Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 230

Export CSV
CVE-2026-2443

Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure

A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Red Hat Redhat
Products
Libsoup Enterprise Linux Enterprise Linux and 1 more
CVE-2026-17591

Libarchive: libarchive: use-after-free via aliased mac metadata copy

A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Libarchive Red Hat Redhat
Products
Libarchive Enterprise Linux Enterprise Linux and 4 more
CVE-2026-2243

Qemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsing

A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read vulnerability, potentially leading to a 12-byte leak of sensitive information or a denial of service condition (DoS).

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Openshift and 2 more
CVE-2026-111802

Nautilus: nautilus: arbitrary file deletion via trash symlink

A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Rhel Els
CVE-2026-118475

Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the application to read past the allocated buffer. This issue can lead to an application crash, resulting in a Denial of Service (DoS), or potentially expose sensitive memory contents.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Gnome Red Hat Redhat
Products
Eog Enterprise Linux Enterprise Linux and 1 more
CVE-2026-110036

Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Openshift and 2 more
CVE-2026-109854

M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding

A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
M17n-lib Red Hat Redhat
Products
M17n-lib Enterprise Linux Enterprise Linux and 1 more
CVE-2026-93566

Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Amq Broker 7 Amq Broker Amq Clients and 19 more
CVE-2026-82965

Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing

A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-107123

Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing

A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more
CVE-2026-93565

Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte

A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Amq Broker 7 Amq Broker Amq Clients and 20 more
CVE-2026-83494

Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)

A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Openshift Ai (rhoai) Openshift Ai
CVE-2026-123151

Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail

A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Hardened Images and 2 more
CVE-2026-121994

Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length

A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub's register reply into an alloca-sized buffer without bounding writes by the register width.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Hardened Images and 2 more
CVE-2026-9150

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse Red Hat Redhat
Products
Libsolv Red Hat Satellite 6 Enterprise Linux and 10 more
CVE-2026-9149

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse Red Hat Redhat
Products
Libsolv Red Hat Satellite 6 Enterprise Linux and 11 more
CVE-2026-14164

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Libarchive Red Hat Redhat
Products
Libarchive Enterprise Linux Ai Inference Server and 13 more
CVE-2026-120194

Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Json-glib Red Hat Redhat
Products
Json-glib Enterprise Linux Enterprise Linux and 4 more
CVE-2026-121997

Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Hardened Images and 2 more
CVE-2026-93011

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dnsmasq Red Hat Redhat
Products
Dnsmasq Enterprise Linux Ceph Storage and 6 more