Source code window and a shield protecting web applications.

Web Applications & DevOps

Vulnerability analysis for web applications, runtimes, containers and open source libraries. Explore CVEs, patches and ways to secure DevOps deployments.

Containers & Cloud Native Web Servers & Runtimes Libraries & Open Source

Medium Nov 13, 2026

Nginx buffer overflow CVE-2026-15176: affected versions and upgrade guidance

Nginx disclosed buffer overflow CVE-2026-15176 when alias is used with rewrite. Versions 0.1.29–1.31.6 are affected; check the running version and upgrade to 1.31.7+ or 1.30.6+.

Low Nov 13, 2026

Docker Engine API v1.57.0 moves to OpenAPI 3.2: what to do

Docker Engine API v1.57.0 moves its primary specification to OpenAPI 3.2, adds a restarting property to container die events, and fixes the ImageManifestSummary.ImageData schema. Tools relying on per-version Swagger 2.0 files should plan migration ahead of future API versions.

Critical Nov 13, 2026

Rucio authentication flaw lets unauthenticated attackers impersonate administrator accounts

Rucio is affected by CVE-2026-100397, which lets unauthenticated attackers obtain an SSH challenge token for an administrator account and access APIs with that account’s privileges for 10 seconds. Check installed versions and upgrade to the corresponding fix.

High Nov 13, 2026

Debian updates postgresql-17 on trixie: upgrade to 17.12-0+deb13u1

Debian DSA-6625-1 updates postgresql-17 on Debian trixie to address multiple vulnerabilities, including CVE-2026-6460. Reported risks include arbitrary code execution, authentication bypass, information disclosure, denial of service, and privilege escalation. Upgrade to 17.12-0+deb13u1 and…

Critical Nov 12, 2026

CVE-2026-111497: Update Windows, .NET and related products to address a Brotli flaw

Microsoft disclosed CVE-2026-111497, an out-of-bounds write in the Brotli decoder used by .NET that could enable elevation of privilege over a network. Exposure requires an application to use Brotli decompression; check affected products and versions, then install the applicable update.

High Nov 11, 2026

Meta FAIRChem: Deserialization flaw could allow arbitrary code execution

ZDI warns that untrusted-data deserialization in Meta FAIRChem’s utils load_inference_model could allow code execution in the current process if a user opens a malicious file or visits a malicious page. ZDI recommends limiting interaction with the product.

High Nov 11, 2026

Node.js releases security updates for the 22.x, 24.x, and 26.x lines

Node.js has released security updates for the 22.x, 24.x, and 26.x lines, fixing HTTP/2, HTTPS, and TLS flaws that may disrupt servers, expose memory or data, or bypass certificate authentication. Check your version and upgrade to the corresponding security release.