Dominique Dumont discovered that YAML-LibYAML did not correctly handle
certain reflection operations. If a user or system were tricked into
opening a specially …Dominique Dumont discovered that YAML-LibYAML did not correctly handle
certain reflection operations. If a user or system were tricked into
opening a specially crafted file, an attacker could possibly use this issue
to delete files. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04
LTS. (CVE-2017-20285)
It was discovered that YAML-LibYAML did not correctly handle parsing
certain documents. If a user or automated system were tricked into opening
a specially crafted file, an attacker cou
The Extended Stable channel has been updated to 152.0.7977.167 for Windows and Mac which will roll out over the coming days/weeks. Security Fixes Note: Acc…The Extended Stable channel has been updated to 152.0.7977.167 for Windows and Mac which will roll out over the coming days/weeks. Security Fixes Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed. This update includes 28 security fixes. Please see the Chrome Security Page for more informati
Hi, everyone! We've just released Chrome 155 (155.0.8059.79) for Android. It'll become available on Google Play over the next few days. This release includ…Hi, everyone! We've just released Chrome 155 (155.0.8059.79) for Android. It'll become available on Google Play over the next few days. This release includes stability and performance improvements. You can see a full list of the changes in the Git log . If you find a new issue, please let us know by filing a bug . Android releases contain the same security fixes as their corresponding Desktop releases (Windows & Mac: 155.0.8059.79/.80 Linux: 155.0.8059.79) unless otherwise noted. Harry
A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through spe…A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. [...]
The Beta channel is being updated to OS version 16836.15.0 (Browser version 156.0.8078.31) for most ChromeOS devices. If you find new issues, please let us know…The Beta channel is being updated to OS version 16836.15.0 (Browser version 156.0.8078.31) for most ChromeOS devices. If you find new issues, please let us know one of the following ways: File a bug Visit our ChromeOS communities General: Chromebook Help Community Beta Specific: ChromeOS Beta Help Community Report an issue or send feedback on Chrome Interested in switching channels? Find out how. Andy Wu Google ChromeOS
The Stable channel has been updated to 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 to Linux which will roll out over the coming days/weeks. A fu…The Stable channel has been updated to 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed. This
Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two public…Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. [...]
Microsoft released the Windows 10 KB5126657 extended security update, which includes this month's record-breaking October 2026 Patch Tuesday fixes and a few bug…Microsoft released the Windows 10 KB5126657 extended security update, which includes this month's record-breaking October 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]
Microsoft announced today that devices running Windows 11 24H2 Home and Pro editions have reached the end of support and will no longer receive monthly security…Microsoft announced today that devices running Windows 11 24H2 Home and Pro editions have reached the end of support and will no longer receive monthly security and non-security preview updates. [...]
Microsoft has released the Patch Tuesday Windows 11 KB5127648 and KB5126653 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilit…Microsoft has released the Patch Tuesday Windows 11 KB5127648 and KB5126653 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features. [...]
Hi everyone! We've just released Chrome Stable 156 (156.0.8078.33) for iOS; it'll become available on App Store in the next few hours. This release includes sta…Hi everyone! We've just released Chrome Stable 156 (156.0.8078.33) for iOS; it'll become available on App Store in the next few hours. This release includes stability and performance improvements. You can see a full list of the changes in the Git log . If you find a new issue, please let us know by filing a bug . Chrome Release Team Google Chrome
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [.…Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]
Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal a…Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT). [...]
It was discovered that the timer stats implementation in the Linux kernel
allowed the discovery of a real PID value while inside a PID namespace. A
local attack…It was discovered that the timer stats implementation in the Linux kernel
allowed the discovery of a real PID value while inside a PID namespace. A
local attacker could use this to expose sensitive information.
(CVE-2017-5967)
Wen Xu discovered that the XFS file system implementation in the Linux
kernel did not properly track inode validations. An attacker could use this
to construct a malicious XFS image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13093)
Wen
It was discovered that some AMD processors did not properly perform Reverse
Map Table (RMP) checks when the IOMMU accessed certain host buffers. A
local attacke…It was discovered that some AMD processors did not properly perform Reverse
Map Table (RMP) checks when the IOMMU accessed certain host buffers. A
local attacker with hypervisor access could possibly use this to trigger an
out-of-bounds condition and compromise the integrity of SEV-SNP guest
memory. (CVE-2023-20585)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the fo…Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- S390 architecture;
- IIO ADC drivers;
- Multiple devices driver;
- PCI subsystem;
- VFIO drivers;
- Network file system (NFS) server daemon;
- Overlay file system;
(CVE-2024-53194, CVE-2024-53214, CVE-2024-56570, CVE-2024-56779,
CVE-2024-57849, CVE-2024-57904, CVE-2024-57929, CVE-2025-21664)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the fo…Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Ethernet bonding driver;
- Network drivers;
- F2FS file system;
- Network file system (NFS) server daemon;
- Tracing infrastructure;
- io_uring subsystem;
- Networking core;
- IPv6 networking;
- IUCV driver;
- Netfilter;
- RxRPC session sockets;
(CVE-2022-49149, CVE-2022-49170, CVE-2022-49182, C
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the fo…Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- SCSI subsystem;
- Bluetooth subsystem;
(CVE-2022-49111, CVE-2022-49114)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the fo…Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Ethernet bonding driver;
- Network drivers;
- F2FS file system;
- Tracing infrastructure;
- io_uring subsystem;
- Networking core;
- IUCV driver;
- RxRPC session sockets;
(CVE-2022-49149, CVE-2022-49170, CVE-2022-49182, CVE-2022-49201,
CVE-2024-53187, CVE-2024-53210, CVE-2024-56763, CVE-2026-43456,
CV
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the fo…Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- S390 architecture;
- IIO ADC drivers;
- Multiple devices driver;
- PCI subsystem;
- VFIO drivers;
- Network file system (NFS) server daemon;
- Overlay file system;
- IPv6 networking;
- Netfilter;
(CVE-2024-53194, CVE-2024-53214, CVE-2024-56570, CVE-2024-56779,
CVE-2024-57849, CVE-2024-57904, CVE-202
It was discovered that some AMD processors did not properly perform Reverse
Map Table (RMP) checks when the IOMMU accessed certain host buffers. A
local attacke…It was discovered that some AMD processors did not properly perform Reverse
Map Table (RMP) checks when the IOMMU accessed certain host buffers. A
local attacker with hypervisor access could possibly use this to trigger an
out-of-bounds condition and compromise the integrity of SEV-SNP guest
memory. (CVE-2023-20585)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK f…SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. [...]
YuSung Han discovered that PyJWT did not properly validate certain JWK keys
when performing HMAC verification. An attacker could possibly use this
issue to forg…YuSung Han discovered that PyJWT did not properly validate certain JWK keys
when performing HMAC verification. An attacker could possibly use this
issue to forge authentication tokens. This issue only affected Ubuntu
26.04 LTS. (CVE-2026-102266)
Rohan Das discovered that PyJWT incorrectly handled redirects when fetching
key sets. A remote attacker could possibly use this issue to cause PyJWT
to disclose sensitive information. This issue only affected Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, Ubuntu
CVSSv3 Score:
3.4
A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or …CVSSv3 Score:
3.4
A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
2.1
A Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a local authenticated attacker to crash the ne…CVSSv3 Score:
2.1
A Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
6.7
An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cau…CVSSv3 Score:
6.7
An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
9.6
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenti…CVSSv3 Score:
9.6
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests.
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
7.9
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, Fort…CVSSv3 Score:
7.9
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests.
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
4.8
An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persi…CVSSv3 Score:
4.8
An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests.
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
7.7
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail m…CVSSv3 Score:
7.7
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
5.3
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager …CVSSv3 Score:
5.3
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially crafted packets. Impersonation of a Fortimanager cluster node requires possessing the node's certificate and private key.
Revised on 2026-10-13 00:00:00
Ce bulletin d'actualité du CERT-FR revient sur les vulnérabilités significatives de la semaine passée pour souligner leurs criticités. Il ne remplace pas l'anal…Ce bulletin d'actualité du CERT-FR revient sur les vulnérabilités significatives de la semaine passée pour souligner leurs criticités. Il ne remplace pas l'analyse de l'ensemble des avis et alertes publiés par le CERT-FR dans le cadre d'une analyse de risques pour prioriser l'application des...
De multiples vulnérabilités ont été découvertes dans PostgreSQL JDBC. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données…De multiples vulnérabilités ont été découvertes dans PostgreSQL JDBC. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
De multiples vulnérabilités ont été découvertes dans les produits MongoDB. Elles permettent à un attaquant de provoquer un déni de service à distance et un prob…De multiples vulnérabilités ont été découvertes dans les produits MongoDB. Elles permettent à un attaquant de provoquer un déni de service à distance et un problème de sécurité non spécifié par l'éditeur.
Le CERT-FR a connaissance de nombreuses compromissions des controleurs à distance d'installation de réfrigération Danfoss série AK-SM, AK-SC ainsi que Copeland …Le CERT-FR a connaissance de nombreuses compromissions des controleurs à distance d'installation de réfrigération Danfoss série AK-SM, AK-SC ainsi que Copeland xweb et Dixell xweb. De manière générale l'exposition d'une interface de gestion sur Internet est contraire aux bonnes pratiques.
The Stable channel is being updated to OS version 16805.33.0 (Browser version 154.0.8037.151) for most ChromeOS devices. If you find new issues, please let us …The Stable channel is being updated to OS version 16805.33.0 (Browser version 154.0.8037.151) for most ChromeOS devices. If you find new issues, please let us know one of the following ways File a bug Visit our ChromeOS communities General: Chromebook Help Community Beta Specific: ChromeOS Beta Help Community Report an issue or send feedback on Chrome Interested in switching channels? Find out how . Alon Bajayo, Google ChromeOS ChromeOS Vulnerability Rewards Program Reported Bug Fixes: N/A O
Hi everyone! We've just released Chrome Dev 157 (157.0.8092.0) for Android. It's now available on Google Play . You can see a partial list of the changes in th…Hi everyone! We've just released Chrome Dev 157 (157.0.8092.0) for Android. It's now available on Google Play . You can see a partial list of the changes in the Git log . For details on new features, check out the Chromium blog , and for details on web platform updates, check here . If you find a new issue, please let us know by filing a bug . Chrome Release Team Google Chrome
The Dev channel has been updated to 157.0.8092.0 for Windows, Mac and Linux. A partial list of changes is available in the Git log . Interested in switching …The Dev channel has been updated to 157.0.8092.0 for Windows, Mac and Linux. A partial list of changes is available in the Git log . Interested in switching release channels? Find out how . If you find a new issue, please let us know by filing a bug . The community help forum is also a great place to reach out for help or learn about common issues. Chrome Release Team Google Chrome
Une vulnérabilité a été découverte dans les produits Tenable. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance. L'éditeur ind…Une vulnérabilité a été découverte dans les produits Tenable. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance. L'éditeur indique qu'une réinstallation d'un composant est nécessaire après la mise à jour.
A new LTC version 150.0.7871.256 (Platform Version: 16700.66.0 ), is being rolled out for most ChromeOS devices. This version includes selected security fi…A new LTC version 150.0.7871.256 (Platform Version: 16700.66.0 ), is being rolled out for most ChromeOS devices. This version includes selected security fixes including: 533502257 High CVE-2026-85043 Incomplete cleanup in Network 562174487 High CVE-2026-102324 Use after free in PictureInPicture 553118043 High CVE-2026-87499 Incorrect authorization in Network 502304489 High CVE-2026-85052 Out of bounds read in CrashReporting 533534913 High CVE-2026-84324 Use after free in Prox
Hi everyone! We've just released Chrome Beta 156 (156.0.8078.25) for Android. It's now available on Google Play . You can see a partial list of the changes in …Hi everyone! We've just released Chrome Beta 156 (156.0.8078.25) for Android. It's now available on Google Play . You can see a partial list of the changes in the Git log . For details on new features, check out the Chromium blog , and for details on web platform updates, check here . If you find a new issue, please let us know by filing a bug . Chrome Release Team Google Chrome
The Stable channel has been updated to 156.0.8078.12/.13 for Windows and Mac a s part of our early stable release to a small percentage of users. A full lis…The Stable channel has been updated to 156.0.8078.12/.13 for Windows and Mac a s part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log . You can find more details about early Stable releases here . Interested in switching release channels? Find out how here . If you find a new issue, please let us know by filing a bug . The community help forum is also a great place to reach out for help or learn about common is
The Beta channel has been updated to 156.0.8078.17 for Windows, Mac and Linux. A partial list of changes is available in the Git log . Interested in switching…The Beta channel has been updated to 156.0.8078.17 for Windows, Mac and Linux. A partial list of changes is available in the Git log . Interested in switching release channels? Find out how . If you find a new issue, please let us know by filing a bug . The community help forum is also a great place to reach out for help or learn about common issues. Chrome Release Team Google Chrome
Hi everyone! We've just released Chrome Beta 156 (156.0.8078.24) for iOS; it'll become available on App Store in the next few days. You can see a partial list o…Hi everyone! We've just released Chrome Beta 156 (156.0.8078.24) for iOS; it'll become available on App Store in the next few days. You can see a partial list of the changes in the Git log . If you find a new issue, please let us know by filing a bug . Chrome Release Team Google Chrome
The Long Term Support Candidate LTC-150 has been promoted to ChromeOS LTS-150 and is rolling out to most ChromeOS devices. The current version is 150.0.7871.25…The Long Term Support Candidate LTC-150 has been promoted to ChromeOS LTS-150 and is rolling out to most ChromeOS devices. The current version is 150.0.7871.256 (Platform Version: 16700.66.0 ). If you are currently on the ChromeOS Long Term Support (LTS) channel (and not pinned to 144), your devices will automatically update to ChromeOS LTS 150. Release notes for LTS-150 can be found here Andy Wu Google ChromeOS
De multiples vulnérabilités ont été découvertes dans Sonicwall Secure Mobile Access. Certaines d'entre elles permettent à un attaquant de provoquer une exécutio…De multiples vulnérabilités ont été découvertes dans Sonicwall Secure Mobile Access. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une falsification de requêtes côté serveur (SSRF) et une injection de code indirecte à distance (XSS)....
De multiples vulnérabilités ont été découvertes dans les produits Elastic. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privi…De multiples vulnérabilités ont été découvertes dans les produits Elastic. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'édi…De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.