Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2026-86320

Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Enterprise Linux Eus and 5 more
CVE-2026-93683

Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou

A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openstack
CVE-2026-86856

Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openstack
CVE-2026-86849

Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto

A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openstack
CVE-2026-86847

Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup

A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openstack
CVE-2026-86846

Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto

A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dpdk Redhat
Products
Dpdk Enterprise Linux Openshift and 1 more
CVE-2026-86845

Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup

A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openstack
CVE-2026-86566

Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dpdk Red Hat Redhat
Products
Dpdk Enterprise Linux Enterprise Linux and 3 more
CVE-2026-86561

Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dpdk Red Hat Redhat
Products
Dpdk Enterprise Linux Enterprise Linux and 5 more
CVE-2026-100236

Dpdk: dpdk: heap out-of-bounds read/write in gso header copy

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Dpdk Redhat
Products
Dpdk Enterprise Linux Openshift and 1 more
CVE-2026-86848

Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto

A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openstack
CVE-2026-86567

Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap

A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Dpdk Red Hat Redhat
Products
Dpdk Enterprise Linux Enterprise Linux and 5 more
CVE-2026-86565

Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Dpdk Red Hat Redhat
Products
Dpdk Enterprise Linux Enterprise Linux and 5 more
CVE-2026-86562

Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openstack
CVE-2026-97024

Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Flatpak Redhat
Products
Flatpak Enterprise Linux Enterprise Linux Eus and 3 more
CVE-2026-97023

Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Flatpak Redhat
Products
Flatpak Enterprise Linux Enterprise Linux Eus and 3 more
CVE-2026-74860

Libxml2: double-free/uaf in libxml2 python bindings

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cert Manager Cost Management On Premise Enterprise Linux and 13 more
CVE-2026-97185

Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux Rhel E4s and 1 more
CVE-2026-92248

Gimp: integer overflow when generating a thumbnail preview for a psd file

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a heap-based buffer overflow when the image data is decoded. This buffer overflow corrupts adjacent heap objects, allowing for a controlled memory write that can result in an application crash or arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gnome Red Hat Redhat
Products
Gimp Enterprise Linux Enterprise Linux and 2 more