Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,139

Export CSV
CVE-2026-5419

Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Gnutls Cert Manager Discovery and 11 more
CVE-2026-3832

Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response

A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Gnutls Cert Manager Discovery and 8 more
CVE-2026-44605

Rpm: heap buffer overflow in ndb slot table parsing

A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during file parsing, leading to an incorrect memory allocation. An attacker could leverage this to cause a denial of service, making the system unavailable.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Hardened Images Hummingbird and 2 more
CVE-2026-3184

Util-linux: util-linux: access control bypass due to improper hostname canonicalization

A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Kernel Linux Redhat
Products
Util-linux Util-linux Enterprise Linux and 4 more
CVE-2026-2340

Samba: vfs_worm does not block directory modification

A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Enterprise Linux Eus Openshift and 8 more
CVE-2026-18839

Popt-devel: popt-static: size_t underflow in singleoptionhelp

An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of service of the affected application.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Popt-devel Redhat
Products
Popt-static Enterprise Linux Hardened Images and 5 more
CVE-2026-18743

Popt-devel: popt-static: short realloc in poptconfigfiletostring

A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the `poptConfigFileToString` function reallocates memory for buffers. Successful exploitation could result in heap metadata corruption, potentially causing the affected process to become unavailable (denial of service).

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Redhat Rpm-software-management
Products
Enterprise Linux Hardened Images Hummingbird and 5 more
CVE-2026-18739

Popt-devel: popt-static: off-by-one in poptstuffargs

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Popt-devel Redhat
Products
Popt-static Enterprise Linux Hummingbird and 3 more
CVE-2026-17591

Libarchive: libarchive: use-after-free via aliased mac metadata copy

A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Libarchive Red Hat Redhat
Products
Libarchive Enterprise Linux Enterprise Linux and 4 more
CVE-2026-16517

Libarchive: libarchive: signed integer overflow in archive_write_zip_header

A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Libarchive Redhat
Products
Libarchive Enterprise Linux Hardened Images and 4 more
CVE-2026-12969

Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation

An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dnsmasq Redhat Thekelleys
Products
Dnsmasq Enterprise Linux Openshift and 3 more
CVE-2026-2243

Qemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsing

A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read vulnerability, potentially leading to a 12-byte leak of sensitive information or a denial of service condition (DoS).

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Openshift and 2 more
CVE-2026-15812

Kronosnet: kronosnet: access control list bypass via link id spoofing on unencrypted dynamic links

A vulnerability was found in the internal Access Control List (ACL) subsystem of kronosnet (Version affected: <= 1.34). When the framework is explicitly configured to manage dynamic links (accepting network traffic from any IP address) without network payload encryption, the validation architecture implicitly trusts the link ID provided within incoming data packets. A remote, unauthenticated attacker can exploit this lack of validation by spoofing a legitimate link ID inside crafted network frames. This allows the attacker to fully bypass the ACL framework and inject arbitrary data packets into the application layer, potentially leading to data corruption or service instabilities.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openshift Container Platform
CVE-2026-1485

Glib: glib: local denial of service via buffer underflow in content type parsing

A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.

CVSS 3.1 · 2.8 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Ai Rhel Els
CVE-2025-6170

Libxml2: stack buffer overflow in xmllint interactive shell command handling

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Ai Inference Server Cert Manager Discovery and 17 more
CVE-2025-5918

Libarchive: reading past eof may be triggered for piped file streams

A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Libarchive Redhat
Products
Libarchive Enterprise Linux Openshift and 3 more
CVE-2025-5917

Libarchive: off by one error in build_ustar_entry_name() at archive_write_set_format_pax.c

A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0.

CVSS 3.1 · 2.8 Low EPSS < 1% KEV · Not listed
Vendors
Libarchive Redhat
Products
Libarchive Enterprise Linux Openshift and 3 more
CVE-2025-5916

Libarchive: integer overflow while reading warc files at archive_read_support_format_warc.c

A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Libarchive Redhat
Products
Libarchive Enterprise Linux Openshift and 3 more
CVE-2025-5915

Libarchive: heap buffer over read in copy_from_lzss_window() at archive_read_support_format_rar.c

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Libarchive Redhat
Products
Libarchive Enterprise Linux Openshift and 3 more
CVE-2026-114236

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Advanced Cluster Security Ansible Automation Platform Certifications and 16 more