Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 66

Export CSV
CVE-2026-107174

Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction

A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Container Platform Openshift Serverless and 4 more
CVE-2023-6717

Keycloak: xss via assertion consumer service url in saml post-binding flow

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Broker Build Keycloak Jboss Bpms and 13 more
CVE-2024-2700

Quarkus-core: leak of local configuration properties into quarkus applications

A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been set by the developer or CI environment for testing purposes, such as dropping the database during application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application, which can lead to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the `quarkus.*` namespace. Application-specific properties are not captured.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Streams Apache Camel Hawtio Apicurio Registry and 7 more
CVE-2025-5914

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Libarchive Redhat
Products
Libarchive Cert Manager Confidential Compute Attestation and 16 more
CVE-2025-7425

Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cert Manager Discovery Enterprise Linux and 14 more
CVE-2025-49796

Libxml: type confusion leads to denial of service (dos)

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.

CVSS 3.1 · 9.1 Critical EPSS 1.6% KEV · Not listed
Vendors
Redhat
Products
Cert Manager Discovery Enterprise Linux and 13 more
CVE-2025-49794

Libxml: heap use after free (uaf) leads to denial of service (dos)

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
3scale Cert Manager Enterprise Linux and 13 more
CVE-2024-1249

Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Broker Amq Streams Build Keycloak and 12 more
CVE-2023-4853

Quarkus: http security policy bypass

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

CVSS 3.1 · 8.1 High EPSS 2.3% KEV · Not listed
Vendors
Quarkus Redhat
Products
Quarkus Apache Camel Quarkus Build Of Optaplanner and 20 more
CVE-2026-87743

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Openshift Ai (rhoai) Apicurio Registry Build Keycloak and 16 more
CVE-2024-24786

Infinite loop in JSON unmarshaling in google.golang.org/protobuf

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Acm Ceph Storage Cluster Observability Operator and 20 more
CVE-2023-44487

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed
Vendors
Akka Amazon Apache and 30 more
Products
Http Server Opensearch Data Prepper Apisix and 375 more
CVE-2025-6020

Linux-pam: linux-pam directory traversal

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cert Manager Confidential Compute Attestation Discovery and 13 more
CVE-2025-22871

Request smuggling due to acceptance of invalid chunked data in net/http

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Ansible Automation Platform Cryostat and 10 more
CVE-2023-48795

ssh: Prefix truncation attack on Binary Packet Protocol (BPP)

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.

CVSS 3.1 · 5.9 Medium EPSS 93.5% KEV · Not listed
Vendors
9bis Apache Apple and 39 more
Products
Kitty Sshd Sshj and 74 more
CVE-2024-24783

Verify panics on certificates with an unknown public key algorithm in crypto/x509

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Advanced Cluster Security Ansible Automation Platform Ceph Storage and 20 more
CVE-2025-22866

Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Apache Camel Hawtio Ceph Storage and 4 more
CVE-2024-40094

graphql-java: Allocation of Resources Without Limits or Throttling in GraphQL Java

GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cryostat Openshift Serverless Quarkus
CVE-2023-45289

Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Advanced Cluster Security Enterprise Linux Logging and 9 more