Vulnerabilidades publicadas recientemente en el software que administramos a diario. La lista está filtrada: solo aparece lo que afecta a servidores en producción, no el catálogo completo de CVE.
| CVE | Severidad | Software | Resumen | Corregido en | Publicado |
|---|---|---|---|---|---|
| CVE-2026-109618 | Crítica 9.8 | PHP | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for… | Debian:12: 8.2.35-1~deb12u1Debian:13: 8.4.27-1~deb13u1Debian:14: 8.4.27-1Ubuntu:14.04: 5.5.9+dfsg-1ubuntu4.29+esm18Ubuntu:16.04: 7.0.33-0ubuntu0.16.04.16+esm22Ubuntu:18.04: 7.2.24-0ubuntu0.18.04.17+esm14Ubuntu:20.04: 7.4.3-4ubuntu2.29+esm5Ubuntu:22.04: 8.1.2-1ubuntu2.28Ubuntu:24.04: 8.3.6-0ubuntu0.24.04.13Ubuntu:26.04: 8.5.4-0ubuntu1.5Ubuntu:26.10: 8.5.9-0ubuntu2.1 |
2026-10-21 |
| CVE-2026-85746 | Crítica 9.9 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write… | Debian:14: 1:11.8.9+ds-1 |
2026-10-16 |
| CVE-2026-92262 | Crítica 9.9 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass… | Debian:14: 1:11.8.9+ds-1 |
2026-10-16 |
| CVE-2026-85748 | Crítica 9.9 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array… | Sin parche aún | 2026-10-16 |
| CVE-2026-78663 | Crítica 9.1 | containerd | The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread… | Ubuntu:22.04: 1.22.2-2~22.04.4Ubuntu:24.04: 1.22.2-2ubuntu0.5 |
2026-10-08 |
| CVE-2026-56154 | Crítica 9.8 | Apache HTTP Server | Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1Ubuntu:14.04: 2.4.7-1ubuntu4.22+esm16Ubuntu:16.04: 2.4.18-2ubuntu3.17+esm21Ubuntu:18.04: 2.4.29-1ubuntu4.27+esm12Ubuntu:20.04: 2.4.41-4ubuntu3.23+esm8Ubuntu:22.04: 2.4.52-1ubuntu4.24Ubuntu:24.04: 2.4.58-1ubuntu8.16Ubuntu:26.04: 2.4.66-2ubuntu2.5 |
2026-10-01 |
| CVE-2026-57941 | Crítica 9.8 | Apache HTTP Server | Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1Ubuntu:18.04: 2.4.29-1ubuntu4.27+esm12Ubuntu:20.04: 2.4.41-4ubuntu3.23+esm8Ubuntu:22.04: 2.4.52-1ubuntu4.24Ubuntu:24.04: 2.4.58-1ubuntu8.16Ubuntu:26.04: 2.4.66-2ubuntu2.5 |
2026-10-01 |
| CVE-2026-59797 | Crítica 9.8 | Apache HTTP Server | Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1Ubuntu:14.04: 2.4.7-1ubuntu4.22+esm16Ubuntu:16.04: 2.4.18-2ubuntu3.17+esm21Ubuntu:18.04: 2.4.29-1ubuntu4.27+esm12Ubuntu:20.04: 2.4.41-4ubuntu3.23+esm8Ubuntu:22.04: 2.4.52-1ubuntu4.24Ubuntu:24.04: 2.4.58-1ubuntu8.16Ubuntu:26.04: 2.4.66-2ubuntu2.5 |
2026-10-01 |
| CVE-2026-109619 | Alta 8.1 | PHP | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated… | Debian:12: 8.2.35-1~deb12u1Debian:13: 8.4.27-1~deb13u1Debian:14: 8.4.27-1Ubuntu:14.04: 5.5.9+dfsg-1ubuntu4.29+esm18Ubuntu:16.04: 7.0.33-0ubuntu0.16.04.16+esm22Ubuntu:18.04: 7.2.24-0ubuntu0.18.04.17+esm14Ubuntu:20.04: 7.4.3-4ubuntu2.29+esm5Ubuntu:22.04: 8.1.2-1ubuntu2.28Ubuntu:24.04: 8.3.6-0ubuntu0.24.04.13Ubuntu:26.04: 8.5.4-0ubuntu1.5Ubuntu:26.10: 8.5.9-0ubuntu2.1 |
2026-10-21 |
| CVE-2026-19630 | Alta 7.5 | BIND | In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS… | Debian:13: 1:9.20.30-1~deb13u1Debian:14: 1:9.20.30-1 |
2026-10-21 |
| CVE-2026-94300 | Alta 8.1 | BIND | Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it… | Debian:13: 1:9.20.30-1~deb13u1Debian:14: 1:9.20.30-1 |
2026-10-21 |
| CVE-2026-96888 | Alta 7.5 | BIND | A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the… | Debian:13: 1:9.20.30-1~deb13u1Debian:14: 1:9.20.30-1 |
2026-10-21 |
| CVE-2026-97313 | Alta 7.5 | BIND | A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure… | Debian:13: 1:9.20.30-1~deb13u1Debian:14: 1:9.20.30-1 |
2026-10-21 |
| CVE-2026-101679 | Alta 7.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101770 | Alta 8.1 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101771 | Alta 8.1 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101772 | Alta 8.1 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101773 | Alta 7.1 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected… | Sin parche aún | 2026-10-20 |
| CVE-2026-101775 | Alta 7.4 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101781 | Alta 8.8 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are… | Sin parche aún | 2026-10-20 |
| CVE-2026-101785 | Alta 8.3 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101796 | Alta 7.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101797 | Alta 7.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-86047 | Alta 7.7 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER… | Debian:14: 1:11.8.9+ds-1 |
2026-10-16 |
| CVE-2026-97380 | Alta 8.8 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY… | Debian:14: 1:11.8.9+ds-1 |
2026-10-16 |
| CVE-2026-15176 | Alta 8.1 | Nginx | A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or… | Debian:13: 1.26.3-3+deb13u10Debian:14: 1.30.4-8Ubuntu:22.04: 1.18.0-6ubuntu14.22Ubuntu:24.04: 1.24.0-2ubuntu7.19Ubuntu:26.04: 1.28.3-2ubuntu1.12Ubuntu:26.10: 1.30.4-7ubuntu1.1 |
2026-10-14 |
| CVE-2026-93479 | Alta 8.1 | Nginx | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the… | Debian:13: 1.26.3-3+deb13u10Debian:14: 1.30.4-8Ubuntu:22.04: 1.18.0-6ubuntu14.22Ubuntu:24.04: 1.24.0-2ubuntu7.19Ubuntu:26.04: 1.28.3-2ubuntu1.12Ubuntu:26.10: 1.30.4-7ubuntu1.1 |
2026-10-14 |
| CVE-2026-97205 | Alta 8.1 | Nginx | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain… | Debian:13: 1.26.3-3+deb13u10Debian:14: 1.30.4-8Ubuntu:22.04: 1.18.0-6ubuntu14.22Ubuntu:24.04: 1.24.0-2ubuntu7.19Ubuntu:26.04: 1.28.3-2ubuntu1.12Ubuntu:26.10: 1.30.4-7ubuntu1.1 |
2026-10-14 |
| CVE-2026-95837 | Alta 7.8 | containerd | containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because… | Sin parche aún | 2026-10-12 |
| CVE-2026-107815 | Alta 8.5 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's… | Debian:14: 1:11.8.9+ds-1 |
2026-10-09 |
| CVE-2026-107818 | Alta 8.4 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service… | Debian:14: 1:11.8.9+ds-1 |
2026-10-09 |
| CVE-2026-107821 | Alta 8 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently… | Debian:14: 1:11.8.9+ds-1 |
2026-10-09 |
| CVE-2026-107823 | Alta 7.2 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM… | Debian:14: 1:11.8.9+ds-1 |
2026-10-09 |
| CVE-2026-107814 | Alta 8.4 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages… | Sin parche aún | 2026-10-09 |
| CVE-2026-78659 | Alta 7.5 | containerd | When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server… | Ubuntu:22.04: 1.22.2-2~22.04.4Ubuntu:24.04: 1.22.2-2ubuntu0.5 |
2026-10-08 |
| CVE-2026-78660 | Alta 7.5 | containerd | Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing… | Ubuntu:22.04: 1.22.2-2~22.04.4Ubuntu:24.04: 1.22.2-2ubuntu0.5 |
2026-10-08 |
| CVE-2026-78669 | Alta 7.5 | containerd | A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS… | Ubuntu:22.04: 1.22.2-2~22.04.4Ubuntu:24.04: 1.22.2-2ubuntu0.5 |
2026-10-08 |
| CVE-2026-97032 | Alta 7.5 | containerd | HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder… | Sin parche aún | 2026-10-08 |
| CVE-2026-106583 | Alta 7.8 | OpenSSH | In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. | Debian:14: 1:10.6p1-1Ubuntu:22.04: 1:8.9p1-3ubuntu0.18Ubuntu:24.04: 1:9.6p1-3ubuntu13.20Ubuntu:26.04: 1:10.2p1-2ubuntu3.8Ubuntu:26.10: 1:10.5p1-1ubuntu3.1 |
2026-10-07 |
| CVE-2026-106553 | Alta 7.5 | OpenSSH | In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt. | Debian:14: 1:10.6p1-1Ubuntu:22.04: 1:8.9p1-3ubuntu0.18Ubuntu:24.04: 1:9.6p1-3ubuntu13.20Ubuntu:26.04: 1:10.2p1-2ubuntu3.8Ubuntu:26.10: 1:10.5p1-1ubuntu3.1 |
2026-10-06 |
| CVE-2026-106555 | Alta 7.5 | OpenSSH | In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. | Debian:14: 1:10.6p1-1Ubuntu:22.04: 1:8.9p1-3ubuntu0.18Ubuntu:24.04: 1:9.6p1-3ubuntu13.20Ubuntu:26.04: 1:10.2p1-2ubuntu3.8Ubuntu:26.10: 1:10.5p1-1ubuntu3.1 |
2026-10-06 |
| CVE-2026-46729 | Alta 7.5 | Apache HTTP Server | NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1 |
2026-10-01 |
| CVE-2026-47360 | Alta 7.5 | Apache HTTP Server | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1 |
2026-10-01 |
| CVE-2026-48005 | Alta 7.5 | Apache HTTP Server | Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1 |
2026-10-01 |
| CVE-2026-56153 | Alta 7.5 | Apache HTTP Server | Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1 |
2026-10-01 |
| CVE-2026-56449 | Alta 7.5 | Apache HTTP Server | Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server version… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1 |
2026-10-01 |
| CVE-2026-63045 | Alta 7.5 | Apache HTTP Server | Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1Ubuntu:14.04: 2.4.7-1ubuntu4.22+esm17Ubuntu:16.04: 2.4.18-2ubuntu3.17+esm22Ubuntu:18.04: 2.4.29-1ubuntu4.27+esm13Ubuntu:20.04: 2.4.41-4ubuntu3.23+esm9Ubuntu:22.04: 2.4.52-1ubuntu4.25Ubuntu:24.04: 2.4.58-1ubuntu8.17Ubuntu:26.04: 2.4.66-2ubuntu2.6 |
2026-10-01 |
| CVE-2026-63292 | Alta 7.5 | Apache HTTP Server | Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1Ubuntu:14.04: 2.4.7-1ubuntu4.22+esm17Ubuntu:16.04: 2.4.18-2ubuntu3.17+esm22Ubuntu:18.04: 2.4.29-1ubuntu4.27+esm13Ubuntu:20.04: 2.4.41-4ubuntu3.23+esm9Ubuntu:22.04: 2.4.52-1ubuntu4.25Ubuntu:24.04: 2.4.58-1ubuntu8.17Ubuntu:26.04: 2.4.66-2ubuntu2.6 |
2026-10-01 |
| CVE-2026-63686 | Alta 7.5 | Apache HTTP Server | A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1Ubuntu:14.04: 2.4.7-1ubuntu4.22+esm17Ubuntu:16.04: 2.4.18-2ubuntu3.17+esm22Ubuntu:18.04: 2.4.29-1ubuntu4.27+esm13Ubuntu:20.04: 2.4.41-4ubuntu3.23+esm9Ubuntu:22.04: 2.4.52-1ubuntu4.25Ubuntu:24.04: 2.4.58-1ubuntu8.17Ubuntu:26.04: 2.4.66-2ubuntu2.6 |
2026-10-01 |
| CVE-2026-63718 | Alta 7.5 | Apache HTTP Server | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1Ubuntu:20.04: 2.4.41-4ubuntu3.23+esm9Ubuntu:22.04: 2.4.52-1ubuntu4.25Ubuntu:24.04: 2.4.58-1ubuntu8.17Ubuntu:26.04: 2.4.66-2ubuntu2.6 |
2026-10-01 |
| CVE-2026-73636 | Alta 8.1 | Apache HTTP Server | Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1Ubuntu:14.04: 2.4.7-1ubuntu4.22+esm17Ubuntu:16.04: 2.4.18-2ubuntu3.17+esm22Ubuntu:18.04: 2.4.29-1ubuntu4.27+esm13Ubuntu:20.04: 2.4.41-4ubuntu3.23+esm9Ubuntu:22.04: 2.4.52-1ubuntu4.25Ubuntu:24.04: 2.4.58-1ubuntu8.17Ubuntu:26.04: 2.4.66-2ubuntu2.6 |
2026-10-01 |
| CVE-2026-73637 | Alta 7.3 | Apache HTTP Server | Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1Ubuntu:14.04: 2.4.7-1ubuntu4.22+esm17Ubuntu:16.04: 2.4.18-2ubuntu3.17+esm22Ubuntu:18.04: 2.4.29-1ubuntu4.27+esm13Ubuntu:20.04: 2.4.41-4ubuntu3.23+esm9Ubuntu:22.04: 2.4.52-1ubuntu4.25Ubuntu:24.04: 2.4.58-1ubuntu8.17Ubuntu:26.04: 2.4.66-2ubuntu2.6 |
2026-10-01 |
| CVE-2026-93546 | Alta 8.8 | Apache HTTP Server | Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1Ubuntu:14.04: 2.4.7-1ubuntu4.22+esm17Ubuntu:16.04: 2.4.18-2ubuntu3.17+esm22Ubuntu:18.04: 2.4.29-1ubuntu4.27+esm13Ubuntu:20.04: 2.4.41-4ubuntu3.23+esm9Ubuntu:22.04: 2.4.52-1ubuntu4.25Ubuntu:24.04: 2.4.58-1ubuntu8.17Ubuntu:26.04: 2.4.66-2ubuntu2.6 |
2026-10-01 |
| CVE-2026-2270 | Media 5.9 | Kubernetes | A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision… | Debian:12: 1.20.5+really1.20.2-1Debian:13: 1.20.5+really1.20.2-1Debian:14: 1.20.5+really1.20.2-1 |
2026-10-26 |
| CVE-2026-101607 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101608 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101609 | Media 4.4 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101610 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101611 | Media 4.4 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101612 | Media 4 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101613 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101614 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101615 | Media 4.4 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101616 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101617 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101618 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101619 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101620 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101621 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101622 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101623 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101624 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101627 | Media 4.4 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101629 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101637 | Media 5.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101721 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are… | Sin parche aún | 2026-10-20 |
| CVE-2026-101722 | Media 4.3 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are… | Sin parche aún | 2026-10-20 |
| CVE-2026-101724 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101725 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101726 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101727 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101728 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101729 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101730 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101731 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101732 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101733 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101747 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101748 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Audit). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101750 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101751 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are… | Sin parche aún | 2026-10-20 |
| CVE-2026-101752 | Media 4.4 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are… | Sin parche aún | 2026-10-20 |
| CVE-2026-101753 | Media 4.4 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: RAPID). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101754 | Media 4.4 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101756 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101760 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101761 | Media 5.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are… | Sin parche aún | 2026-10-20 |
| CVE-2026-101762 | Media 5.3 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are… | Sin parche aún | 2026-10-20 |
| CVE-2026-101766 | Media 4.4 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101774 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101776 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin). Supported versions that are affected… | Sin parche aún | 2026-10-20 |
| CVE-2026-101777 | Media 5.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are… | Sin parche aún | 2026-10-20 |
| CVE-2026-101778 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are… | Sin parche aún | 2026-10-20 |
| CVE-2026-101780 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101784 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101787 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101788 | Media 5.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are… | Sin parche aún | 2026-10-20 |
| CVE-2026-101789 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101794 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101795 | Media 6.7 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are… | Sin parche aún | 2026-10-20 |
| CVE-2026-101798 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101799 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are… | Sin parche aún | 2026-10-20 |
| CVE-2026-101800 | Media 6.8 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are… | Sin parche aún | 2026-10-20 |
| CVE-2026-101801 | Media 4.9 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-101802 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-101803 | Media 6.5 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML). Supported versions that are affected are MySQL Server… | Sin parche aún | 2026-10-20 |
| CVE-2026-85745 | Media 4.3 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond… | Debian:14: 1:11.8.9+ds-1 |
2026-10-16 |
| CVE-2026-85985 | Media 5.4 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine… | Debian:14: 1:11.8.9+ds-1 |
2026-10-16 |
| CVE-2026-97629 | Media 6.5 | Nginx | Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key… | Debian:13: 1.26.3-3+deb13u10Debian:14: 1.30.4-8Ubuntu:24.04: 1.24.0-2ubuntu7.19Ubuntu:26.04: 1.28.3-2ubuntu1.12Ubuntu:26.10: 1.30.4-7ubuntu1.1 |
2026-10-14 |
| CVE-2026-107816 | Media 6.4 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin… | Debian:14: 1:11.8.9+ds-1 |
2026-10-09 |
| CVE-2026-107817 | Media 4.4 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin… | Debian:14: 1:11.8.9+ds-1 |
2026-10-09 |
| CVE-2026-107822 | Media 6.4 | MariaDB | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache… | Debian:14: 1:11.8.9+ds-1 |
2026-10-09 |
| CVE-2026-107819 | Media 5.9 | MariaDB | MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C… | Sin parche aún | 2026-10-09 |
| CVE-2026-106552 | Media 6.5 | OpenSSH | In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy… | Debian:14: 1:10.6p1-1Ubuntu:22.04: 1:8.9p1-3ubuntu0.18Ubuntu:24.04: 1:9.6p1-3ubuntu13.20Ubuntu:26.04: 1:10.2p1-2ubuntu3.8Ubuntu:26.10: 1:10.5p1-1ubuntu3.1 |
2026-10-06 |
| CVE-2026-106585 | Media 6.5 | OpenSSH | In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data. | Debian:14: 1:10.6p1-1Ubuntu:22.04: 1:8.9p1-3ubuntu0.18Ubuntu:24.04: 1:9.6p1-3ubuntu13.20Ubuntu:26.04: 1:10.2p1-2ubuntu3.8Ubuntu:26.10: 1:10.5p1-1ubuntu3.1 |
2026-10-06 |
| CVE-2026-106586 | Media 4.3 | OpenSSH | In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different… | Debian:14: 1:10.6p1-1Ubuntu:22.04: 1:8.9p1-3ubuntu0.18Ubuntu:24.04: 1:9.6p1-3ubuntu13.20Ubuntu:26.04: 1:10.2p1-2ubuntu3.8Ubuntu:26.10: 1:10.5p1-1ubuntu3.1 |
2026-10-06 |
| CVE-2026-42528 | Media 4.3 | Apache HTTP Server | A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1 |
2026-10-01 |
| CVE-2026-58415 | Media 5.3 | Apache HTTP Server | Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1Ubuntu:14.04: 2.4.7-1ubuntu4.22+esm17Ubuntu:16.04: 2.4.18-2ubuntu3.17+esm22Ubuntu:18.04: 2.4.29-1ubuntu4.27+esm13Ubuntu:20.04: 2.4.41-4ubuntu3.23+esm9Ubuntu:22.04: 2.4.52-1ubuntu4.25Ubuntu:24.04: 2.4.58-1ubuntu8.17Ubuntu:26.04: 2.4.66-2ubuntu2.6 |
2026-10-01 |
| CVE-2026-79768 | Media 5.3 | Apache HTTP Server | Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1Ubuntu:14.04: 2.4.7-1ubuntu4.22+esm17Ubuntu:16.04: 2.4.18-2ubuntu3.17+esm22Ubuntu:18.04: 2.4.29-1ubuntu4.27+esm13Ubuntu:20.04: 2.4.41-4ubuntu3.23+esm9Ubuntu:22.04: 2.4.52-1ubuntu4.25Ubuntu:24.04: 2.4.58-1ubuntu8.17Ubuntu:26.04: 2.4.66-2ubuntu2.6 |
2026-10-01 |
| CVE-2026-101779 | Baja 2.7 | MariaDB | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Telemetry). Supported versions that are affected are MySQL… | Sin parche aún | 2026-10-20 |
| CVE-2026-106582 | Baja 3.7 | OpenSSH | In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams"… | Debian:14: 1:10.6p1-1Ubuntu:22.04: 1:8.9p1-3ubuntu0.18Ubuntu:24.04: 1:9.6p1-3ubuntu13.20Ubuntu:26.04: 1:10.2p1-2ubuntu3.8Ubuntu:26.10: 1:10.5p1-1ubuntu3.1 |
2026-10-06 |
| CVE-2026-106584 | Baja 3.3 | OpenSSH | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more… | Debian:14: 1:10.6p1-1Ubuntu:22.04: 1:8.9p1-3ubuntu0.18Ubuntu:24.04: 1:9.6p1-3ubuntu13.20Ubuntu:26.04: 1:10.2p1-2ubuntu3.8Ubuntu:26.10: 1:10.5p1-1ubuntu3.1 |
2026-10-06 |
| CVE-2026-106587 | Baja 3.6 | OpenSSH | In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is… | Debian:14: 1:10.6p1-1Ubuntu:22.04: 1:8.9p1-3ubuntu0.18Ubuntu:24.04: 1:9.6p1-3ubuntu13.20Ubuntu:26.04: 1:10.2p1-2ubuntu3.8Ubuntu:26.10: 1:10.5p1-1ubuntu3.1 |
2026-10-06 |
| CVE-2026-106589 | Baja 2.9 | OpenSSH | In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is… | Sin parche aún | 2026-10-06 |
| CVE-2026-42356 | Baja 3.7 | Apache HTTP Server | Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and… | Debian:13: 2.4.69-1~deb13u1Debian:14: 2.4.69-1 |
2026-10-01 |
| CVE-2026-78661 | Sin clasificar | containerd | When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated… | Sin parche aún | 2026-10-27 |
| CVE-2026-97045 | Sin clasificar | containerd | In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that… | Sin parche aún | 2026-10-27 |
| CVE-2026-110928 | Sin clasificar | OpenSSH | authorized_keys restrict does not apply to tunnel forwarding | Sin parche aún | 2026-10-26 |
| CVE-2025-1218 | Sin clasificar | PHP | php8.5, php8.3, php8.1, php7.4, php7.2, php7.0, php5 vulnerabilities | Ubuntu:14.04: 5.5.9+dfsg-1ubuntu4.29+esm17Ubuntu:16.04: 7.0.33-0ubuntu0.16.04.16+esm21Ubuntu:18.04: 7.2.24-0ubuntu0.18.04.17+esm13Ubuntu:20.04: 7.4.3-4ubuntu2.29+esm4Ubuntu:22.04: 8.1.2-1ubuntu2.27Ubuntu:24.04: 8.3.6-0ubuntu0.24.04.12Ubuntu:26.04: 8.5.4-0ubuntu1.4Ubuntu:26.10: 8.5.9-0ubuntu2 |
2026-10-19 |
| CVE-2026-95101 | Sin clasificar | Nginx | Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering… | Debian:13: 1.26.3-3+deb13u10Debian:14: 1.30.4-8 |
2026-10-14 |
| CVE-2025-40778 | Sin clasificar | BIND | bind9 vulnerabilities | Ubuntu:14.04: 1:9.9.5.dfsg-3ubuntu0.19+esm15Ubuntu:16.04: 1:9.10.3.dfsg.P4-8ubuntu1.19+esm11Ubuntu:18.04: 1:9.11.3+dfsg-1ubuntu1.19+esm6Ubuntu:20.04: 1:9.18.30-0ubuntu0.20.04.2+esm3Ubuntu:22.04: 1:9.18.39-0ubuntu0.22.04.7Ubuntu:24.04: 1:9.18.39-0ubuntu0.24.04.8Ubuntu:26.04: 1:9.20.24-1ubuntu0.4 |
2026-10-14 |
| CVE-2026-95838 | Sin clasificar | containerd | containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories… | Sin parche aún | 2026-10-12 |
| CVE-2026-92542 | Sin clasificar | Docker | The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams… | Sin parche aún | 2026-10-07 |
| CVE-2026-92543 | Sin clasificar | Docker | Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure… | Sin parche aún | 2026-10-07 |
| CVE-2023-53629 | Sin clasificar | Kernel Linux | Kernel Live Patch Security Notice | Ubuntu:16.04: 4.15.0-1197.210~16.04.1Ubuntu:18.04: 4.15.0-1197.210Ubuntu:20.04: 5.4.0-241.261Ubuntu:22.04: 5.15.0-1117.124Ubuntu:24.04: 6.8.0-1065.68Ubuntu:26.04: 7.0.0-1011.11 |
2026-10-07 |
| CVE-2026-93315 | Sin clasificar | Docker | When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build… | Sin parche aún | 2026-10-05 |
| CVE-2026-93316 | Sin clasificar | Docker | If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident. | Sin parche aún | 2026-10-05 |
| CVE-2026-93317 | Sin clasificar | Docker | An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting… | Sin parche aún | 2026-10-05 |
| CVE-2026-93318 | Sin clasificar | Docker | A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised… | Sin parche aún | 2026-10-05 |
| CVE-2026-93319 | Sin clasificar | Docker | A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon… | Sin parche aún | 2026-10-05 |
| CVE-2026-93320 | Sin clasificar | Docker | BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on… | Sin parche aún | 2026-10-05 |
| CVE-2026-93321 | Sin clasificar | Docker | A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon. | Sin parche aún | 2026-10-05 |
| CVE-2026-93322 | Sin clasificar | Docker | A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon. | Sin parche aún | 2026-10-05 |
| CVE-2026-93323 | Sin clasificar | Docker | The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an… | Sin parche aún | 2026-10-05 |
| CVE-2026-93326 | Sin clasificar | Docker | A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look… | Sin parche aún | 2026-10-05 |
| CVE-2026-59685 | Sin clasificar | Apache HTTP Server | — | Sin parche aún | 2026-10-01 |
Datos de OSV.dev, que agrega los avisos de Debian, Ubuntu, Alpine y Rocky Linux. La severidad es la puntuación base CVSS 3.1 calculada a partir del vector publicado. Esta tabla se genera automáticamente y no sustituye a los avisos oficiales de tu distribución.
Ningún aviso coincide con esos filtros.
El servicio que administramos en la práctica, no todo el catálogo: Kernel Linux, systemd, OpenSSH y OpenSSL como base; Nginx y Apache como servidores web; PostgreSQL y MariaDB como bases de datos; Docker, containerd y Kubernetes en contenedores; y PHP, Postfix y BIND. Se consulta sobre Debian 12, Ubuntu 24.04 y Alpine 3.20.
Todo lo que no llega a un servidor en producción: escritorio, navegadores, aplicaciones de usuario y hardware de consumo. Una lista que lo incluyera todo sería más larga y menos útil, porque obligaría a filtrar a mano lo que aquí ya viene filtrado.
La tabla se regenera automáticamente y ninguna parte de ella la redacta un modelo de lenguaje: son datos copiados de su fuente. Para decidir qué hacer con un aviso concreto, la referencia sigue siendo el aviso oficial de tu distribución, enlazado en cada fila.
Recopilamos estos avisos a diario. Puedes seguirlos por RSS en tu lector habitual, o suscribirte solo a los de un software o una distribución concretos desde su página.
Suscribirse por RSSRevisar avisos es la parte fácil. Lo que cuesta es decidir qué urge, probarlo y aplicarlo sin cortar el servicio. Si eso hoy no lo lleva nadie, hablamos.
Soporte Linux y DevOps en español