All tools
Every tool in the collection, grouped by the kind of software it protects. Type to filter by product, CVE or kind of protection.
Servers, proxies and network services 12 entries
Web servers, proxies, name servers, FTP, logging, databases and container hosts.
| Patch | Targets | CVEs | Type |
|---|---|---|---|
| nginx October 2026 | nginx and njs on GNU/Linux | CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-95101, CVE-2026-97629; njs: CVE-2026-101019, CVE-2026-101025 | Check, config audit, hunt, three workarounds (mitigate) and rollback |
| vsftpd FTPS data channel hijack | vsftpd 3.0.5 and older with FTPS enabled on a standalone listener, GNU/Linux | CVE-2026-119568, CVE-2025-14242 (Red Hat family packages) | Check, mitigation, optional hardening and rollback |
| Apache Tomcat October 2026 | Apache Tomcat 9.0, 10.1 and 11.0 on GNU/Linux | CVE-2026-103119, CVE-2026-101356 | Check, mitigation (mitigate --ajp|--http2) and rollback |
| HAProxy HTTP/2 PING | HAProxy 3.1 to 3.4 on GNU/Linux | CVE-2026-110353 | Check, config audit, vendor workaround (mitigate) and rollback |
| Apache CouchDB | Apache CouchDB 3.5.2 and earlier on GNU/Linux | CVE-2026-86471 | Read-only check |
| ISC BIND 9 | BIND 9 name servers on GNU/Linux (9.18 and older get no upstream fix) | CVE-2026-94300 | Read-only check |
| rsyslog dynaFile | rsyslog configurations on GNU/Linux | CVE-2026-92709 | Configuration audit, secure-path fix (mitigate) and rollback |
| Apache Traffic Server | Traffic Server 8.x to 10.2.0 that loads the experimental magick or tsmemcache plugin (CVSS 10) | CVE-2026-111813, CVE-2026-111811 | Read-only check |
| Apache Pulsar and Pulsar Manager | Pulsar brokers with the MultiRoles authorization provider and an anonymous role, or a proxy role; and any Pulsar Manager (retired) | CVE-2026-105869, CVE-2026-105942, CVE-2026-105944 | Read-only check |
| Incus | Incus 6.0 before 6.0.7, 7.0 before 7.0.2 and 7.1 to 7.4: a confined client can write to the host as root | CVE-2026-115375, CVE-2026-115377, CVE-2026-115372 | Read-only check |
| nginx-ui restricted-directive bypass | nginx-ui below 2.4.1: a logged-in user can bypass the restricted-directive check, which leads to code execution where nginx loads njs, Perl or Lua | CVE-2026-84316, CVE-2026-84317, CVE-2026-84318, CVE-2026-84319 | Read-only check and hunt |
| nginx-ui directive injection | nginx-ui below 2.4.1: authenticated directive injection leading to RCE when nginx loads njs/Perl/Lua | CVE-2026-84316, CVE-2026-84317, CVE-2026-84318 | Read-only check |
Operating system, libraries and runtimes 21 entries
The kernel, system libraries, language runtimes and the certificate store.
| Patch | Targets | CVEs | Type |
|---|---|---|---|
| PHP2Shell | PHP-FPM 7.0 through 8.5 on Debian/Ubuntu/Trisquel and derivatives | CVE-2026-109618, CVE-2026-109619, CVE-2026-115560 | Mitigation |
| PHP2Shell live watch | PHP-FPM, Apache and nginx logs on any GNU/Linux; optional systemd unit | CVE-2026-109618, CVE-2026-109619 | Read-only live monitor |
| PHP2Shell on cPanel | cPanel/WHM servers running EasyApache 4 PHP (ea-php74 to ea-php85), any handler | CVE-2026-109618, CVE-2026-109619, CVE-2026-115560 | Mitigation, check and audit |
| PHP session audit | Any PHP host | CVE-2026-115560 | Read-only audit |
| PHP2Shell edge guards | Apache httpd (server configuration or .htaccess) and nginx in front of PHP, with request body and header limits, and a curl tester | CVE-2026-109618, CVE-2026-109619 | Compensating controls (log-only first) |
| PHP2Shell detection rules | auditd, Tetragon and nftables on GNU/Linux | CVE-2026-109618, CVE-2026-109619 | Detection content |
| Node.js October 2026 | Node.js on GNU/Linux; systemd for the guard | CVE-2026-111497 (Brotli) and 9 Node CVEs | Mitigation (Node only) |
| Brotli checker | libbrotli and the processes using it, plus Node/Bun/Python/Ruby/PHP/Envoy/Istio/cdxgen and containers on GNU/Linux | CVE-2026-111497 (Broccoli2Shell) | Read-only check and audit |
| Ruby and GitLab Regexp | Ruby runtimes, Ruby apps and GitLab on GNU/Linux | CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, CVE-2026-110264 | Read-only check and audit |
| libheif HEIF/AVIF Decoder | libheif, ImageMagick and Discourse on GNU/Linux | writeup; DSA-6417-1 | Check, audit and ImageMagick coder mitigation |
| eMudhra CA Compromise | System CA store on Debian/Ubuntu/Trisquel and derivatives | disclosure; Go: CVE-2026-111943 | Mitigation |
| eMudhra CA Compromise on macOS | macOS system CA bundle /etc/ssl/cert.pem and Homebrew ca-certificates | disclosure; Apple | Check and mitigation |
| curl HTTP/2 upload | curl and libcurl on GNU/Linux | CVE-2026-92392 | Read-only check and audit |
| Pillow 13.0.0 | Pillow in Python environments and lock files on GNU/Linux | CVE-2026-96639, CVE-2026-112900 | Read-only check |
| libexpat billion laughs | libexpat, Python's pyexpat and programs that embed expat on GNU/Linux | CVE-2026-115506 | Read-only check and embedded-copy scan |
| Linux kernel ebtables SNAT | The Linux kernel on every distribution: out-of-bounds write in the ebtables SNAT ARP rewrite, exploited in the wild | CVE-2026-53266 | Read-only check |
| Linux kernel local root quartet | The Linux kernel on every distribution: four local privilege escalations with public exploits (IPsec AH6, TUN/TAP, PPPoE, SCTP), each fixed at a different release per branch | CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469 | Check, opt-in protective measures (mitigate) and rollback |
| Linux kernel IPv4 TCP use-after-free | The Linux kernel from 4.4 on every distribution: a race in the IPv4 TCP handshake that an unauthenticated peer can trigger with IP options, remote code execution shown with an MPTCP listener | CVE-2026-98432 | Check, hunt and reversible reductions |
| Linux kernel module blocker | The Linux kernel on every distribution: stop any module from loading, with a list of 42 (recent exploits, older well known flaws, rarely needed attack surface), a status command and a rollback | CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469, CVE-2026-53266, CVE-2026-98432 | List, check and reversible blocks |
| APT package downloads | Debian, Ubuntu and their derivatives: APT before the fixed release of its line (3.0.4, 2.6.2, 2.8.4 and others), when it follows redirects and retries downloads | CVE-2026-109518 | Check, hunt, stopgap (mitigate) and rollback |
| OpenSSL DTLS heap disclosure | OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 before their fixed releases: a High flaw reachable through DTLS | CVE-2026-84782 | Read-only check |
Content management and web applications 18 entries
WordPress, Joomla, Drupal and the other sites and services you host.
| Patch | Targets | CVEs | Type |
|---|---|---|---|
| Nextcloud Collabora Built-in CODE | Nextcloud with the richdocumentscode app on GNU/Linux | CVE-2026-110447 | Mitigation, check and hunt |
| Plex Media Server Plex2Shell | Plex Media Server on GNU/Linux | CVE-2026-96651, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 | Read-only check and hunt |
| WordPress XSS2Shell | WordPress Core sites and their web server logs on GNU/Linux | CVE-2026-64638 | Read-only check, audit and hunt |
| BTCPay Server hot wallet thefts | BTCPay Server 2.4.1 and earlier, on a Docker host or any server you can reach by address; GNU/Linux | No CVE (1 November 2026) | Check, recovery plan, evidence archive, hunt, hardening review and a Tor option; --strict and --json |
| WordPress plugins October 2026 | LiteSpeed Cache, Rank Math PRO, OttoKit, SureCart, LatePoint, Amelia, Profile Builder and Bricksforge (exploited upload to code execution) in WordPress installs on GNU/Linux | CVE-2026-113500, CVE-2026-111862, CVE-2026-110372, CVE-2026-112241, CVE-2026-110653, CVE-2026-112327, CVE-2026-112242, CVE-2026-85097 | Check, hunt, plugin deactivation (mitigate) and rollback |
| Drupal Webform | Drupal sites with the Webform module on GNU/Linux | CVE-2026-96355 | Read-only check |
| Roundcube Webmail October 2026 | Roundcube on GNU/Linux, including copies bundled by hosting panels | CVE-2026-114716 | Read-only check and hunt |
| Craft CMS | Craft CMS 4.x and 5.x projects on GNU/Linux | CVE-2026-112777 | Read-only check |
| Drupal core Field UI and Entity List | Drupal 8.9 to 12 sites on GNU/Linux (end-of-life branches move to a supported branch) and the contributed Entity List module | CVE-2026-108097, CVE-2026-108099 | Check, Drupal's Field UI workaround (mitigate) and rollback |
| YOOtheme Pro | YOOtheme Pro 5 on WordPress and Joomla (CVSS 10.0) | CVE-2026-102785 | Check, hunt, web server rule (mitigate) and rollback |
| Grav Login plugin | Grav CMS sites with Login 3.6.0 to 3.9.12 | CVE-2026-114658 | Read-only check and hunt |
| Grav core allowlist bypass | Grav 2.0.15 to 2.2.12: a page editor can run arbitrary public static methods | CVE-2026-116019 | Read-only check and hunt |
| WordPress page-template path traversal | WordPress core 4.7.0 to 7.1.1: unauthenticated path traversal, local PHP file inclusion, exploited in the wild | CVE-2026-87902 | Read-only check and hunt |
| Magento, Adobe Commerce and Mage-OS BlockStrap | Magento and Adobe Commerce 2.4.4 to 2.4.9, and Mage-OS below 3.6.0: a CVSS 10.0 unauthenticated email-template engine flaw | CVE-2026-103849 | Read-only check |
| Zammad session hijack and privilege escalation | Zammad 6.3.0 to 6.5.4: session hijack to code execution as the zammad user, chained to root, exploited in the wild | CVE-2026-102489, CVE-2026-102490 | Read-only check and hunt |
| Joomla core, September 2026 release | Joomla 4.0.0 to 5.4.8 and 6.0.0 to 6.1.3: 16 core fixes, two rated High (directory deletion, SSRF) | CVE-2026-90915, CVE-2026-92222, CVE-2026-92227 and others | Check, administrator path restriction (mitigate --allow) and rollback |
| baserCMS 5 | baserCMS 5.0.0 to 5.4.1 (before 5.3.2 and 5.4.2): admin SQL injection, path traversal, and deserialization leading to command execution | CVE-2026-114621, CVE-2026-114622, CVE-2026-114624 | Read-only check |
| wp2shell, WordPress core RCE | WordPress core 6.8.0 to 6.8.5, 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1: unauthenticated remote code execution, exploited in the wild | CVE-2026-63030, CVE-2026-60137 | Check, hunt, batch-route block (mitigate) and rollback |
Developer platforms, tools and supply chain 15 entries
Developer machines, build and CI systems, frameworks and packages.
| Patch | Targets | CVEs | Type |
|---|---|---|---|
| openapi-typescript-codegen | Projects, CI jobs and generated TypeScript clients on GNU/Linux | CVE-2026-108551 | Read-only check and generated-code scan |
| LiteLLM supply-chain compromise | litellm in Python environments and containers on GNU/Linux | incident (litellm 1.107.0, no CVE) | Detect, hunt and contain |
| GhostAction developer-machine stealer | Git repositories and developer machines on GNU/Linux | incident (campaign, no CVE) | Scan, hunt and contain |
| Claude Code extension SSH backdoor | Claude Code extension 2.1.312 and 2.1.313 served by the Cursor marketplace (29 October 2026); developer machines on GNU/Linux, macOS and Windows (Cursor's notice publishes scripts for macOS and Windows only; the Windows script here is a read-only check) | incident (no CVE) | Check, hunt, clean and block (Windows: check) |
| Laravel TokenGuard | Laravel apps on GNU/Linux | CVE-2026-114509 | Read-only check and protective middleware |
| Next.js Server Actions | Next.js projects on GNU/Linux | CVE-2026-94482 | Read-only check |
| Django REST framework | DRF installs and pinned dependencies on GNU/Linux | CVE-2026-114138, CVE-2026-114137 | Check, nginx rule (mitigate) and rollback |
| Gitea | Gitea up to 28.1.0 that trusts a user SSH certificate authority | CVE-2026-109553 | Read-only check |
| Sentry for Next.js | Next.js apps using @sentry/nextjs with tunnelRoute on a webpack build | CVE-2026-114139 | Read-only check |
| Jupyter Server and nbconvert | Jupyter Server 2.0 to 2.5 with a gateway and a custom authorizer, and nbconvert 5.4 to 7.17.1 | CVE-2026-114135, CVE-2026-114140 | Read-only check |
| Storybook | Storybook 8 to 11-alpha dev servers reachable from the network | CVE-2026-114126 | Read-only check |
| Amazon SageMaker Python SDK | SageMaker SDK V2 before 2.257.3 and V3 before 3.10.0 (default bucket takeover) | CVE-2026-112408 | Read-only check |
| LiteLLM proxy admin escalation | LiteLLM proxy 1.87.0 up to the fixed release on each line | CVE-2026-114612 | Read-only check |
| Jenkins plugins, advisory of 16 September 2026 | 13 Jenkins plugins including Script Security (eight High sandbox bypasses) | CVE-2026-92122 to CVE-2026-92141 | Read-only check |
| GitLab security releases, October 2026 | Self-managed GitLab: seven High flaws from the 12 and 21 October releases (cross-site scripting, pipeline authorization, cache poisoning, an LDAP account takeover, a Duo prompt injection). 19.2.9 is not a full fix | CVE-2026-92883, CVE-2026-16301, CVE-2026-14814, CVE-2026-81839, CVE-2026-96893, CVE-2026-15723, CVE-2026-112212 | Read-only check |
The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.
