CVE-2023-5455

Ipa: invalid csrf protection

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Freeipa Redhat

Products

Fedora Freeipa Codeready Linux Builder and 23 more

CVE-2022-2127

Samba: out-of-bounds read in winbind auth_crap

An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash.

CVSS 3.1 · 5.9 Medium EPSS 1.7% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 5 more

CVE-2026-83596

Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 4 more

CVE-2026-78376

Webkitgtk: use-after-free of jscvalue function parameters

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 4 more

CVE-2026-92925

Redis: redis: out-of-bounds read via crafted cluster bus packets

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Pen Drive Powered By Red Hat Lightspeed Red Hat Openshift Ai (rhoai) 3scale and 19 more

CVE-2026-9064

389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)

A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

389 Directory Server Directory Server Directory Server E4s and 9 more

CVE-2026-80110

Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Certificate System Dogtag Certificate System Enterprise Linux and 3 more

CVE-2026-79678

Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus Freeipa and 6 more

CVE-2026-76578

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus Freeipa and 6 more

CVE-2026-76561

Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)

A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Certificate System Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-76560

389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Directory Server Directory Server E4s Enterprise Linux and 7 more

CVE-2026-73198

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Freeipa Redhat

Products

Freeipa Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-73197

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Freeipa Redhat

Products

Freeipa Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-72694

Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mrtgconfig Redhat

Products

Mrtg Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-59692

Gstreamer1-plugins-bad-free: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callback

A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Gstreamer Redhat

Products

Gstreamer Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-59691

Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gstreamer Redhat

Products

Gstreamer Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-59090

Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Gimp Redhat

Products

Gimp Enterprise Linux Rhel E4s and 2 more

CVE-2026-58384

Gimp: gimp: integer overflow in read_rle_channel()

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gimp Gnu Redhat

Products

Gimp Gimp Enterprise Linux and 3 more

CVE-2026-58379

Gimp: gimp: heap buffer overflow in read_channel_data()

A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gimp Redhat

Products

Gimp Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-66758

Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gimp Redhat

Products

Gimp Enterprise Linux Rhel E4s and 2 more