Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 111

Export CSV
CVE-2026-48864

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Opensuse Redhat
Products
Libsolv Cert Manager Discovery and 20 more
CVE-2026-15588

Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ai Inference Server Cert Manager Discovery and 15 more
CVE-2026-14164

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Libarchive Red Hat Redhat
Products
Libarchive Enterprise Linux Ai Inference Server and 13 more
CVE-2026-13757

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
P11-kit Project Redhat
Products
P11-kit Cert Manager Cost Management and 10 more
CVE-2025-5278

Coreutils: heap buffer under-read in gnu coreutils sort via key specification

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cert Manager Cost Management Discovery and 7 more
CVE-2026-5704

Tar: tar: hidden file injection via crafted archives

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Tar Discovery Enterprise Linux and 4 more
CVE-2026-42014

Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin

A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Gnutls Cert Manager Discovery and 14 more
CVE-2026-42015

Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling

A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS) or potentially other unspecified impacts.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cert Manager Discovery Enterprise Linux and 13 more
CVE-2026-3833

Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Gnutls Cert Manager Discovery and 14 more
CVE-2026-5121

Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Libarchive Redhat
Products
Libarchive Ai Inference Server Cert Manager and 15 more
CVE-2026-5260

Gnutls: gnutls: information disclosure via heap overread in rsa key exchange

A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Gnutls Cert Manager Discovery and 14 more
CVE-2026-18508

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Tar Discovery Enterprise Linux and 6 more
CVE-2026-18477

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Tar Discovery Enterprise Linux and 6 more
CVE-2025-6021

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Discovery Enterprise Linux Enterprise Linux Eus and 27 more
CVE-2025-6395

Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()

A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ceph Storage Discovery Enterprise Linux and 5 more
CVE-2025-4598

Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

CVSS 3.1 · 4.7 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Linux Oracle and 2 more
Products
Debian Linux Linux Kernel Linux and 8 more
CVE-2025-26465

Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

CVSS 3.1 · 6.8 Medium EPSS 7.7% KEV · Not listed
Vendors
Debian Netapp Openbsd and 1 more
Products
Debian Linux Active Iq Unified Manager Ontap and 7 more
CVE-2025-10911

Libxslt: use-after-free with key data stored cross-rvt

A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Discovery Enterprise Linux Enterprise Linux Eus and 10 more
CVE-2024-8775

Ansible-core: exposure of sensitive information in ansible vault files due to improper logging

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Ansible Automation Platform Developer Ansible Automation Platform Inside and 4 more
CVE-2024-8176

Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Devworkspace Discovery Enterprise Linux and 8 more