CVE-2023-5992

Opensc: side-channel leaks while stripping encryption pkcs#1 padding

A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data.

CVSS 3.1 · 5.6 Medium EPSS 1.2% KEV · Not listed

Vendors

Opensc Project Redhat

Products

Opensc Enterprise Linux Enterprise Linux Eus and 9 more

CVE-2023-5981

Gnutls: timing side-channel in the rsa-psk authentication

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

CVSS 3.1 · 5.9 Medium EPSS 1.3% KEV · Not listed

Vendors

Debian Fedoraproject Gnu and 1 more

Products

Debian Linux Fedora Gnutls and 6 more

CVE-2026-79405

Improper Input Validation in Modem Firmware

Transient DOS when processing a malformed NR RRC configuration message due to improper input validation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Unisoc

Products

Modem

CVE-2026-63339

IXP Manager has authenticated non-administrator privilege escalation

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. This issue is fixed in version 7.3.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Inex

Products

Ixp Manager

CVE-2026-62333

OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory roots

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `MemoryMerkleAir` does not forbid Merkle expansion rows at `parent_height` = 0 or below while `expand_direction` != 0. A malicious prover can fabricate a subtree below a memory leaf and swap digests inside that subtree to change the committed memory root without a corresponding memory operation. The fraudulent rows still balance against the Merkle and compression buses and require no memory-bus operation for the changed leaf. Because the memory Merkle root binds VM memory state across continuation segment boundaries, this affects the soundness of OpenVM proofs using persistent memory. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Openvm-org

Products

Openvm

CVE-2026-61618

SNARK Verifier: noncanonical accumulator limb decoding

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. `PlonkProof::read` selects scalars using `accumulator_indices` and passes them to `AccumulatorEncoding::from_repr`. For the EVM loader, `LimbsEncoding::from_repr` forwards them to `EvmLoader::ec_point_from_limbs` in `snark-verifier/src/loader/evm/loader.rs`, where `shl` and `add` reconstruct coordinates before `validate_ec_point` checks the resulting affine point rather than the original limb bounds. The related native path in `snark-verifier/src/pcs/kzg/accumulator.rs` can reach assertion- or unwrap-based decoding and panic instead of returning a verification error. This allows noncanonical encodings at the verifier boundary and can crash the native verifier. Standard SDK aggregation circuits are expected to constrain accumulator limbs before this boundary, which limits practical exploitability. This issue is fixed in version 0.2.5.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Axiom-crypto

Products

Snark-verifier

CVE-2026-119342

Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses SvgSanitizer.isExternalUrl() before Batik resolves it against the file:///input.svg document base as a same-origin local file. The convert() and addSvgAsPage() paths in app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java can then render image-decodable server files into the returned PDF when sanitization is enabled, including without authentication on login-disabled deployments or with non-admin access when login is enabled. The issue discloses PNG, JPG, GIF, or SVG content and provides an existence oracle only for image-decodable paths; plain text, binary files, directories, XInclude text, external entities, explicit file URLs, and tested HTTP references are not disclosed through this mechanism. This issue is fixed in version 2.13.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Stirling

Products

Stirling Pdf

CVE-2012-0059

Spacewalk-backend: spacewalk-backend: information disclosure via cleartext passwords in error messages

A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit this by reading server logs and emails, leading to the unauthorized disclosure of user passwords.

CVSS 3.1 · 4.9 Medium EPSS 1.7% KEV · Not listed

Vendors

Redhat

Products

Network Proxy Network Satellite Rhel Els and 1 more

CVE-2011-1594

Spacewalk: spacewalk: open redirect vulnerability enables phishing attacks via url parameter

A flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote attackers to redirect users to arbitrary web sites by manipulating a URL in the url_bounce parameter. This can enable attackers to conduct phishing attacks, potentially leading to unauthorized information disclosure or credential theft.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Redhat

Products

Network Satellite Rhel Els Spacewalk

CVE-2026-71217

Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Iperf3 Project Redhat

Products

Iperf3 Enterprise Linux Rhel Els

CVE-2026-119566

Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects

Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoint or a redirecting server can return a 3xx to their host and replay the token, for example to write metrics to the victim's backend.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Prometheus

Products

Prometheus

CVE-2025-12543

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

CVSS 3.1 · 9.6 Critical EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Apache Camel Hawtio Apache Camel Spring Boot Build Of Apache Camel and 16 more

CVE-2025-49177

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: data leak in xfixes extension's xfixessetclientdisconnectmode

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els Rhel Eus

CVE-2024-4467

Qemu-kvm: 'qemu-img info' leads to host file read/write

A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Advanced Virtualization Container Native Virtualization Enterprise Linux and 5 more

CVE-2026-93434

Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-117928

Same-origin policy bypass in the CSS Parsing and Computation component

Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-108316

Tanium addressed an information disclosure vulnerability in Tanium Server.

Tanium addressed an information disclosure vulnerability in Tanium Server.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Tanium Server

CVE-2024-4027

Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks

A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Camel K Jboss Bpms Jboss Data Grid and 6 more

CVE-2024-3657

389-ds-base: potential denial of service via specially crafted kerberos as-req request

A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Directory Server Directory Server E4s Directory Server Eus and 3 more

CVE-2025-13591

Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery

The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in responses can be leveraged to enumerate existing user accounts. Successful exploitation enables an attacker to discover valid usernames within the system, significantly increasing the risk of subsequent attacks such as brute force attacks on user credentials, social engineering attacks, and information leakage. The discovered usernames can be used to craft targeted phishing emails or other social engineering campaigns.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Email Otp Authenticator Identity Server Wso2 Carbon Abstract Otp Authenticator and 1 more