These pages track how the distros and operating systems I have deployed are responding to specific vulnerabilities — which releases are patched, which are still exposed, and when the fixes shipped. Each tracker is updated twice daily with information from vendor advisories and other sources. Updates are continued until every tracked release has a fix.
Applications
- CVE-2026-97206 — Unbound 1.26.2 security release (5 CVEs) Added
- Five Unbound vulnerabilities fixed together on 2026-10-21, headlined by a DNS-over-QUIC use-after-free, with two DNSSEC trust-island bypasses, a decompression CPU exhaustion, and a cache side channel. Tracks Unbound in Debian, pkgsrc, and NixOS.
- CVE-2026-97205 — nginx 1.30.6 / 1.31.7 security releases (5 CVEs) Added
- Five nginx core vulnerabilities fixed together on 2026-10-14, headlined by a worker use-after-free when AIO serves SSI pages. Tracks both nginx tracks in Debian, pkgsrc, and NixOS.
- CVE-2026-93834 — QEMU 9pfs fid path UAF guest escape Added
- QEMU 9pfs race between Tlcreate and Twalk that lets a guest with a virtio-9p share escape the shared directory, reading and writing host files and running code as the QEMU process. Tracks the upstream stable backports and QEMU packages in Debian, Proxmox VE, pkgsrc, NixOS, and Rocky Linux.
- CVE-2026-81642 — Unbound DNSKEY digest heap overflow Added
- Unbound DNSSEC validator heap overflow: a DNSKEY whose owner name points into its own RDATA overruns the digest buffer with attacker-controlled bytes, giving a malicious zone a crash and possible remote code execution on any validating resolver made to look it up. Also covers the canonicalisation overflow and the ReTrap complexity attacks fixed in the same release.
Recently Archived
- CVE-2026-109618, CVE-2026-109619 — PHP2Shell unauthenticated PHP RCE Added · Archived
- Two critical PHP request-lifecycle flaws, leaked a day early and fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on 2026-10-21. Tracks every PHP branch in Debian, pkgsrc, and NixOS.
- CVE-2026-81000 — TUNderflow Added · Archived
-
Linux kernel TUN/TAP out-of-bounds write: an oversized receive headroom propagated
through Open vSwitch underflows the TUN linear-size computation and leaves
skb->datapast its page-sized head. An unprivileged local user (via user namespaces) or a container holdingCAP_NET_ADMINescalates to root, and a working exploit is public. One of four bugs disclosed together with DirtyAH6, PPPoEject, and DiagSpill. - CVE-2026-91765 et al. — PHP 2026-09-24 security releases Added · Archived
- PHP 8.5.11, 8.4.26, 8.3.35, and 8.2.34: twelve advisories across SOAP, PHP-FPM, OpenSSL, the HTTP stream wrapper, Phar, and mysqlnd, including an unauthenticated crash of any SOAP server and an IPv6 bypass of PHP-FPM's client allowlist. Tracks which PHP branch each distribution release ships and whether it has that branch's fix.