Security Check

security.bloxprod.io

Schwachstellen, die jetzt zählen.

CVE für Linux-Server, Android, Apple-Telefone, Windows, Browser, Krypto-Wallets und übrige Software. Ein Klick auf den Titel öffnet das Original beim Herausgeber.

12349Artikel
1696Kritisch
6401Hoch
1781Aktiv ausgenutzt
Alle StufenKritischHochMittelNiedrigAktiv ausgenutzt
Hoch 8.1Windows

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf…

CVE-2026-96644Pillow21. Okt 2026

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using the original full dimensions. A crafted wide, short metafile can pass the pixel-count decompression-bomb check and make the Windows-only renderer read beyond the heap buffer…

Original bei NVDAlle Quellen (2)
Hoch 8.2Linux-Server

Red Hat Enterprise Linux (pillow and aspell): Mehrere Schwachstellen

CVE-2026-96640Amazon Linux 2, Red Hat Enterprise Linux, Fedora Linux, Red Hat Satellite, RESF Rocky Linux, SUSE Linux, SUSE openSUSE…21. Okt 2026

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as distinct pages. A compact malformed PDF can therefore create exponentially many…

Original bei UbuntuAlle Quellen (4)
Mittel 6.8Linux-Server

Red Hat Enterprise Linux ca-certificates: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

CVE-2026-114406Red Hat Enterprise Linux, Broadcom Fabric OS, IBM QRadar SIEM, RESF Rocky Linux, SUSE Linux, SUSE openSUSE, Oracle…21. Okt 2026

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client…

Original bei Red HatAlle Quellen (95)
Kritisch 9.2Aktiv ausgenutztSoftware

PHP: Mehrere Schwachstellen ermöglichen Codeausführung

CVE-2026-109619Debian Linux, Google Cloud Platform, Amazon Linux 2, Red Hat Enterprise Linux, Fedora Linux, Open Source PHP, Xerox…21. Okt 2026

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Original bei HinweisAlle Quellen (22)
Kritisch 9.8Aktiv ausgenutztSoftware

PHP: Mehrere Schwachstellen ermöglichen Codeausführung

CVE-2026-109618Debian Linux, Google Cloud Platform, Amazon Linux 2, Red Hat Enterprise Linux, Fedora Linux, Open Source PHP, Xerox…21. Okt 2026

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Original bei HinweisAlle Quellen (13)
Hoch 8.2Software

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under…

CVE-2026-114400Trudesk21. Okt 2026

Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.

Original bei HinweisAlle Quellen (4)
Mittel 6.2Linux-Server

A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound…

CVE-2026-9282421. Okt 2026

A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.

Original bei Red HatAlle Quellen (4)
Mittel 6.2Linux-Server

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not…

CVE-2026-9282321. Okt 2026

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.

Original bei Red HatAlle Quellen (4)
Mittel 6.2Linux-Server

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and…

CVE-2026-9282221. Okt 2026

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.

Original bei Red HatAlle Quellen (4)
Hoch 7.5Software

Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).

CVE-2026-10160421. Okt 2026

Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security). Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete…

Original bei NVDAlle Quellen (1)
Hoch 8.8Software

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning).

CVE-2026-101567E-Business Suite21. Okt 2026

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector…

Original bei HerstellerAlle Quellen (2)
Hoch 7.8Software

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).

CVE-2026-101566Application Object Library21. Okt 2026

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS…

Original bei HerstellerAlle Quellen (2)
Hoch 7.5Software

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields).

CVE-2026-101552Application Object Library21. Okt 2026

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and…

Original bei HerstellerAlle Quellen (2)
Hoch 7.5Software

Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Suite (component: Internal Operations).

CVE-2026-101546E-Business Suite21. Okt 2026

Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Materials Requirement Planning. Successful attacks of this vulnerability can result in takeover of Oracle Materials Requirement Planning. CVSS 3.1 Base Score 7.5…

Original bei HerstellerAlle Quellen (2)
Hoch 7.5Software

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance).

CVE-2026-101536Cost Management21. Okt 2026

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS…

Original bei HerstellerAlle Quellen (2)
Hoch 7.5Software

Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API).

CVE-2026-101535E-Business Suite21. Okt 2026

Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Foundation. Successful attacks of this vulnerability can result in takeover of Oracle Sales Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS…

Original bei HerstellerAlle Quellen (2)
Hoch 8.5Software

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI).

CVE-2026-101534E-Business Suite21. Okt 2026

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway. While the vulnerability is in Oracle EDI Gateway, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to…

Original bei HerstellerAlle Quellen (2)