CVE-2026-98438 faible kernel: mptcp: options: fix uninit-value in mptcp_write_data_fin 27 oct. 2026 build de 01:25 UTC 18 oct. 2026 CVE-2026-111802 faible nautilus: nautilus: Arbitrary File Deletion via Trash Symlink 27 oct. 2026 build de 01:25 UTC 16 oct. 2026 CVE-2026-46472 faible gstreamer1-plugins-good: gstreamer1-plugins-good: Information disclosure via out-of-bounds read in qtdemux_parse_chnl 27 oct. 2026 build de 01:25 UTC 16 oct. 2026 CVE-2026-111581 faible libblockdev: libblockdev: argument injection in NTFS/VFAT label-setting helpers via udisks2 SetLabel() D-Bus method 27 oct. 2026 build de 01:25 UTC 16 oct. 2026 CVE-2026-98427 faible kernel: net/sched: codel: bound the dropping loop per dequeue call 27 oct. 2026 build de 01:25 UTC 14 oct. 2026 CVE-2026-98414 faible kernel: memcg: avoid charging the root memcg from obj_cgroup_charge_pages() 27 oct. 2026 build de 01:25 UTC 14 oct. 2026 CVE-2026-98402 faible kernel: net: icmp: avoid invalid transport header access in icmp_send tracepoint 27 oct. 2026 build de 01:25 UTC 14 oct. 2026 CVE-2026-98398 faible kernel: locking/lockdep: Invalidate stale class_cache entries for zapped classes 27 oct. 2026 build de 01:25 UTC 14 oct. 2026 CVE-2026-98394 faible kernel: af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer 27 oct. 2026 build de 01:25 UTC 14 oct. 2026 CVE-2026-98393 faible kernel: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU 27 oct. 2026 build de 01:25 UTC 14 oct. 2026 CVE-2026-98391 faible kernel: drm/xe: Guard page-fault worker with runtime PM check 27 oct. 2026 build de 01:25 UTC 14 oct. 2026 CVE-2026-98390 faible kernel: x86/amd_node: Avoid divide by zero on virtualized systems 27 oct. 2026 build de 01:25 UTC 14 oct. 2026 CVE-2026-98389 faible kernel: drm/amdgpu: skip gfx switch_power_profile during GPU reset 27 oct. 2026 build de 01:25 UTC 14 oct. 2026 CVE-2026-100229 faible gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check 27 oct. 2026 build de 01:25 UTC 14 oct. 2026 CVE-2026-109278 faible ImageMagick: ImageMagick: Denial of Service via memory leak in wavelet-denoise operation 27 oct. 2026 build de 01:25 UTC 12 oct. 2026 CVE-2026-105081 faible ImageMagick: ImageMagick: Security policy bypass via symbolic link 27 oct. 2026 build de 01:25 UTC 12 oct. 2026 CVE-2026-98356 faible kernel: RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup 27 oct. 2026 build de 01:25 UTC 6 oct. 2026 CVE-2026-104029 faible sssd: sssd: Denial of Service via out-of-bounds read in autofs responder 27 oct. 2026 build de 01:25 UTC 5 oct. 2026 CVE-2026-105712 faible gnupg2: gnupg: Arbitrary file overwrite via symlink traversal in gpgtar 27 oct. 2026 build de 01:25 UTC 5 oct. 2026 CVE-2026-102621 faible poppler: poppler: Denial of Service via integer overflow in SplashClip 27 oct. 2026 build de 01:25 UTC 29 sept. 2026 CVE-2026-98055 faible kernel: ASoC: Intel: avs: Clean up the bus when fetching ML caps fails 27 oct. 2026 build de 01:25 UTC 25 sept. 2026 CVE-2026-96546 faible gimp: gimp: one-byte out-of-bounds heap read in the uncompressed DDS loader 27 oct. 2026 build de 01:25 UTC 23 sept. 2026 CVE-2026-116190 faible github.com/rclone/rclone: rclone: Information disclosure via cross-host HTTP redirects 26 oct. 2026 build de 19:14 UTC 25 oct. 2026 CVE-2026-106073 faible nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() 26 oct. 2026 build de 19:14 UTC 23 oct. 2026 CVE-2026-98874 faible kernel: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect 26 oct. 2026 build de 19:14 UTC 23 oct. 2026 CVE-2026-98873 faible kernel: netfilter: nf_conntrack_expect: zero at allocation time 26 oct. 2026 build de 19:14 UTC 23 oct. 2026 CVE-2026-112769 faible Parse Server before 8.6.98 and 9.x before 9.10.3 Session Class-Level Permission Bypass 26 oct. 2026 build de 14:38 UTC 19 oct. 2026 CVE-2026-116160 faible ImageMagick: ImageMagick: Denial of Service via crafted image in X11 animate operation 26 oct. 2026 build de 07:15 UTC 25 oct. 2026 CVE-2026-116158 faible ImageMagick: ImageMagick: Denial of Service via memory leak in compare command 26 oct. 2026 build de 07:15 UTC 25 oct. 2026 CVE-2026-116157 faible ImageMagick: ImageMagick: Denial of Service via memory leak in PerlMagick 26 oct. 2026 build de 07:15 UTC 25 oct. 2026 CVE-2026-116156 faible ImageMagick: ImageMagick: Denial of Service via memory leak in -set profile option 26 oct. 2026 build de 07:15 UTC 25 oct. 2026 CVE-2026-116153 faible ImageMagick: ImageMagick: Denial of Service via heap-based buffer overflow in convex-hull calculations 26 oct. 2026 build de 07:15 UTC 25 oct. 2026 CVE-2026-116143 faible ImageMagick: ImageMagick: Denial of Service via scene selection policy bypass 26 oct. 2026 build de 07:15 UTC 25 oct. 2026 CVE-2026-116140 faible ImageMagick: ImageMagick: Security policy bypass via flawed delegate invocation parsing 26 oct. 2026 build de 07:15 UTC 25 oct. 2026 CVE-2026-116137 faible adm-zip: adm-zip: File integrity check bypass via duplicate archive entries 26 oct. 2026 build de 07:15 UTC 25 oct. 2026 GHSA-h4fr-cmh5-qr62 faible Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root au moins depuis le 24 oct. 2026 build de 07:11 UTC 23 oct. 2026 GHSA-xmj3-9gf7-h52w faible setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description au moins depuis le 24 oct. 2026 build de 07:11 UTC 23 oct. 2026 CVE-2026-83813 faible twisted: twisted: DNS spoofing via missing response source verification au moins depuis le 24 oct. 2026 build de 07:11 UTC 23 oct. 2026 CVE-2026-115569 faible Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root au moins depuis le 24 oct. 2026 build de 07:11 UTC 23 oct. 2026 CVE-2026-54711 faible PGHoard: Password written to debug log au moins depuis le 24 oct. 2026 build de 07:11 UTC 23 oct. 2026 CVE-2026-115730 faible i18next-http-backend: i18next-http-backend: Cross-site scripting via protocol-relative URL injection au moins depuis le 24 oct. 2026 build de 07:11 UTC 23 oct. 2026 CVE-2026-114614 faible authlib: Authlib: Transport security bypass via improper URL validation au moins depuis le 24 oct. 2026 build de 07:11 UTC 22 oct. 2026 CVE-2026-115393 faible wasmtime: wasmtime: Memory corruption via cross-engine object validation failure au moins depuis le 24 oct. 2026 build de 07:11 UTC 22 oct. 2026 CVE-2026-115389 faible wasmtime: wasmtime: Denial of Service via untracked host memory allocation in Val API au moins depuis le 24 oct. 2026 build de 07:11 UTC 22 oct. 2026 CVE-2026-115386 faible wasmtime: wasmtime: Information disclosure via uninitialized struct padding in fd_readdir au moins depuis le 24 oct. 2026 build de 07:11 UTC 22 oct. 2026 GHSA-c6gr-qvv4-5v3f faible DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml au moins depuis le 24 oct. 2026 build de 07:11 UTC 22 oct. 2026 CVE-2026-115319 faible github.com/junegunn/fzf: fzf: Denial of Service via inefficient string concatenation au moins depuis le 24 oct. 2026 build de 07:11 UTC 22 oct. 2026 CVE-2026-114130 faible Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled au moins depuis le 24 oct. 2026 build de 07:11 UTC 21 oct. 2026 CVE-2026-114124 faible Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry au moins depuis le 24 oct. 2026 build de 07:11 UTC 21 oct. 2026 CVE-2026-114122 faible Electron: Frame subscription trusts GPU-supplied frame geometry au moins depuis le 24 oct. 2026 build de 07:11 UTC 21 oct. 2026 