Section
Advisories
Vendor PSIRT bulletins, CERT notes, CISA and partner-agency alerts, and distribution security notices.
331 matching records, 4 with confirmed exploitation.
-
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-102895 GPUStack Improper Authentication Vulnerability CVE-2026-116779 SignalWire…
-
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-19868 SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability This…
-
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-119977 WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability…
-
Linux kernel vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - USB Gadget drivers; - Memory management…
-
Linux kernel vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - USB Gadget drivers; - Memory management…
-
Apache HTTP Server vulnerabilities
Zhang San, Ankit Prateek, Zhen Kong, SeungHyun Cho, Ryoma Nishioka, Keita Sode and Hyojae Lee discovered that Apache HTTP Server did not correctly handle certain memory operations. An attacker could possibly use this issue to…
-
OpenJDK 21 vulnerabilities
It was discovered that the Security component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE…
-
OpenJDK 17 vulnerabilities
It was discovered that the Security component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE…
-
OpenJDK 8 vulnerabilities
It was discovered that the Security component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component…
-
OpenJDK 11 vulnerabilities
It was discovered that the Security component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE…
-
pyasn1 vulnerabilities
It was discovered that pyasn1 did not properly bound the size of long-form tag identifiers when parsing BER, CER, or DER encoded data. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data…
-
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2024-27834 Apple Multiple Products Improper Authentication Vulnerability This type of…
-
Important: dnsmasq security, bug fix, and enhancement update
An update for dnsmasq is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as…
-
Important: dnsmasq security, bug fix, and enhancement update
An update for dnsmasq is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this…
-
Linux kernel vulnerabilities
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an…
-
Linux kernel vulnerabilities
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an…
-
Linux kernel (Azure) vulnerabilities
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an…
-
Linux kernel (Raspberry Pi) vulnerabilities
Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service…
-
CVE-2026-124034, CVE-2026-124035: Issues with Amazon Braket SDK
Bulletin ID: 2026-175-AWS Publication Date: 11/09/2026 14:15 PM PST Description: Amazon Braket SDK is an open source Python library that customers use to run quantum tasks and hybrid jobs on Amazon Braket. We identified…
-
Fetchmail vulnerabilities
Christian Herdtweck discovered that Fetchmail incorrectly handled certain long log messages. A remote attacker could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service. This issue only affected…
-
Important: OpenShift Container Platform 4.14.78 packages and security update
Red Hat OpenShift Container Platform release 4.14.78 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container…
-
Critical: OpenShift Container Platform 4.14.78 bug fix and security update
Red Hat OpenShift Container Platform release 4.14.78 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container…
-
Critical: OpenShift Container Platform 5.0.1 bug fix and security update
Red Hat OpenShift Container Platform release 5.0.1 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform…
-
Moderate: patch security update
An update for patch is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a…
-
Cisco Identity Services Engine Authorization Bypass Vulnerability
A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to obtain an endpoint identity certificate.…
-
Chromium CVE-2026-76028: Use after free
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-76029: Memory corruption
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-76024: Memory corruption
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-76025: Use after free
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-76031: Use after free
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-76026: Memory corruption
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-76030: Memory corruption
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-76027: Memory corruption
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-118321: Use after free
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-119268: Integer overflow
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-119269: Use after free
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-119264: Memory corruption
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-119265: Memory corruption
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-119266: Use after free
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-119267: Memory corruption
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-119260: Use after free
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-119261: Improper input validation
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-119262: Improper input validation
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-119263: Memory corruption
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-119272: Out of bounds read
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-119271: Use after free
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-119270: Improper input validation
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
PrestaShop Performance Debug Configuration Contains a PHP Code Injection Vulnerability
Overview PrestaShop's back-office Performance > Debug mode functionality contains a PHP code injection vulnerability. An authenticated attacker with permission to modify debug-mode configuration can submit crafted cookie…
-
Linux kernel vulnerabilities
Pengfei Wang discovered that the Turtle Beach MultiSound audio device driver in the Linux kernel contained race conditions when fetching from the ring-buffer, leading to an out-of-bounds access. A local attacker could use this to…
-
Linux kernel (AWS) vulnerabilities
Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain…
-
Linux kernel vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - GPU drivers; - Ethernet bonding driver…
-
Linux kernel vulnerabilities
Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain…
-
Chrome for Android Update
Hi, everyone! We've just released Chrome 157 (157.0.8103.50) for Android. It'll become available on Google Play over the next few days. This release includes stability and performance improvements. You can see a full list of the…
-
CVE-2026-124033 - Relative path traversal in the log export commands in AWS ParallelCluster CLI
Bulletin ID: 2026-174-AWS Publication Date: 11/09/2026 13:00 PM PST Description: AWS ParallelCluster CLI is an open source command line tool, distributed on PyPI as aws-parallelcluster. We identified CVE-2026-124033, an issue…
-
Important: Red Hat JBoss Web Server 6.2.6 release and security update
Red Hat JBoss Web Server 6.2.6 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important.…
-
Important: Red Hat JBoss Web Server 6.2.6 release and security update
Red Hat JBoss Web Server 6.2.6 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has rated this update as having a…
-
Important: cockpit security update
An update for cockpit is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives…
-
Moderate: ruby security, bug fix, and enhancement update
An update for ruby is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a…
-
Important: nodejs:24 security update
An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score…
-
Important: nodejs:22 security, bug fix, and enhancement update
An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score…
-
Important: nodejs-nodemon security update
An update for nodejs-nodemon is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score…
-
Critical: edk2 security update
An update for edk2 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a…
-
Important: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring…
-
ca-certificates update
USN-9001-1 fixed a vulnerability in ca-certificates, ca-certificates-java. This update provides the corresponding fix for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that the…
-
Important: tesseract security update
An update for tesseract is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as…
-
HAProxy regression
USN-8972-1 fixed vulnerabilities in HAProxy. On Ubuntu 22.04 LTS, the update caused a regression when processing certain chunked requests. This update fixes the problem. We apologize for the inconvenience. Original advisory…
-
HAProxy vulnerabilities
It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service.…
-
Linux kernel (NVIDIA) vulnerabilities
It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an…
-
nginx vulnerabilities
USN-8955-1 fixed vulnerabilities in nginx in Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. This update provides the corresponding update for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, and…
-
Stable Channel Update for Desktop
The Chrome team is delighted to announce the promotion of Chrome 157 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 157.0.8103.38 (Linux) 157.0.8103.38/.39 Windows/Mac…
-
Bind vulnerabilities
It was discovered that Bind incorrectly handled certain DNS messages with repeated singleton records such as SOA, CNAME, or DNAME records. A remote attacker could possibly use this issue to cause Bind to use excessive memory…
-
Important: Red Hat build of Keycloak 26.6.9 Images Security Update
New images are available for Red Hat build of Keycloak 26.6.9 and Red Hat build of Keycloak 26.6.9 Operator, running on OpenShift Container Platform
-
Important: Red Hat build of Keycloak 26.6.9 Security Update
New Red Hat build of Keycloak 26.6.9 packages are available from the Customer Portal
-
CVE-2026-109518 - APT package manager that affects Ubuntu and Debian operating systems
Bulletin ID: 2026-172-AWS Publication Date: 11/05/2026 20:00 PM PST Description: An issue in the APT package manager (CVE-2026-109518) affects Ubuntu and Debian operating systems. Under specific conditions, when APT is configured…
-
Chromium CVE-2026-118314: Incorrect reference resolution
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Chromium CVE-2026-118309: Incorrect reference resolution
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
-
Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated…
-
Important: OpenShift Container Platform 4.18.60 packages and security update
Red Hat OpenShift Container Platform release 4.18.60 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container…
-
Critical: OpenShift Container Platform 4.19.55 bug fix and security update
Red Hat OpenShift Container Platform release 4.19.55 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container…
-
Critical: OpenShift Container Platform 4.20.46 bug fix and security update
Red Hat OpenShift Container Platform release 4.20.46 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container…
-
Critical: OpenShift Container Platform 4.21.42 bug fix and security update
Red Hat OpenShift Container Platform release 4.21.42 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container…
-
Important: OpenShift Container Platform 4.16.75 bug fix and security update
Red Hat OpenShift Container Platform release 4.16.75 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container…
-
Important: OpenShift Container Platform 4.16.75 packages and security update
Red Hat OpenShift Container Platform release 4.16.75 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container…
-
Security update: watchOS 26.6.1
Apple published security content for watchOS 26.6.1 (Apple Watch Series 6, Apple Watch Series 7, Apple Watch Series 8, Apple Watch SE (2nd generation), and Apple Watch Ultra). The advisory lists the CVE entries fixed in this…
-
Security update: watchOS 27.2.1
Apple published security content for watchOS 27.2.1 (Apple Watch Series 9 and later). The advisory lists the CVE entries fixed in this release.
-
Security update: macOS Golden Gate 27.2.1
Apple published security content for macOS Golden Gate 27.2.1 (macOS Golden Gate). The advisory lists the CVE entries fixed in this release.
-
Security update: macOS Tahoe 26.7.3
Apple published security content for macOS Tahoe 26.7.3 (macOS Tahoe). The advisory lists the CVE entries fixed in this release.
-
Security update: macOS Sequoia 15.8.3
Apple published security content for macOS Sequoia 15.8.3 (macOS Sequoia). The advisory lists the CVE entries fixed in this release.
-
Security update: iOS 26.7.3 and iPadOS 26.7.3
Apple published security content for iOS 26.7.3 and iPadOS 26.7.3 (iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th…
-
Security update: iOS 18.7.12 and iPadOS 18.7.12
Apple published security content for iOS 18.7.12 and iPadOS 18.7.12 (iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation). The advisory lists the CVE entries fixed in this release.
-
Security update: iOS 27.2.1 and iPadOS 27.2.1
Apple published security content for iOS 27.2.1 and iPadOS 27.2.1 (iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th…
-
Security update: visionOS 27.2.1
Apple published security content for visionOS 27.2.1 (Apple Vision Pro (all models)). The advisory lists the CVE entries fixed in this release.
-
libsoup regression
USN-8890-1 fixed vulnerabilities in libsoup. Unfortunately, that update introduced a memory leak in the cookie jar and could introduce a regression. This update fixes the problem. We apologize for the inconvenience. Original…
-
Extended Stable Update for Desktop
The Extended Stable channel has been updated to 156.0.8078.96 for Windows and Mac which will roll out over the coming days/weeks. Security Fixes Note: Access to bug details and links may be kept restricted until a majority of…
-
libheif vulnerability
Alex Thomas discovered that libheif incorrectly handled certain HEIF images. An attacker could possibly use this issue to execute arbitrary code if a user or automated system were tricked into opening a specially crafted file.
-
Important: Red Hat build of Keycloak 26.6.8 Images Security Update
New images are available for Red Hat build of Keycloak 26.6.8 and Red Hat build of Keycloak 26.6.8 Operator, running on OpenShift Container Platform
Reuse this view
Same filters as JSON: /api/items?category=advisory&window=7d&limit=100. RSS for this section: feed.xml.