https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33221.htmlhttps://patchthecve.com/cve/CVE-2026-33221.htmlWed, 17 Jun 2026 10:37:08 +0000MEDIUM 5.3: Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the client-provided Content-Type header without performing server-side MIME type detection. This allows an attacker to upload files with an arbitrary MIME type, bypasshttps://patchthecve.com/cve/CVE-2023-42669.htmlhttps://patchthecve.com/cve/CVE-2023-42669.htmlWed, 17 Jun 2026 06:24:13 +0000MEDIUM 6.5: A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in thehttps://patchthecve.com/cve/CVE-2023-3961.htmlhttps://patchthecve.com/cve/CVE-2023-3961.htmlWed, 17 Jun 2026 06:15:29 +0000CRITICAL 9.1: A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates onhttps://patchthecve.com/cve/CVE-2023-4091.htmlhttps://patchthecve.com/cve/CVE-2023-4091.htmlWed, 17 Jun 2026 06:37:03 +0000MEDIUM 6.5: A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only accesshttps://patchthecve.com/cve/CVE-2023-3347.htmlhttps://patchthecve.com/cve/CVE-2023-3347.htmlWed, 17 Jun 2026 06:13:52 +0000MEDIUM 5.9: A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such ahttps://patchthecve.com/cve/CVE-2023-34968.htmlhttps://patchthecve.com/cve/CVE-2023-34968.htmlWed, 17 Jun 2026 06:04:10 +0000MEDIUM 5.3: A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the informahttps://patchthecve.com/cve/CVE-2022-2447.htmlhttps://patchthecve.com/cve/CVE-2022-2447.htmlWed, 17 Jun 2026 04:41:54 +0000MEDIUM 6.6: A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.https://patchthecve.com/cve/CVE-2021-3670.htmlhttps://patchthecve.com/cve/CVE-2021-3670.htmlWed, 17 Jun 2026 04:05:32 +0000MEDIUM 6.5: MaxQueryDuration not honoured in Samba AD DC LDAPhttps://patchthecve.com/cve/CVE-2022-26148.htmlhttps://patchthecve.com/cve/CVE-2022-26148.htmlWed, 17 Jun 2026 04:34:46 +0000CRITICAL 9.8: An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsohttps://patchthecve.com/cve/CVE-2021-44141.htmlhttps://patchthecve.com/cve/CVE-2021-44141.htmlWed, 17 Jun 2026 04:11:56 +0000MEDIUM 4.3: All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.https://patchthecve.com/cve/CVE-2021-20291.htmlhttps://patchthecve.com/cve/CVE-2021-20291.htmlWed, 17 Jun 2026 03:33:37 +0000MEDIUM 6.5: A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinhttps://patchthecve.com/cve/CVE-2020-14318.htmlhttps://patchthecve.com/cve/CVE-2020-14318.htmlWed, 17 Jun 2026 02:54:31 +0000MEDIUM 4.3: A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.https://patchthecve.com/cve/CVE-2020-10730.htmlhttps://patchthecve.com/cve/CVE-2020-10730.htmlWed, 17 Jun 2026 02:48:20 +0000MEDIUM 6.5: A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libhttps://patchthecve.com/cve/CVE-2020-10685.htmlhttps://patchthecve.com/cve/CVE-2020-10685.htmlWed, 17 Jun 2026 02:48:15 +0000MEDIUM 5.0: A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, https://patchthecve.com/cve/CVE-2019-14907.htmlhttps://patchthecve.com/cve/CVE-2019-14907.htmlWed, 17 Jun 2026 02:19:17 +0000MEDIUM 6.5: All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentichttps://patchthecve.com/cve/CVE-2013-4280.htmlhttps://patchthecve.com/cve/CVE-2013-4280.htmlTue, 16 Jun 2026 23:56:56 +0000MEDIUM 5.5: Insecure temporary file vulnerability in RedHat vsdm 4.9.6.https://patchthecve.com/cve/CVE-2014-3470.htmlhttps://patchthecve.com/cve/CVE-2014-3470.htmlWed, 17 Jun 2026 00:08:14 +0000MEDIUM 4.3: The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certifichttps://patchthecve.com/cve/CVE-2014-0224.htmlhttps://patchthecve.com/cve/CVE-2014-0224.htmlWed, 17 Jun 2026 00:02:33 +0000HIGH 7.4: OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions https://patchthecve.com/cve/CVE-2014-0221.htmlhttps://patchthecve.com/cve/CVE-2014-0221.htmlWed, 17 Jun 2026 00:02:32 +0000MEDIUM 4.3: The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.https://patchthecve.com/cve/CVE-2012-4406.htmlhttps://patchthecve.com/cve/CVE-2012-4406.htmlTue, 16 Jun 2026 23:44:57 +0000CRITICAL 9.8: OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.https://patchthecve.com/cve/CVE-2012-0876.htmlhttps://patchthecve.com/cve/CVE-2012-0876.htmlTue, 16 Jun 2026 23:38:26 +0000MEDIUM 4.3: The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.https://patchthecve.com/cve/CVE-2012-0037.htmlhttps://patchthecve.com/cve/CVE-2012-0037.htmlTue, 16 Jun 2026 23:36:32 +0000MEDIUM 6.5: Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF documenthttps://patchthecve.com/cve/CVE-2012-1798.htmlhttps://patchthecve.com/cve/CVE-2012-1798.htmlTue, 16 Jun 2026 23:40:19 +0000MEDIUM 6.5: The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image.https://patchthecve.com/cve/CVE-2012-0260.htmlhttps://patchthecve.com/cve/CVE-2012-0260.htmlTue, 16 Jun 2026 23:37:00 +0000MEDIUM 6.5: The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a JPEG image with a crafted sequence of restart markers.https://patchthecve.com/cve/CVE-2012-0248.htmlhttps://patchthecve.com/cve/CVE-2012-0248.htmlTue, 16 Jun 2026 23:36:59 +0000MEDIUM 5.5: ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted image whose IFD contains IOP tags that all reference the beginning of the IDF.https://patchthecve.com/cve/CVE-2012-0247.htmlhttps://patchthecve.com/cve/CVE-2012-0247.htmlTue, 16 Jun 2026 23:36:58 +0000HIGH 8.8: ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset and count values in the ResolutionUnit tag in the EXIF IFD0 of an image.https://patchthecve.com/cve/CVE-2011-3045.htmlhttps://patchthecve.com/cve/CVE-2011-3045.htmlTue, 16 Jun 2026 23:32:30 +0000HIGH 8.8: Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a diffhttps://patchthecve.com/cve/CVE-2012-0053.htmlhttps://patchthecve.com/cve/CVE-2012-0053.htmlTue, 16 Jun 2026 23:36:34 +0000MEDIUM 4.3: protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in con