Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2026-97029

Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group

Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Flatpak Redhat
Products
Flatpak Enterprise Linux Rhel Els
CVE-2026-96545

Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux Rhel Els
CVE-2026-96281

Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes

On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Flatpak Redhat
Products
Flatpak Enterprise Linux Rhel Els
CVE-2026-96279

Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as /etc/shadow.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Flatpak Redhat
Products
Flatpak Enterprise Linux Rhel Els
CVE-2026-96276

Flatpak: flatpak: arbitrary write in host context via flatpak build-init

If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Flatpak Redhat
Products
Flatpak Enterprise Linux Rhel Els
CVE-2026-95512

Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Freetype Redhat
Products
Freetype Build Of Openjdk 11 Els Enterprise Linux and 4 more
CVE-2026-95508

Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openshift Container Platform
CVE-2026-93653

Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)

A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline routine, without a corresponding memory allocation. An attacker could exploit this by supplying a malicious PDF to an application that renders it via Poppler's Splash backend, causing the rendering process to consume 100% CPU for an attacker-controlled, extended duration.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Poppler Redhat
Products
Poppler Enterprise Linux Hardened Images and 2 more
CVE-2026-93433

Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing

A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System Interface) Vital Product Data (VPD) page 0x80 data. This malformed data, specifically an untrusted page length field, can lead to a stack buffer overflow in the `_sg_parse_vpd_80()` function during serial number parsing. Successful exploitation could result in a denial of service by crashing or destabilizing the process querying the serial number.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Els
CVE-2026-93011

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dnsmasq Red Hat Redhat
Products
Dnsmasq Enterprise Linux Ceph Storage and 6 more
CVE-2026-93007

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dnsmasq Red Hat Redhat
Products
Dnsmasq Enterprise Linux Ceph Storage and 6 more
CVE-2026-93006

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Dnsmasq Red Hat Redhat
Products
Dnsmasq Enterprise Linux Ceph Storage and 6 more
CVE-2026-92821

Sssd: sssd: access control bypass via premature ldap access rule evaluation

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Sssd
Products
Enterprise Linux Openshift Openshift Container Platform and 2 more
CVE-2026-91920

Undertow: undertow: chunkreader message length permits chunk-size overflow

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Camel Spring Boot Enterprise Linux Jboss Enterprise Application Platform and 3 more
CVE-2026-90462

Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account context could exploit this to maintain access to information and potentially make limited modifications to resources that should no longer be available.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Sssd
Products
Sssd Enterprise Linux Openshift and 3 more
CVE-2026-82324

Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0

A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes (nPlanes) is zero. This causes a row size mismatch that bypasses memory bounds checking, resulting in heap out-of-bounds reads. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux Rhel Els
CVE-2026-75032

Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Els
CVE-2026-89329

Device-mapper-multipath: local denial of service via blocking ipc send operations

A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the `multipathd` listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openshift Container Platform and 1 more
CVE-2026-89098

Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd

A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Nfs Redhat
Products
Nfs-utils Enterprise Linux Openshift and 2 more
CVE-2026-89096

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nfs Redhat
Products
Nfs-utils Enterprise Linux Openshift and 2 more