74 openlast updated

HomeHomelab

Homelab

Homelab patch issues, open ones first.

RSS feed

01

Open

CallTitleVendorProductsDate
Patch now
CallPatch nowTitleVSA-2026-063: Xen Orchestra VM import flaw exploited, no fixEnterpriseHomelabVendorVatesProductsXen Orchestra 6.10.1 and earlier, Xen Orchestra Appliance +1Date
CallPatch nowTitleCVE-2026-102895: GPUStack hands out admin to proxiesEnterpriseHomelabVendorGPUStackProductsGPUStackDate
CallPatch nowTitleCVE-2026-116779: FreeSWITCH SIP MESSAGE runs commandsEnterpriseHomelabVendorSignalWireProductsFreeSWITCHDate
CallPatch nowTitleVSA-2026-062: Xen Orchestra auth bypass is being exploitedEnterpriseHomelabVendorVatesProductsXen Orchestra, Xen Orchestra Appliance +1Date
CallPatch nowTitleCVE-2026-123158 OpenSSH sshole: patch Alpine nowEnterpriseHomelabfrom 2026-10VendorLinuxProductsOpenSSH before 10.6p2, Alpine Linux +4Date
CallPatch nowTitleCVE-2026-107441 Zyxel GS1900: exploited, old patch missed itEnterpriseHomelabfrom 2026-10VendorZyxelProductsZyxel GS1900-8, GS1900-8HP +8Date
CallPatch nowTitleBTCPay Server 2.4.1 and older: hot wallets drainedEnterpriseHomelabfrom 2026-10VendorBTCPay ServerProductsBTCPay Server 2.4.1 and earlier, BTCPay Server 2.4.2Date
CallPatch nowTitleCVE-2026-58115 Node-RED on Siemens IoT2050: exploitedEnterpriseHomelabfrom 2026-10VendorSiemens, Node-REDProductsSIMATIC IoT2050 Advanced, Industrial OS +1Date
CallPatch nowTitleCVE-2026-119977 WordPress update race RCE: now exploitedEnterpriseHomelabfrom 2026-10VendorWordPressProductsWordPress 4.7 through 7.1.3, WordPress 7.1.4 +3Date
CallPatch nowTitleCVE-2026-97229 GitLab: exploited CI/CD regex RCE, CVSS 10EnterpriseHomelabfrom 2026-10VendorGitLabProductsGitLab CE, GitLab EE +1Date
CallPatch nowTitleSynology DSM SA-24:20: ransomware hits unpatched NAS boxesEnterpriseHomelabfrom 2026-10VendorSynologyProductsSynology DSM 7.4, Synology DSM 7.3 +5Date
CallPatch nowTitleCVE-2026-41709 ESXi: exploited flaw that skips the logsEnterpriseHomelabfrom 2026-10VendorVMwareProductsVMware ESXi 8.0, VMware ESX 9.0 +3Date
CallPatch nowTitleCVE-2026-46300 Fragnesia: exploited Linux kernel root bugEnterpriseHomelabfrom 2026-10VendorLinux, Debian, Ubuntu, Proxmox, Palo Alto NetworksProductsLinux kernel, Debian 11/12/13 +4Date
CallPatch nowTitleCVE-2026-109618/-109619 php2shell: patch PHP and appliancesEnterpriseHomelabfrom 2026-10VendorPHPProductsPHP 8.2-8.5, PAN-OS +7Date
CallPatch nowTitleNextcloud's built-in Collabora app: exploited for six weeks, CVE'd for ten daysEnterpriseHomelabfrom 2026-10VendorNextcloudProductsCollabora Online - Built-in CODE Server (richdocumentscode) before 26.4.303Date
CallPatch nowTitlePlex2Shell: your media server is now somebody else's crypto minerHomelabfrom 2026-10VendorPlexProductsPlex Media Server before 1.43.3.10861Date
Hold
CallHoldTitleDebian 13 kernel 6.12.111 and Broadcom NICs: Proxmox already did this oneEnterpriseHomelabfrom 2026-10VendorDebianProductsDebian 13 trixie kernel 6.12.111+deb13, bnxt_en +1Date
Known issues
CallKnown issueTitleHome Assistant 2026.11.0: custom integrations not loadedHomelabfrom 2026-10VendorHome AssistantProductsHome Assistant Core 2026.11.0, Home Assistant OS +2Date
CallKnown issueTitleFortiOS 7.4 and 7.6: the GUI daemon that eats the firewall (bug 1227167)EnterpriseHomelabfrom 2026-10VendorFortinetProductsFortiOS 7.4, FortiOS 7.6Date
02

Resolved