Export limit exceeded: 424857 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424857 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (17064 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-13757 | 2 P11-kit Project, Redhat | 13 P11-kit, Cert Manager, Cost Management and 10 more | 2026-11-06 | 6.2 Medium |
| A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services. | ||||
| CVE-2026-11850 | 1 Redhat | 7 Enterprise Linux, Hardened Images, Hummingbird and 4 more | 2026-11-06 | 5 Medium |
| An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data. | ||||
| CVE-2025-5278 | 1 Redhat | 10 Cert Manager, Cost Management, Discovery and 7 more | 2026-11-06 | 4.4 Medium |
| A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data. | ||||
| CVE-2026-95521 | 2 Redhat, Rpm | 6 Enterprise Linux, Hardened Images, Hummingbird and 3 more | 2026-11-06 | 7.8 High |
| A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm. | ||||
| CVE-2026-95519 | 2 Redhat, Rpm | 6 Enterprise Linux, Hardened Images, Hummingbird and 3 more | 2026-11-06 | 7.8 High |
| A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account. | ||||
| CVE-2026-120194 | 3 Json-glib, Red Hat, Redhat | 7 Json-glib, Enterprise Linux, Enterprise Linux and 4 more | 2026-11-06 | 7.5 High |
| A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service. | ||||
| CVE-2026-121997 | 2 Red Hat, Redhat | 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more | 2026-11-06 | 8.1 High |
| A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer. | ||||
| CVE-2026-97029 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 5.7 Medium |
| Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell. | ||||
| CVE-2026-96545 | 2 Gimp, Redhat | 3 Gimp, Enterprise Linux, Rhel Els | 2026-11-06 | 4.4 Medium |
| An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in. | ||||
| CVE-2026-96281 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 6.2 Medium |
| On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities. | ||||
| CVE-2026-96279 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 6.5 Medium |
| A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as /etc/shadow. | ||||
| CVE-2026-96276 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 6.5 Medium |
| If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal. | ||||
| CVE-2026-95512 | 2 Freetype, Redhat | 7 Freetype, Build Of Openjdk 11 Els, Enterprise Linux and 4 more | 2026-11-06 | 5.5 Medium |
| A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate. | ||||
| CVE-2026-95508 | 1 Redhat | 3 Enterprise Linux, Openshift, Openshift Container Platform | 2026-11-06 | 7.4 High |
| A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected. | ||||
| CVE-2026-93653 | 2 Poppler, Redhat | 5 Poppler, Enterprise Linux, Hardened Images and 2 more | 2026-11-06 | 5.5 Medium |
| A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline routine, without a corresponding memory allocation. An attacker could exploit this by supplying a malicious PDF to an application that renders it via Poppler's Splash backend, causing the rendering process to consume 100% CPU for an attacker-controlled, extended duration. | ||||
| CVE-2026-93433 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-06 | 5.5 Medium |
| A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System Interface) Vital Product Data (VPD) page 0x80 data. This malformed data, specifically an untrusted page length field, can lead to a stack buffer overflow in the `_sg_parse_vpd_80()` function during serial number parsing. Successful exploitation could result in a denial of service by crashing or destabilizing the process querying the serial number. | ||||
| CVE-2026-93011 | 3 Dnsmasq, Red Hat, Redhat | 9 Dnsmasq, Enterprise Linux, Ceph Storage and 6 more | 2026-11-06 | 5.3 Medium |
| A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime. | ||||
| CVE-2026-93007 | 3 Dnsmasq, Red Hat, Redhat | 9 Dnsmasq, Enterprise Linux, Ceph Storage and 6 more | 2026-11-06 | 5.3 Medium |
| A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime. | ||||
| CVE-2026-93006 | 3 Dnsmasq, Red Hat, Redhat | 9 Dnsmasq, Enterprise Linux, Ceph Storage and 6 more | 2026-11-06 | 6.8 Medium |
| A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine. | ||||
| CVE-2026-92821 | 2 Redhat, Sssd | 5 Enterprise Linux, Openshift, Openshift Container Platform and 2 more | 2026-11-06 | 6.8 Medium |
| A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems. | ||||