widely used library for reading and writing TIFF (Tagged Image File Format) files, offering tools like tiff2ps.
Fast DDS	0.15			2			2	eProsima Fast DDS is a C++ implementation of the OMG Data Distribution Service (DDS) and RTPS protocols, providing high-performance publish-subscribe middleware for distributed and real-time systems.
kin-openapi	0.12			2	1	1	4	kin-openapi is a Go library for parsing, converting, validating, and working with OpenAPI and Swagger specifications and for validating HTTP requests and responses against OpenAPI schemas.
WebOb	0.1			1			1	WebOb is a Python library that provides objects for HTTP requests and responses, commonly used by Python web frameworks and applications.
libtpms	0.08			1			1	libtpms is a software library implementing a TPM 1.2 and TPM 2.0 emulator, commonly used by virtualization and software TPM components such as swtpm.
Unknown Product	0				137	199	336	Unknown Product

Vulnerability Type	Criticality	U	C	H	M	L	A
Remote Code Execution	1.0	4	21	255	45		325
Authentication Bypass	0.98	2	5	28	37		72
Code Injection	0.97		3	6	7		16
Command Injection	0.97		3	3	7		13
XXE Injection	0.97			1	2		3
Arbitrary File Writing	0.95			2	1		3
Security Feature Bypass	0.9		15	53	146	1	215
Server-Side Request Forgery	0.87		1	6	11	1	19
Elevation of Privilege	0.85		1	5	8	1	15
Arbitrary File Reading	0.83			8	2		10
Information Disclosure	0.83			33	106	2	141
Cross Site Scripting	0.8		3	6	12		21
Open Redirect	0.75			1	3	1	5
Denial of Service	0.7		2	52	184	19	257
Path Traversal	0.7			13	17		30
Incorrect Calculation	0.5			3	24	4	31
Memory Corruption	0.5		1	68	316	36	421
Spoofing	0.4			6	21	1	28
Unknown Vulnerability Type	0				501	527	1028

Source	U	C	H	M	L	A
almalinux		1	15	8	1	25
altlinux	5	31	359	559	104	1058
debian	3	49	495	1215	531	2293
oraclelinux		2	27	123	39	191
redhat			14	8	1	23
redos		5	23	55	21	104
ubuntu		1	17	32	11	61

Urgent (6)

1. Remote Code Execution - Gitea (CVE-2026-60004) - Urgent [958]

Description: Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

altlinux: CVE-2026-60004 was patched at 2026-08-27, 2026-08-29, 2026-09-04

2. Authentication Bypass - Gitea (CVE-2026-20896) - Urgent [942]

Description: Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

altlinux: CVE-2026-20896 was patched at 2026-08-27, 2026-08-29, 2026-09-04

3. Authentication Bypass - Keycloak (CVE-2026-18963) - Urgent [939]

Description: A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

altlinux: CVE-2026-18963 was patched at 2026-08-20, 2026-08-26, 2026-08-28

4. Remote Code Execution - Chromium (CVE-2026-85046) - Urgent [919]

Description: Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

altlinux: CVE-2026-85046 was patched at 2026-09-05

debian: CVE-2026-85046 was patched at 2026-09-05, 2026-09-16

5. Remote Code Execution - Chromium (CVE-2026-87491) - Urgent [907]

Description: Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

altlinux: CVE-2026-87491 was patched at 2026-09-17

debian: CVE-2026-87491 was patched at 2026-09-16

6. Remote Code Execution - SPIP (CVE-2026-77806) - Urgent [904]

Description: SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.

debian: CVE-2026-77806 was patched at 2026-08-21, 2026-08-25

Critical (55)

7. Authentication Bypass - PHP (CVE-2026-55584) - Critical [701]

Description: phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticated attacker can supply an allowed address in one of these headers to impersonate a trusted client and access exposed hostname, kernel, CPU, memory, filesystem, and network-interface information. This issue is fixed in version 3.4.6.

debian: CVE-2026-55584 was patched at 2026-09-16

8. Remote Code Execution - Chromium (CVE-2026-78904) - Critical [680]

Description: Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

altlinux: CVE-2026-78904 was patched at 2026-08-28

debian: CVE-2026-78904 was patched at 2026-09-03, 2026-09-16

9. Remote Code Execution - PHP (CVE-2026-56705) - Critical [680]

Description: Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.

debian: CVE-2026-56705 was patched at 2026-09-16

10. Authentication Bypass - FreeIPA (CVE-2026-76578) - Critical [677]

Description: A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

altlinux: CVE-2026-76578 was patched at 2026-09-07

debian: CVE-2026-76578 was patched at 2026-09-16

11. Remote Code Execution - Chromium (CVE-2026-78905) - Critical [669]

Description: Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

altlinux: CVE-2026-78905 was patched at 2026-08-28

debian: CVE-2026-78905 was patched at 2026-09-03, 2026-09-16

12. Remote Code Execution - Chromium (CVE-2026-87528) - Critical [669]

Description: Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

altlinux: CVE-2026-87528 was patched at 2026-09-17

debian: CVE-2026-87528 was patched at 2026-09-16

13. Remote Code Execution - NumPy (CVE-2026-79657) - Critical [666]

Description: NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading.

debian: CVE-2026-79657 was patched at 2026-09-16

14. Authentication Bypass - Curl (CVE-2026-19931) - Critical [663]

Description: A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.

altlinux: CVE-2026-19931 was patched at 2026-09-02, 2026-09-07

debian: CVE-2026-19931 was patched at 2026-09-16

15. Remote Code Execution - Chromium (CVE-2026-78938) - Critical [657]

Description: Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

altlinux: CVE-2026-78938 was patched at 2026-08-28

debian: CVE-2026-78938 was patched at 2026-09-03, 2026-09-16

16. Remote Code Execution - PHP (CVE-2026-56702) - Critical [657]

Description: Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.

debian: CVE-2026-56702 was patched at 2026-09-16

17. Remote Code Execution - SQLite (CVE-2026-56703) - Critical [652]

Description: Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.

debian: CVE-2026-56703 was patched at 2026-09-16

18. Server-Side Request Forgery - Gitea (CVE-2026-22874) - Critical [649]

Description: Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

altlinux: CVE-2026-22874 was patched at 2026-08-27, 2026-08-29, 2026-09-04

19. Remote Code Execution - FreeRDP (CVE-2026-63633) - Critical [647]

Description: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context->common.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.

almalinux: CVE-2026-63633 was patched at 2026-08-31

debian: CVE-2026-63633 was patched at 2026-08-25

oraclelinux: CVE-2026-63633 was patched at 2026-09-01

20. Remote Code Execution - Chromium (CVE-2026-79266) - Critical [645]

Description: Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)

altlinux: CVE-2026-79266 was patched at 2026-08-28

debian: CVE-2026-79266 was patched at 2026-09-03, 2026-09-16

21. Code Injection - xmldom (CVE-2026-83609) - Critical [643]

Description: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.

debian: CVE-2026-83609 was patched at 2026-09-16

22. Code Injection - xmldom (CVE-2026-83616) - Critical [643]

Description: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8.x. Because serialization emits <?target data?>, a target containing >, ?, whitespace, or another invalid XML-name character can break the processing-instruction boundary and inject XML structure. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

debian: CVE-2026-83616 was patched at 2026-09-16

23. Code Injection - xmldom (CVE-2026-83618) - Critical [643]

Description: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteral_match and SystemLiteral_match expressions produced by reg() in lib/grammar.js, which inherit the multiline flag. A complete valid literal on the first line can therefore satisfy the matcher while U+000A, U+000D, U+2028, or U+2029 and breakout markup remain in the emitted <!DOCTYPE ...> declaration. This bypasses the strict-serialization mitigation for the earlier DocumentType injection advisory; creation and direct property assignment remain unvalidated by design. This issue is fixed in @xmldom/xmldom version 0.9.12.

debian: CVE-2026-83618 was patched at 2026-09-16

24. Remote Code Execution - LXD (CVE-2026-66897) - Critical [642]

Description: A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution.

debian: CVE-2026-66897 was patched at 2026-09-16

25. Remote Code Execution - canvg (CVE-2025-25977) - Critical [642]

Description: An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.

debian: CVE-2025-25977 was patched at 2026-08-25

26. Command Injection - PHP (CVE-2026-84361) - Critical [639]

Description: Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

debian: CVE-2026-84361 was patched at 2026-09-16

27. Remote Code Execution - GitPython (CVE-2026-76218) - Critical [630]

Description: GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.

altlinux: CVE-2026-76218 was patched at 2026-09-01

debian: CVE-2026-76218 was patched at 2026-08-20

redos: CVE-2026-76218 was patched at 2026-09-02

28. Remote Code Execution - GitPython (CVE-2026-76220) - Critical [630]

Description: GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.

altlinux: CVE-2026-76220 was patched at 2026-09-01

debian: CVE-2026-76220 was patched at 2026-08-20

redos: CVE-2026-76220 was patched at 2026-09-01

29. Remote Code Execution - GitPython (CVE-2026-78676) - Critical [630]

Description: GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.

altlinux: CVE-2026-78676 was patched at 2026-09-01

debian: CVE-2026-78676 was patched at 2026-08-25

redos: CVE-2026-78676 was patched at 2026-09-08

30. Remote Code Execution - nltk (CVE-2026-79675) - Critical [630]

Description: NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.

debian: CVE-2026-79675 was patched at 2026-09-16

31. Security Feature Bypass - Gitea (CVE-2026-58424) - Critical [630]

Description: Permanent Fork PR Workflow Approval Gate Bypass

altlinux: CVE-2026-58424 was patched at 2026-08-27, 2026-08-29, 2026-09-04

32. Authentication Bypass - Traefik (CVE-2026-53622) - Critical [627]

Description: Traefik is an HTTP reverse proxy and load balancer. Versions prior to 3.7.3, 3.6.18, and 2.11.51 have a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact, case-sensitive lookup on the SNI value, which fails to match wildcard host patterns (e.g., *.example.com) or case variants of the configured hostname. Because the handshake falls back to the default TLS configuration — which may not require client certificates — a client can complete the QUIC handshake without presenting a certificate, while the subsequent HTTP routing layer still dispatches the request to a backend protected by a router-specific mTLS policy. The issue affects deployments where HTTP/3 is enabled, a router uses a wildcard Host rule or case-insensitive hostname matching, a router-specific TLSOptions enforces client certificate authentication, and UDP access to the entrypoint is reachable by an attacker. This vulnerability is fixed in versions 3.7.3, 3.6.18, and 2.11.51.

altlinux: CVE-2026-53622 was patched at 2026-09-15, 2026-09-16

33. Remote Code Execution - Windows Kernel (CVE-2026-78680) - Critical [626]

Description: NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can exploit bare-name binary resolution on Windows via the current working directory or on Unix-like systems via relative PATH entries to execute their binary instead of the legitimate Graphviz tool.

debian: CVE-2026-78680 was patched at 2026-08-25

34. Remote Code Execution - Chromium (CVE-2026-85045) - Critical [621]

Description: Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

altlinux: CVE-2026-85045 was patched at 2026-09-05

debian: CVE-2026-85045 was patched at 2026-09-05, 2026-09-16

35. Remote Code Execution - GitPython (CVE-2026-76221) - Critical [619]

Description: GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.

altlinux: CVE-2026-76221 was patched at 2026-09-01

debian: CVE-2026-76221 was patched at 2026-08-20

redos: CVE-2026-76221 was patched at 2026-09-01

36. Security Feature Bypass - Gitea (CVE-2026-58433) - Critical [619]

Description: Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

altlinux: CVE-2026-58433 was patched at 2026-08-27, 2026-08-29, 2026-09-04

redos: CVE-2026-58433 was patched at 2026-08-20

37. Command Injection - Netty (CVE-2026-89044) - Critical [616]

Description: Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.

debian: CVE-2026-89044 was patched at 2026-09-16

38. Denial of Service - Expat (CVE-2026-66046) - Critical [615]

Description: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

debian: CVE-2026-66046 was patched at 2026-08-20

39. Denial of Service - RPC (CVE-2026-84304) - Critical [615]

Description: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.

debian: CVE-2026-84304 was patched at 2026-09-16

40. Security Feature Bypass - Chromium (CVE-2026-87606) - Critical [615]

Description: Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

altlinux: CVE-2026-87606 was patched at 2026-09-17

debian: CVE-2026-87606 was patched at 2026-09-16

41. Cross Site Scripting - xmldom (CVE-2026-83605) - Critical [613]

Description: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not validate them, so a crafted name can terminate the intended attribute and inject additional attributes, including event handlers, into browser-consumed output; synthesized xmlns:PREFIX declarations expose the same unchecked-name boundary. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.

debian: CVE-2026-83605 was patched at 2026-09-16

42. Cross Site Scripting - xmldom (CVE-2026-83607) - Critical [613]

Description: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controlled tag names could inject attributes, elements, or processing instructions into serialized XML or HTML and could cause cross-site scripting when browser-consumed. The unchecked values violate the XML QName constraint, and default serialization and creation-time createElement() behavior remain permissive. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.

debian: CVE-2026-83607 was patched at 2026-09-16

43. Cross Site Scripting - xmldom (CVE-2026-83617) - Critical [613]

Description: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produced by reg() in lib/grammar.js, which inherits the multiline flag. A name with a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup therefore passes validation and is emitted verbatim in element start and end tags or attribute names. This bypasses the strict-serialization checks introduced for the earlier element-name and attribute-name injection advisories, while the default serialization path remains outside the strict guarantee. This issue is fixed in @xmldom/xmldom version 0.9.12.

debian: CVE-2026-83617 was patched at 2026-09-16

44. Security Feature Bypass - Curl (CVE-2026-80231) - Critical [613]

Description: A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.

altlinux: CVE-2026-80231 was patched at 2026-09-02, 2026-09-07

45. Security Feature Bypass - libevent (CVE-2026-63382) - Critical [613]

Description: Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

debian: CVE-2026-63382 was patched at 2026-08-25, 2026-09-11

ubuntu: CVE-2026-63382 was patched at 2026-09-01, 2026-09-16

46. Elevation of Privilege - util-linux (CVE-2026-76642) - Critical [611]

Description: util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.

debian: CVE-2026-76642 was patched at 2026-09-16

47. Remote Code Execution - Chromium (CVE-2026-87533) - Critical [609]

Description: Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

altlinux: CVE-2026-87533 was patched at 2026-09-17

debian: CVE-2026-87533 was patched at 2026-09-16

48. Memory Corruption - Linux Kernel (CVE-2026-74586) - Critical [608]

Description: In the Linux kernel, the following vulnerability has been resolved: sctp: clear new_transport when removing a peer sctp_process_asconf_param() stores a newly added peer transport in asoc->new_transport. After all parameters in the ASCONF chunk have been processed, sctp_sf_do_asconf() uses this pointer to send a HEARTBEAT to the new transport. An authenticated ASCONF from a remote SCTP peer can add a transport and remove it again with a wildcard DEL-IP parameter in the same chunk. The wildcard deletion preserves the transport on which the ASCONF arrived, but removes the newly added transport through sctp_assoc_del_nonprimary_peers(). The removal does not clear asoc->new_transport, leaving it pointing to the removed transport. sctp_sf_do_asconf() then creates a HEARTBEAT whose chunk->transport points to the removed transport without holding a transport reference. During local address replacement, src_out_of_asoc_ok keeps this HEARTBEAT on control_chunk_list. After the transport is freed by RCU, a successful ASCONF_ACK for the replacement address releases the queued HEARTBEAT and sctp_outq_select_transport() reads the freed transport's state. The issue was found during a static audit of SCTP objects. With an authenticated peer, the reproducer triggered the same KASAN report in 2 of 2 unpatched runs on a KASAN-enabled netdev/main kernel: BUG: KASAN: slab-use-after-free in sctp_outq_select_transport Read of size 4 at addr ffff88800b9bd95c by task python3/197 Call Trace: sctp_outq_select_transport+0x549/0x8b0 [sctp] sctp_outq_flush+0x306/0x2c60 [sctp] sctp_transport_immediate_rtx+0xaf/0x260 [sctp] sctp_process_asconf_ack+0xa48/0xf70 [sctp] Allocated by task 197: sctp_transport_new+0x68/0x650 [sctp] sctp_assoc_add_peer+0x258/0x12a0 [sctp] sctp_process_asconf+0x5e9/0x1090 [sctp] Last potentially related work creation: __call_rcu_common.constprop.0+0x77/0xb70 sctp_assoc_del_nonprimary_peers+0x7c/0xd0 [sctp] sctp_process_asconf+0xd9c/0x1090 [sctp] The first invalid access was a four-byte read of transport->state at net/sctp/outqueue.c:833. The same reproducer completed the full authenticated ASCONF and local-address replacement sequence with this change without a KASAN report or oops. Clear new_transport when its peer is removed, before it can be used to create the HEARTBEAT.

debian: CVE-2026-74586 was patched at 2026-08-25

oraclelinux: CVE-2026-74586 was patched at 2026-09-04

49. Remote Code Execution - GIMP (CVE-2026-59087) - Critical [607]

Description: A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker to write several kilobytes of controlled data beyond the intended memory buffer. Such an overflow can result in memory corruption, potentially leading to arbitrary code execution or a denial of service.

altlinux: CVE-2026-59087 was patched at 2026-09-14

50. Authentication Bypass - Curl (CVE-2026-13608) - Critical [603]

Description: A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.

altlinux: CVE-2026-13608 was patched at 2026-09-02, 2026-09-07

debian: CVE-2026-13608 was patched at 2026-09-16

51. Security Feature Bypass - Chromium (CVE-2026-87441) - Critical [603]

Description: Missing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

altlinux: CVE-2026-87441 was patched at 2026-09-17

debian: CVE-2026-87441 was patched at 2026-09-16

52. Security Feature Bypass - Chromium (CVE-2026-87447) - Critical [603]

Description: Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: High)

altlinux: CVE-2026-87447 was patched at 2026-09-17

debian: CVE-2026-87447 was patched at 2026-09-16

53. Security Feature Bypass - Chromium (CVE-2026-87483) - Critical [603]

Description: Incorrect authorization in Browser in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

altlinux: CVE-2026-87483 was patched at 2026-09-17

debian: CVE-2026-87483 was patched at 2026-09-16

54. Security Feature Bypass - Chromium (CVE-2026-87503) - Critical [603]

Description: Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

altlinux: CVE-2026-87503 was patched at 2026-09-17

debian: CVE-2026-87503 was patched at 2026-09-16

55. Security Feature Bypass - Chromium (CVE-2026-87505) - Critical [603]

Description: Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)

altlinux: CVE-2026-87505 was patched at 2026-09-17

debian: CVE-2026-87505 was patched at 2026-09-16

56. Security Feature Bypass - Chromium (CVE-2026-87513) - Critical [603]

Description: Missing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

altlinux: CVE-2026-87513 was patched at 2026-09-17

debian: CVE-2026-87513 was patched at 2026-09-16

57. Security Feature Bypass - Chromium (CVE-2026-87535) - Critical [603]

Description: Information loss or omission in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

altlinux: CVE-2026-87535 was patched at 2026-09-17

debian: CVE-2026-87535 was patched at 2026-09-16

58. Security Feature Bypass - jackson-databind (CVE-2026-19032) - Critical [603]

Description: jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs; further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path from untrusted JSON should be avoided regardless of version.

debian: CVE-2026-19032 was patched at 2026-09-16

59. Command Injection - 389 Directory Server (CVE-2026-19843) - Critical [601]

Description: A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

altlinux: CVE-2026-19843 was patched at 2026-09-08, 2026-09-11

debian: CVE-2026-19843 was patched at 2026-09-16

60. Security Feature Bypass - Curl (CVE-2026-80230) - Critical [601]

Description: When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.

altlinux: CVE-2026-80230 was patched at 2026-09-02, 2026-09-07

debian: CVE-2026-80230 was patched at 2026-09-16

61. Security Feature Bypass - Curl (CVE-2026-80255) - Critical [601]

Description: A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

altlinux: CVE-2026-80255 was patched at 2026-09-02, 2026-09-07

debian: CVE-2026-80255 was patched at 2026-09-16

High (549)

62. Memory Corruption - Linux Kernel (CVE-2026-74581) - High [596]

Description: In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release(). Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.

almalinux: CVE-2026-74581 was patched at 2026-08-26, 2026-09-03

debian: CVE-2026-74581 was patched at 2026-08-25

oraclelinux: CVE-2026-74581 was patched at 2026-08-26, 2026-09-04, 2026-09-07

redhat: CVE-2026-74581 was patched at 2026-08-26, 2026-08-27, 2026-09-01, 2026-09-03

63. Memory Corruption - Linux Kernel (CVE-2026-80714) - High [596]

Description: In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connection flags from the destination into cp->flags. IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed, expiry can treat it as a one-packet connection and skip unlinking the existing conn_tab node, leaving stale hash nodes pointing at a freed struct ip_vs_conn. Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced connections.

debian: CVE-2026-80714 was patched at 2026-09-16

oraclelinux: CVE-2026-80714 was patched at 2026-09-04

64. Denial of Service - xmldom (CVE-2026-83613) - High [595]

Description: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode, while NamedNodeMap.setNamedItem in lib/dom.js calls the linear getNamedItem or getNamedItemNS lookup for each insertion. A well-formed element with many distinct attributes therefore requires quadratic comparisons during DOMParser.parseFromString() and can stall a Node.js event loop before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

debian: CVE-2026-83613 was patched at 2026-09-16

65. Denial of Service - xmldom (CVE-2026-83614) - High [595]

Description: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing quadratic reindexing and string rebuilding. The first path is reachable through default DOMParser.parseFromString() processing, while the second is also reachable through a direct normalize() call on a programmatically constructed DOM, and endDocument invokes that normalization after parsing. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

debian: CVE-2026-83614 was patched at 2026-09-16

66. Denial of Service - xmldom (CVE-2026-83615) - High [595]

Description: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses _copy to clone the complete currentNSMap for each nested element that declares a new namespace prefix. Keeping every ancestor map live on the parse stack creates quadratic peak namespace-map storage, so a small highly compressible XML document can exhaust the process heap before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

debian: CVE-2026-83615 was patched at 2026-09-16

67. Remote Code Execution - GitPython (CVE-2026-87817) - High [595]

Description: GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.

debian: CVE-2026-87817 was patched at 2026-09-16

68. Authentication Bypass - 389 Directory Server (CVE-2026-76560) - High [591]

Description: A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.

almalinux: CVE-2026-76560 was patched at 2026-09-08

altlinux: CVE-2026-76560 was patched at 2026-09-08, 2026-09-11

debian: CVE-2026-76560 was patched at 2026-09-16

oraclelinux: CVE-2026-76560 was patched at 2026-09-08, 2026-09-10

redhat: CVE-2026-76560 was patched at 2026-09-08

69. Information Disclosure - Chromium (CVE-2026-87629) - High [591]

Description: Incorrect authorization in Sources in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

altlinux: CVE-2026-87629 was patched at 2026-09-17

debian: CVE-2026-87629 was patched at 2026-09-16

70. Memory Corruption - OpenSSL (CVE-2026-80229) - High [591]

Description: When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.

altlinux: CVE-2026-80229 was patched at 2026-09-02, 2026-09-07

debian: CVE-2026-80229 was patched at 2026-09-16

71. Security Feature Bypass - Chromium (CVE-2026-87468) - High [591]

Description: Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

altlinux: CVE-2026-87468 was patched at 2026-09-17

debian: CVE-2026-87468 was patched at 2026-09-16

72. Security Feature Bypass - Chromium (CVE-2026-87475) - High [591]

Description: Missing authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

altlinux: CVE-2026-87475 was patched at 2026-09-17

debian: CVE-2026-87475 was patched at 2026-09-16

73. Security Feature Bypass - Chromium (CVE-2026-87493) - High [591]

Description: Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

altlinux: CVE-2026-87493 was patched at 2026-09-17

debian: CVE-2026-87493 was patched at 2026-09-16

74. Security Feature Bypass - Chromium (CVE-2026-87515) - High [591]

Description: Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

altlinux: CVE-2026-87515 was patched at 2026-09-17

debian: CVE-2026-87515 was patched at 2026-09-16

75. Security Feature Bypass - Chromium (CVE-2026-87532) - High [591]

Description: Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

altlinux: CVE-2026-87532 was patched at 2026-09-17

debian: CVE-2026-87532 was patched at 2026-09-16

76. Security Feature Bypass - Chromium (CVE-2026-87580) - High [591]

Description: Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

altlinux: CVE-2026-87580 was patched at 2026-09-17

debian: CVE-2026-87580 was patched at 2026-09-16

77. Security Feature Bypass - Chromium (CVE-2026-87584) - High [591]

Description: Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)