| Risiko / Label | Veröffentlichung | |
|---|---|---|
| Risiko ? / 10 CVE-2025-1889 | gerade eben | |
| picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pickle file with a non-standard file extension. Because the malicious pickle file inclusion is not considered as part of the scope of picklescan, the file would pass security checks and appear to be safe, when it could instead prove to be problematic. | ||
| Risiko ? / 10 CVE-2024-8309 | gerade eben | |
| A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain-community version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database. | ||
| Risiko ? / 10 RLSA-2026:98584 | vor 1 Stunde(n) | |
| Sandboxed and extendable image decoding. Security Fix(es): * librsvg: Use-after-free when XML includes have duplicated entities (CVE-2026-96889,RUSTSEC-2026-0305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:99696 | vor 1 Stunde(n) | |
| The glib-networking packages provide modules that extend the networking support in Glib. In particular, the packages contain a libproxy-based implementation of the GProxyResolver class type and a gnutls-based implementation of the GTlsConnection class type. Security Fix(es): * glib-networking: Unbounded TLS 1.3 session ticket queue growth in glib-networking allows remote denial of service (CVE-2026-103963) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:98565 | vor 1 Stunde(n) | |
| The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "module" utility, which interprets module files. Security Fix(es): * environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters (CVE-2026-85013) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:98076 | vor 1 Stunde(n) | |
| The sos package contains a set of utilities that gather information from system hardware, logs, and configuration files. The information can then be used for diagnostic purposes and debugging. Security Fix(es): * sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write (CVE-2026-79655) Bug Fix(es) and Enhancement(s): * Hydra to GraphQL migration and sos upload (JIRA:Rocky Linux-290940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:97090 | vor 1 Stunde(n) | |
| Subscription Manager Cockpit UI Security Fix(es): * lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800) * lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass (CVE-2026-2950) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section. | ||
| Risiko ? / 10 RLSA-2026:98603 | vor 1 Stunde(n) | |
| jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. Security Fix(es): * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers (CVE-2026-39979) * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:98590 | vor 1 Stunde(n) | |
| GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker. Security Fix(es): * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:97163 | vor 1 Stunde(n) | |
| GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) * glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() (CVE-2026-58010) * glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime (CVE-2026-58011) * glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() (CVE-2026-58012) * glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" (CVE-2026-58013) * glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014) * glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015) * glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (CVE-2026-58016) Bug Fix(es) and Enhancement(s): * [mingw-glib2] cause qga command 'guest-ssh-get-authorized-keys' failed (JIRA:Rocky Linux-151748) * Rebase mingw-glib2 to 2.87.5 (JIRA:Rocky Linux-159874) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section. | ||
| Risiko ? / 10 RLSA-2026:99660 | vor 1 Stunde(n) | |
| The xfsprogs packages contain a set of utilities to administer the XFS file system, including the mkfs.xfs utility to construct an XFS file system. Security Fix(es): * xfsprogs: xfsprogs: Local privilege escalation via command injection in xfs_admin (CVE-2026-108472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:99624 | vor 1 Stunde(n) | |
| Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC). Security Fix(es): * krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTH_GSSAPI_INIT requests (CVE-2026-112323) * krb5: MIT krb5 kadmind unauthenticated CPU DoS via AUTH_GSSAPI client states cleanup (CVE-2026-112322) * krb5: MIT krb5 GSS-RPC client memory leak on XID mismatch retries (CVE-2026-112314) * krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request (CVE-2026-71200) * krb5: MIT krb5 kadmind unauthenticated memory leak DoS via AUTH_GSSAPI_INIT error paths (CVE-2026-112321) * krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching (CVE-2026-112320) * krb5: Unauthorized key reset of protected principal via kpasswd (CVE-2026-107884) * krb5: MIT krb5 kadmind authenticated memory exhaustion DoS via unbounded RPC XDR allocation (CVE-2026-112319) * krb5: MIT krb5 kadmind authenticated DoS exploiting dereference of null policy name pointers (CVE-2026-112318) * krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path (CVE-2026-112317) * krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding (CVE-2026-119079) * krb5: MIT krb5 kadmind authenticated memory leak DoS in xdr_krb5_tl_data() decode failure (CVE-2026-112316) * krb5: Improper authorization via flawed PAC checksum verification (CVE-2026-111423) * krb5: MIT krb5 kadmind unauthenticated memory leak DoS in RPCSEC_GSS buffer decode failure (CVE-2026-112315) * krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests (CVE-2026-107708) * krb5: krb5: Denial of Service via crafted forwarded credentials (CVE-2026-107778) * krb5: Alteration of authentication indicators in CAMMAC container (CVE-2026-71199) * krb5: kadmind: request alteration and protected information disclosure (CVE-2026-118380) * krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun (CVE-2026-107364) Bug Fix(es) and Enhancement(s): * Set PKINIT CMS signatureAlgorithm based on certificate public key type [rhel-10.3.z] (JIRA:Rocky Linux-278063) * auth_gssapi_wrap_data xdr_bytes failure leak [rhel-10.3.z] (JIRA:Rocky Linux-296012) * xdr_bytes() does not free its allocation on partial decode failure [rhel-10.3.z] (JIRA:Rocky Linux-296023) * RPCSEC_GSS context lifecycle leaks [rhel-10.3.z] (JIRA:Rocky Linux-296034) * xdr_krb5_principal decode leak [rhel-10.3.z] (JIRA:Rocky Linux-296045) * process_chpw_request leak [rhel-10.3.z] (JIRA:Rocky Linux-296056) * Read overruns in GSSRPC svcauth_unix [rhel-10.3.z] (JIRA:Rocky Linux-296067) * Null dereference in KDC dispatch corner case [rhel-10.3.z] (JIRA:Rocky Linux-296081) * KDC DoS based on otherName value in PKINIT SAN code [rhel-10.3.z] (JIRA:Rocky Linux-296095) * Memory leak on krb5 gss_accept_sec_context() failure [rhel-10.3.z] (JIRA:Rocky Linux-296112) * KDC authdata filter does not catch KDC-issued types nested inside AD-IF-RELEVANT containers [rhel-10.3.z] (JIRA:Rocky Linux-296127) * Dereference of empty first credential list element in GSS mechanism [rhel-10.3.z] (JIRA:Rocky Linux-296997) * Null dereference of principal names in krb5_rd_cred() [rhel-10.3.z] (JIRA:Rocky Linux-297000) * Fix validation issues for trusted inputs [rhel-10.3.z] (JIRA:Rocky Linux-299144) * Skip expired keys when iterating over KEYRING ccache [rhel-10.3.z] (JIRA:Rocky Linux-299145) * Pass through null deleg_cred from SPNEGO to mech [rhel-10.3.z] (JIRA:Rocky Linux-299146) * Fix leaks on error in PKINIT signed-data creation [rhel-10.3.z] (JIRA:Rocky Linux-299147) * Fix hex key input handling in ktutil addent [rhel-10.3.z] (JIRA:Rocky Linux-299148) * Check reply length before V4 reply check [rhel-10.3.z] (JIRA:Rocky Linux-299149) * Fix memory leak in mpool_get() error paths [rhel-10.3.z] (JIRA:Rocky Linux-299150) * json: Correctly abort parse on invalid array [rhel-10.3.z] (JIRA:Rocky Linux-299151) * Prevent unsigned int overflow in iakerb_save_token() [rhel-10.3.z] (JIRA:Rocky Linux-299152) * Fix ksu memory leak in fcmd_resolve() [rhel-10.3.z] (JIRA:Rocky Linux-299153) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:99595 | vor 1 Stunde(n) | |
| The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages. Security Fix(es): * rpm: Command injection in rpmuncompress via unescaped filenames passed to popen() (CVE-2026-84838) * rpm: Command Injection in `rpmbuild -t*` (`getTarSpec`) via Unescaped Tarball Path (CVE-2026-84837) * rpm: Command Execution via Macro Expansion in `rpmuncompress -x` for Crafted `.gem` Filenames (CVE-2026-84233) * rpm: rpmbuild getTarSpec() crafted tar member name ? macro injection (CVE-2026-78367) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:99133 | vor 1 Stunde(n) | |
| The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162) * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588) * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586) * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752) * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586) * kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553) * kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571) * kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584) * kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (CVE-2026-80981) * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633) * kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479) * kernel: i3c: master: svc: bound IBI payload to the requested max_payload_len (CVE-2026-80951) * kernel: s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects (CVE-2026-89956) * kernel: ALSA: seq: midi: Serialize input teardown with event_input (CVE-2026-90207) * kernel: smb: client: validate absolute native symlink targets before NT fixups (CVE-2026-98318) * kernel: kernel: Denial of Service via unvalidated task in iSCSI management responses (CVE-2026-99152) * kernel: kernel: Denial of service via unvalidated task tag in iSCSI Reject PDU (CVE-2026-99153) Bug Fix(es) and Enhancement(s): * mpls test multi_path fails on 10.3 CTC2 compose (JIRA:Rocky Linux-222766) * Rocky Linux10.0 - kernel: CPU hotplug unsupported by CPUMF [rhel-10.3.z] (JIRA:Rocky Linux-270889) * Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [rhel-10.3.z] (JIRA:Rocky Linux-280591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:99209 | vor 1 Stunde(n) | |
| The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fix(es): * perl-DBI: DBI: Loading of arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM (CVE-2026-78030) * perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting (CVE-2026-88815) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:99212 | vor 1 Stunde(n) | |
| CGI.pm is a stable, complete and mature solution for processing and preparing HTTP requests and responses. Major features including processing form submissions, file uploads, reading and writing cookies, query string generation and manipulation, and processing and preparing HTTP headers. Some HTML generation utilities are included as well. CGI.pm performs very well in in a vanilla CGI.pm environment and also comes with built-in support for mod_perl and mod_perl2 as well as FastCGI. Security Fix(es): * perl-cgi: perl-cgi: Denial of Service via unenforced request and upload limits (CVE-2026-120650) * perl-cgi: perl-cgi: arbitrary file write via unsanitized upload filenames (CVE-2026-120641) * perl-cgi: perl-cgi: Security feature bypass via untainted request parameters (CVE-2026-120642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:99130 | vor 1 Stunde(n) | |
| Mutter is a compositing window manager that displays and manages desktop through OpenGL. It combines the window-management logic inherited from the Metacity window manager with a display engine that uses the Clutter toolkit. Security Fix(es): * mutter: mutter: client-triggered use-after-free in Wayland color-management ICC image description path (CVE-2026-108094) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:99174 | vor 1 Stunde(n) | |
| Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512) * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293) * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498) * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515) * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:99129 | vor 1 Stunde(n) | |
| The gstreamer1 packages contain a streaming media framework, based on graphs of filters which operate on media data. Security Fix(es): * gstreamer: gstreamer: Use-after-free in GStreamer core buffer value deserialization (CVE-2026-125704) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:98978 | vor 1 Stunde(n) | |
| The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy (CVE-2026-57941) * httpd:2.4/mod_http2: mod_http2: httpd: Remote code execution in mod_http2 (CVE-2026-119618) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:98635 | vor 1 Stunde(n) | |
| xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts. Security Fix(es): * xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:98636 | vor 1 Stunde(n) | |
| Qt is a software toolkit for developing applications. This package contains base tools, like string, xml, and network handling. Security Fix(es): * qt5-qtbase: qt6-qtbase: qt: Denial of Service via excessively large HTTP Cache-Control header (CVE-2026-76151) * qt: qt: Denial of Service via crafted XML parsing in QXmlStreamReader (CVE-2026-16762) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:98641 | vor 1 Stunde(n) | |
| Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers (CVE-2026-118669) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:98643 | vor 1 Stunde(n) | |
| Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fix(es): * squid: squid: Request Smuggling in HTTP Transfer-Encoding (CVE-2026-61642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:98642 | vor 1 Stunde(n) | |
| Flatpak-builder is a tool for building flatpaks from sources. Security Fix(es): * flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (CVE-2026-86320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:98644 | vor 1 Stunde(n) | |
| GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gst-plugins-good: gst-plugins-good: Local file disclosure via unvalidated file:// URIs in adaptivedemux2 manifest handling (CVE-2026-121629) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:98629 | vor 1 Stunde(n) | |
| The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API. Security Fix(es): * c-ares: c-ares: Denial of Service via unvalidated DNS header record counts (CVE-2026-69186) * c-ares: c-ares: CPU exhaustion denial of service via unbounded DNS name compression pointer chains (CVE-2026-69184) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:98634 | vor 1 Stunde(n) | |
| nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename (CVE-2026-15176) * nginx: NGINX ngx_http_core_module vulnerability (CVE-2026-97205) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| Risiko ? / 10 RLSA-2026:98633 | vor 1 Stunde(n) | |
| The gcc-toolset-15-gcc package contains the GNU Compiler Collection version 15. Security Fix(es): * gcc: Integer wrap in `std (CVE-2026-114691) * gcc: Confirmed out-of-bounds read/write in libstdc++ parallel `std (CVE-2026-114690) * gcc: Stack overflow in std::bitset on libstdc++ (CVE-2026-115455) * gcc: Out-of-bounds read in std::from_chars (CVE-2026-115456) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. | ||
| 12.11.2026 - CastleRAT | 179.745 Datensätze geleaked | |
| Email addresses, Passwords In November 2026, Europol and international law enforcement partners dismantled infrastructure supporting several malware operations. Among them was CastleRAT, a remote access trojan (RAT) that enabled criminals to remotely control infected computers. Europol provided HIBP with 180k email addresses associated with CastleRAT infections, along with 893k unique passwords observed more than 3M times across accounts used on infected computers. The passwords are now searchable via Pwned Passwords. |
||
| 04.10.2026 - Double Counter | 274.922 Datensätze geleaked | |
| Email addresses, Geographic locations, Names, Usernames In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. In its disclosure notice, Double Counter advised that attackers gained access to a subset of its data. A corpus of data was subsequently published publicly and contained 275k unique email addresses and Discord usernames. A small number of records belonging to paying subscribers whose purchases were processed via Stripe were also present and included names, countries and postcodes. |
||
| 09.09.2026 - AfD | 345.439 Datensätze geleaked | |
| Email addresses, Email messages In September 2026, the German political party Alternative für Deutschland (AfD) suffered a data breach which exposed 345k unique email addresses. The following month, hundreds of gigabytes of data containing hundreds of thousands of emails and attachments was published online, with searchable AI-generated summaries and downloadable original files. An analysis of the incident reported that the breach was detected as early as 9 September, with a subsequent intrusion occurring five days later. In its public statement, AfD attributed the breach to an attack on a hosting provider, identified in subsequent reporting as the party-owned Alternita Dienstleistungs GmbH. |
||
| 07.09.2026 - Medela | 423.947 Datensätze geleaked | |
| Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Salutations, Support tickets In September 2026, Swiss medical device company Medela was the target of a ShinyHunters "pay or leak" extortion campaign. The data allegedly obtained in the breach was later published publicly and included 424k unique email addresses belonging predominantly to healthcare professionals, Medela staff and leads. The exposed data consisted primarily of corporate contact information, including names, physical addresses and phone numbers, with some records also containing associated support tickets. |
||
| 29.08.2026 - Neogen | 435.963 Datensätze geleaked | |
| Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Salutations In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters "pay or leak" extortion attempt. The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts. |
||
| 27.08.2026 - Manchester Airports Group | 8.849.657 Datensätze geleaked | |
| Browser user agent details, Email addresses, Geographic locations, IP addresses, Names, Phone numbers, Purchases, Vehicle registration plates In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services. The incident was later claimed by the FulcrumSec hacking group, who subsequently published email addresses and phone numbers relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The data contained personal information relating to airport services, including vehicle registrations and parking history, Fast Track purchases and lounge bookings. In their disclosure notice, MAG advised that "at no point has passenger safety or aviation security been compromised". |
||
| 21.08.2026 - McKesson | 6.404.340 Datensätze geleaked | |
| Dates of birth, Email addresses, Employers, Genders, Names, Personal health data, Phone numbers, Physical addresses In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published a substantial corpus of data they alleged was sourced from the company, which included 6.4M unique email addresses among other personal and corporate data attributes. The impacted data related to a range of individuals and roles, including marketing campaign recipients, patients, staff and healthcare provider contacts. In McKesson's disclosure notice, the company advised it had identified unauthorised access to "certain third-party applications and the exfiltration of certain data was associated with a subset of customers within our Oncology & Multispecialty and Medical-Surgical business units", but had "reasonable assurance of no ongoing unauthorized activity". |
||
| 15.08.2026 - Oz Hair and Beauty | 1.988.331 Datensätze geleaked | |
| Email addresses, Geographic locations, Names, Phone numbers, Purchases In August 2026, Australian beauty retailer Oz Hair and Beauty was the target of an xpl0itrs extortion attack. The group subsequently published data allegedly obtained from the company, which included 2M unique email addresses along with names, phone numbers, geographic locations (suburb and postcode) and purchases. |
||
| 13.08.2026 - Carhartt | 12.933.413 Datensätze geleaked | |
| Email addresses, Names, Phone numbers, Physical addresses In August 2026, clothing retailer Carhartt was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly obtained from the company including 12.9M unique email addresses, names, phone numbers and physical addresses. The published corpus also contained millions of synthetic records that did not relate to real individuals and were excluded from the breach. |
||
| 12.08.2026 - Sharecare | 318.185 Datensätze geleaked | |
| Dates of birth, Email addresses, Employers, Genders, Government issued IDs, Job titles, Marital statuses, Names, Phone numbers, Physical addresses In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small number of Brazilian health insurance plan members, including dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer identification numbers). |
||
| 06.08.2026 - Fanlore | 144.520 Datensätze geleaked | |
| Email addresses, Names, Passwords, Usernames In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates. The breach resulted in the exposure of 145k unique email addresses along with usernames and passwords stored as either MD5 or PBKDF2 hashes. OTW self-submitted the exposed data to HIBP. |
||
| 05.08.2026 - CyrusOne | 373.460 Datensätze geleaked | |
| Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets In August 2026, data centre operator CyrusOne was the target of a ShinyHunters "pay or leak" extortion attempt. The group subsequently published data allegedly obtained from the company, which included 373k unique email addresses across records relating to users, sales leads and CyrusOne employees. The data largely consisted of corporate contact information, including names, physical addresses, phone numbers and job titles. It also included support tickets and other information related to the organisation's operations. |
||
| 03.08.2026 - Chess.com (2026) | 4.653.212 Datensätze geleaked | |
| Email addresses, Geographic locations, Names, Usernames In August 2026, millions of records allegedly sourced from Chess.com were posted online. The data contained 7.3M rows with 4.6M unique email addresses, along with usernames, names, countries and data relating to users' Chess.com accounts. Analysis of the data suggested it had been obtained by scraping. When loaded into HIBP, 99% of the email addresses had already appeared in previous data breaches, further supporting the scraping theory. Read more about scrapes and data breaches. |
||
| 01.08.2026 - Alcon | 218.395 Datensätze geleaked | |
| Email addresses, Names, Phone numbers, Physical addresses In August 2026, the Alcon eye care company was named in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly sourced from Alcon containing 218k unique email addresses along with other largely corporate B2B contact fields, including name, phone number and physical address. |
||
| 01.08.2026 - Questel | 1.226.209 Datensätze geleaked | |
| Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets In August 2026, the French intellectual property software and services company Questel was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published an extensive corpus of data they alleged was obtained from the company, largely comprising corporate contact information associated with sales leads, support cases and marketing activities, with 1.2M unique email addresses. The data also included names, employers and job titles, along with physical addresses and phone numbers. |
||
| 27.07.2026 - RingCentral | 1.596.490 Datensätze geleaked | |
| Email addresses, Names, Phone numbers, Physical addresses In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they claimed was obtained from the platform, which included 1.6M unique email addresses along with names, physical addresses and phone numbers. In their disclosure notice, RingCentral advised that the incident affected "a limited portion of RingCentral customers" and that it was communicating directly with those affected. |
||
| 21.07.2026 - SplitVPN | 865.336 Datensätze geleaked | |
| Device information, Email addresses, Geographic locations, IP addresses, Partial credit card data In July 2026, the Russian VPN service SplitVPN (previously known as NotVPN) suffered a data breach. The incident exposed millions of customer records, including 865k unique email addresses. Other impacted data included IP addresses, the user's country, and partial payment card data (first 6 and last 4 digits plus expiry date). |
||
| 15.07.2026 - Exact Sciences | 10.869.543 Datensätze geleaked | |
| Dates of birth, Email addresses, Genders, Names, Personal health data, Phone numbers, Physical addresses In July 2026, Exact Sciences (now owned by Abbott Laboratories) was the target of a ShinyHunters "pay or leak" extortion campaign. The group claimed to have obtained data from the company's cancer diagnostics business, which they later published publicly. The breach contained 10.9M unique email addresses belonging to customers, patients and healthcare providers, along with names, addresses, phone numbers and health records. Abbott subsequently published a public notice advising that "some of the impacted files contain personal information and/or personal health information" and that more specific information would follow once their review of the incident was complete. For context, Exact Sciences is the maker of the Cologuard at-home colorectal cancer screening test. |
||
| 13.07.2026 - Brinks Home | 732.162 Datensätze geleaked | |
| Dates of birth, Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases In July 2026, Brinks Home was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they alleged was taken from the company, including 732k unique email addresses and other personal information relating to leads, customers and Brinks staff such as name, phone numbers and physical addresses. The data also included purchases from Brinks along with partial credit card data (last 4 digits, card type and expiry). In Brinks' disclosure notice, they acknowledged the incident and risk of disclosure, and advised that they would notify impacted parties "consistent with applicable law". |
||
| 01.07.2026 - Fluke | 821.100 Datensätze geleaked | |
| Email addresses, Employers, Job titles, Names, Physical addresses, Support tickets In July 2026, electronic test and measurement equipment company Fluke was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published more than 100GB of data allegedly taken from the company. The corpus contained largely corporate contact information, including over 800k unique email addresses, names, phone numbers and physical addresses. A large collection of support cases was also present. |
||
| 18.06.2026 - Inter-Con Security | 276.114 Datensätze geleaked | |
| Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses In June 2026, Inter-Con Security was targeted in a ShinyHunters “pay or leak” extortion campaign. The group subsequently published data it alleged was taken from the company, including 276k unique email addresses along with names, physical addresses, job titles and phone numbers. The data encompassed a combination of contacts, internal users and leads. |
||
| 18.06.2026 - Operation Endgame 4.0 | 4.348.526 Datensätze geleaked | |
| Email addresses, Passwords On 18 June 2026, the latest phase of Operation Endgame targeted the SocGholish malware operation, a prolific malware distribution network used to compromise systems and facilitate further cybercrime. Coordinated by international law enforcement agencies with support from Europol and Eurojust, the operation remediated almost 15,000 compromised websites and disrupted more than 100 servers and domains used to distribute malware. Authorities initially provided HIBP with 154k impacted email addresses and more than half a million previously unseen passwords. The following week, a further 4M email addresses and 9M passwords relating to the StealC malware operation also targeted by Operation Endgame were provided, followed by another 131k email addresses the following month, bringing the total to more than 4.3M unique email addresses. |
||
| 16.06.2026 - Houston City College | 831.642 Datensätze geleaked | |
| Academic records, Citizenship statuses, Dates of birth, Email addresses, Genders, Names, Phone numbers, Physical addresses In June 2026, Houston City College was the target of a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from the college was later published publicly and included 832k unique email addresses along with names, addresses, phone numbers, academic records, and other personal information relating to both current students and alumni. |
||
| 15.06.2026 - Glendale Community College | 793.925 Datensätze geleaked | |
| Academic records, Dates of birth, Email addresses, Genders, Government issued IDs, Names, Phone numbers, Physical addresses In June 2026, Glendale Community College was the target of a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from Glendale was later published online and included almost 800k unique email addresses along with various other data fields, including names, addresses, phone numbers, Social Security numbers and other information relating to student enrolments. In its disclosure notice, the college advised that "the potentially impacted information may vary for each individual and may include all or just one of the above-listed types of information". |
||
| 15.06.2026 - June 2026 Stealer Logs | 56.278.397 Datensätze geleaked | |
| Email addresses, Passwords In June 2026, a collection of accumulated stealer logs from various sources was added to HIBP. The corpus comprised 56M unique email addresses across hundreds of millions of stealer log records. The data also contained 124M unique passwords, which have been added to Pwned Passwords and are now searchable. Individuals can view any records captured against their email address in the stealer logs section of their dashboard. Organisations can see logs affecting their domain via the stealer logs API. |
||
| 15.06.2026 - Moody Bible Institute | 2.303.416 Datensätze geleaked | |
| Dates of birth, Email addresses, Genders, Marital statuses, Names, Phone numbers, Physical addresses In June 2026, Moody Bible Institute was targeted by a ShinyHunters "pay or leak" extortion campaign. Over 2.3M unique email addresses and other personal data were later published publicly, including names, physical addresses, phone numbers, dates of birth and other information relating to donors, supporters, students and alumni. In their disclosure notice, Moody advised that they had "engaged both internal and external cybersecurity experts to thoroughly investigate the matter". |
||
| 15.06.2026 - Sysco | 2.691.852 Datensätze geleaked | |
| Customer feedback, Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Usernames In June 2026, the food distribution company Sysco was targeted by a ShinyHunters "pay or leak" extortion campaign. Data was subsequently published containing 2.7M unique email addresses belonging to staff and customers. The data also contained largely corporate contact information including names, phone numbers, physical addresses, internal job titles, and customer feedback. |
||
| 12.06.2026 - American Tower | 216.601 Datensätze geleaked | |
| Email addresses, Job titles, Names, Phone numbers, Physical addresses In June 2026, telecommunications tower infrastructure company American Tower was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly taken from the company containing more than 200k unique email addresses belonging to employees, contractors, customers, and leads. Exposed data also included names, addresses, and phone numbers. |
||
| 12.06.2026 - JCPenney | 368.418 Datensätze geleaked | |
| Dates of birth, Email addresses, Government issued IDs, Job titles, Names, Phone numbers, Physical addresses, Usernames In June 2026, retailer JCPenney and associated brands were targeted in a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from JCPenney through the exploitation of a critical zero-day vulnerability in Oracle PeopleSoft was later published publicly. The exposed records indicated they primarily related to internal HR systems and impacted current and former employees. The data included 368k corporate and personal email addresses, names, dates of birth, Social Security numbers, phone numbers and home addresses. |
||
| 11.06.2026 - Ralph Lauren | 139.903 Datensätze geleaked | |
| Age groups, Email addresses, Genders, Names, Phone numbers In June 2026, fashion retailer Ralph Lauren was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published hundreds of gigabytes of data they claimed was obtained from the organisation's Salesforce instance, including 140k unique email addresses along with names, phone numbers, genders and age groups. |
||
| 09.06.2026 - Goose Creek | 6.574.121 Datensätze geleaked | |
| Email addresses, Names, Phone numbers, Physical addresses, Purchases In June 2026, a party claiming to have access to data from Goose Creek Candle Company sent emails to a number of the company's customers, claiming the company had a security vulnerability and suffered a data breach. The data was subsequently sent to Have I Been Pwned and contained 6.6M unique email addresses along with names, phone numbers, physical addresses, order IDs and total spent. The data appears to have been obtained from the company's Shopify instance. Goose Creek is aware of the reports but was unable to provide Have I Been Pwned with any further information at the time of publication. |
||
| 09.06.2026 - University of Nottingham | 454.635 Datensätze geleaked | |
| Academic records, Citizenship statuses, Dates of birth, Disabilities, Email addresses, Ethnicities, Genders, IP addresses, Names, Passport numbers, Phone numbers, Physical addresses, Purchases, Salutations, Usernames In June 2026, the University of Nottingham was the target of a cyber attack, later linked to a ShinyHunters "pay or leak" extortion campaign. Tens of gigabytes of data were subsequently published online and included 455k unique email addresses along with extensive personal information including names, addresses, phone numbers, ethnicities, disabilities, passport numbers and information relating to academic enrolments and fee payments. In a post about the incident, the university advised that the breach affected both "current students, and alumni". |
||
| 05.06.2026 - Madison Square Garden Sports | 9.796.738 Datensätze geleaked | |
| Customer service records, Email addresses, Names, Phone numbers, Physical addresses In June 2026, the sports and entertainment company Madison Square Garden Sports was the target of a ShinyHunters "pay or leak" extortion campaign. The group later published the alleged data, which included almost 10M unique email addresses spanning staff and customers, along with extensive personal, employment and customer relationship information. |
||
| 30.05.2026 - Atlas Menu | 63.926 Datensätze geleaked | |
| Email addresses, IP addresses, Passwords, Support tickets, Usernames In May 2026, the GTA V and CS2 cheat service Atlas Menu suffered a data breach. An attacker claimed to have gained access to all Atlas systems and published the service's database to a public GitHub repository. The incident exposed 64k unique email addresses along with usernames, IP addresses, support tickets and passwords stored as bcrypt hashes. |
||
| 29.05.2026 - BCD Travel | 396.313 Datensätze geleaked | |
| Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets In May 2026, the corporate travel management company BCD Travel was claimed as a victim of the ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from BCD was subsequently published publicly in early June and contained 396k unique email addresses. Other exposed data included names, addresses, phone numbers, job titles and employer names, spanning a variety of different data sets including leads, internal staff and support tickets. |
||
| 23.05.2026 - Baker Distributing | 102.935 Datensätze geleaked | |
| Email addresses, Names, Phone numbers, Physical addresses, Support tickets In May 2026, the HVAC/R wholesale distributor Baker Distributing Company was added to the ShinyHunters data extortion group's "pay or leak" site. In early June, the group publicly published data they claimed had been obtained from Baker's SharePoint and Salesforce infrastructure including 103k unique email addresses along with names, physical addresses, phone numbers and tickets relating to the company's HVAC contractor customer base. The exposed data was largely corporate contact and support information with limited sensitivity. |
||
| 23.05.2026 - Charter | 4.851.517 Datensätze geleaked | |
| Email addresses, Job titles, Names, Phone numbers, Physical addresses In May 2026, the telecommunications company Charter Communications (the parent company behind the consumer broadband and cable brand Spectrum) was named by the ShinyHunters group in a "pay or leak" extortion campaign. The group later published the data, which exposed 4.9M unique email addresses along with names, phone numbers and physical addresses. A subset of approximately 85k records originating from an internal employee directory also included job titles. Charter confirmed the incident, but stated that no sensitive personal information or customer proprietary network information (CPNI) was exfiltrated. |
||
| 23.05.2026 - DentaQuest | 2.553.599 Datensätze geleaked | |
| Dates of birth, Email addresses, Genders, Government issued IDs, Health insurance information, Names, Phone numbers, Physical addresses In May 2026, the dental benefits administrator DentaQuest was the target of a ShinyHunters "pay or leak" extortion campaign that resulted in the group publicly publishing hundreds of gigabytes of data allegedly obtained from the company. The data included 2.6M unique email addresses along with names, addresses and phone numbers. Much of the data appeared in healthcare enrollment files (ASC X12 transaction sets) with some containing Medicaid IDs, while additional data appeared in member records and related files. DentaQuest acknowledged "a cybersecurity incident involving unauthorized access to a limited portion of our network", and advised they had contained the attack and mitigated the threat. |
||
| 16.05.2026 - Gîtes de France | 117.574 Datensätze geleaked | |
| Booking details, Email addresses, Names, Phone numbers, Physical addresses In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including 118k unique email addresses alongside names, phone numbers, postal addresses and booking details. |
||
| 14.05.2026 - Golf Canada | 568.972 Datensätze geleaked | |
| Dates of birth, Email addresses, Genders, Geographic locations, Names, Usernames In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates of birth, genders and approximate geographic locations (city, province and postcode). It remains unclear whether the data was obtained via unintentionally exposed website features or a security vulnerability. |
||