Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17

Export CSV
CVE-2026-84503

Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce

A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Ansible Automation Platform Ansible Core and 15 more
CVE-2026-114236

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Advanced Cluster Security Ansible Automation Platform Certifications and 16 more
CVE-2026-19391

Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded archives

A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Certification For Red Hat Enterprise Linux Certifications Enterprise Linux and 2 more
CVE-2025-11065

Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Advanced Cluster Security Certifications and 10 more
CVE-2026-89091

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory. This allows an attacker who can get a victim to install a malicious collection to overwrite arbitrary files with the privileges of the user running ansible-galaxy, leading to code execution on the control node. This is a bypass of the fix for CVE-2020-10691.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Ansible Automation Platform Ansible Core and 11 more
CVE-2026-107935

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Certifications Edge Manager Enterprise Linux and 5 more
CVE-2024-1394

Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Ansible Automation Platform Developer Ansible Automation Platform Inside and 21 more
CVE-2023-44487

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed
Vendors
Akka Amazon Apache and 30 more
Products
Http Server Opensearch Data Prepper Apisix and 375 more
CVE-2019-3897

redhat-certification: /rhcert allows to download any file under /var/www/rhcert directory

It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know its name. Red Hat Certification 6 and 7 is vulnerable to this issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Certification Enterprise Linux
CVE-2018-10870

redhat-certification: rhcertStore.py: __saveResultsFile allows to write any file

redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution.

CVSS 3.0 · 9.8 Critical EPSS 6.1% KEV · Not listed
Vendors
Redhat
Products
Certification Certifications Enterprise Linux
CVE-2018-10869

redhat-certification: /download allows to download any file

redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd.

CVSS 3.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Redhat
Products
Certification Certifications Enterprise Linux
CVE-2018-10868

redhat-certification: billion laugh attack when getting the status of a host

redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user to run a "Billion Laugh Attack" by replying to XMLRPC methods when getting the status of an host.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Certification
CVE-2018-10867

redhat-certification: /uploads/results page allows to remove files

Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file accessible by the apached user.

CVSS 3.1 · 9.1 Critical EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Certification
CVE-2018-10866

redhat-certification: remove a "system" file without authorization

It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to remove a "system" file, that is an xml file with host related information, not belonging to him.

CVSS 3.1 · 9.1 Critical EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Certification
CVE-2018-10865

redhat-certification: "restart" a node without authorization

It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to call a "restart" RPC method on any host accessible by the system, even if not belonging to him.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Certification
CVE-2018-10864

redhat-certification: resource consumption in DocumentBase:loadFiltered

An uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may provide an existing but invalid XML file which would be opened and never closed, possibly producing a Denial of Service.

CVSS 3.0 · 5.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Certification Certifications Linux
CVE-2018-10863

redhat-certification: directory listing in /rhcert-transfer

It was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the /var/www/rhcert/store/transfer directory, through the /rhcert-transfer URL. An unauthorized attacker may use this flaw to gather sensible information.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Certification