Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 531

Export CSV
CVE-2026-104034

Sssd: sssd: denial of service via use-after-free in kcm ticket renewal

A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue on systems configured with KCM renewal, causing the KCM responder service to crash and resulting in a Denial of Service (DoS).

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Sssd
Products
Enterprise Linux Openshift Openshift Container Platform and 2 more
CVE-2026-104033

Sssd: sssd: access control bypass via improper ldap shadow expiration check

A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system. This allows unauthorized access to persist after the account was intended to be deactivated.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Sssd
Products
Enterprise Linux Openshift Openshift Container Platform and 2 more
CVE-2026-104032

Sssd: sssd: denial of service via unprivileged autofs cache invalidation

A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Sssd
Products
Sssd Enterprise Linux Openshift and 3 more
CVE-2026-104031

Sssd: sssd: denial of service via memory exhaustion in autofs responder

A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Red Hat Redhat and 1 more
Products
Sssd Enterprise Linux Enterprise Linux and 4 more
CVE-2026-104030

Sssd: sssd: denial of service via out-of-bounds read during passkey parsing

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash and disrupting authentication services.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Sssd
Products
Sssd Enterprise Linux Openshift and 3 more
CVE-2026-10805

Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend

A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Hummingbird Jboss Enterprise Application Platform Expansion Pack and 12 more
CVE-2025-4598

Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

CVSS 3.1 · 4.7 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Linux Oracle and 2 more
Products
Debian Linux Linux Kernel Linux and 8 more
CVE-2025-5372

Libssh: incorrect return code handling in ssh_kdf() in libssh

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Libssh Redhat
Products
Libssh Enterprise Linux Openshift and 6 more
CVE-2025-5351

Libssh: double free vulnerability in libssh key export functions

A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Libssh Redhat
Products
Libssh Enterprise Linux Openshift and 2 more
CVE-2025-26465

Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

CVSS 3.1 · 6.8 Medium EPSS 7.7% KEV · Not listed
Vendors
Debian Netapp Openbsd and 1 more
Products
Debian Linux Active Iq Unified Manager Ontap and 7 more
CVE-2025-0678

Grub2: squash4: integer overflow may lead to heap based out-of-bounds write when reading data

A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the direct_read() will perform a heap based out-of-bounds write during data reading. This flaw may be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution, by-passing secure boot protections.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Grub2 Enterprise Linux Openshift and 2 more
CVE-2024-9676

Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Eus Enterprise Linux For Arm 64 and 17 more
CVE-2024-9341

Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.

CVSS 3.1 · 5.4 Medium EPSS 1.0% KEV · Not listed
Vendors
Containers Redhat
Products
Common Enterprise Linux Openshift and 2 more
CVE-2025-32990

Gnutls: vulnerability in gnutls certtool template parsing

A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Gnutls Ceph Storage Discovery and 8 more
CVE-2025-32989

Gnutls: vulnerability in gnutls sct extension parsing

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.

CVSS 3.1 · 5.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Gnu Redhat
Products
Gnutls Ceph Storage Discovery and 8 more
CVE-2025-32988

Gnutls: vulnerability in gnutls othername san export

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Gnu Redhat
Products
Gnutls Ceph Storage Discovery and 8 more
CVE-2025-14831

Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification

A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Ai Inference Server Ceph Storage and 16 more
CVE-2025-13601

Glib: integer overflow in in g_escape_uri_string()

A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Glib Ceph Storage Codeready Linux Builder and 38 more
CVE-2025-12801

Nfs-utils: rpc.mountd in the nfs-utils privilege escalation

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux-nfs Redhat
Products
Nfs-utils Ceph Storage Enterprise Linux and 5 more
CVE-2024-45778

Grub2: fs/bfs: integer overflow in the bfs parser.

A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Grub2 Enterprise Linux Openshift and 2 more