CVE-2026-58016

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Glib Cert-manager Operator Cert Manager and 22 more

CVE-2023-3972

Insights-client: unsafe handling of temporary files and directories

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local user or attacker could create the /var/tmp/insights-client directory (owning the directory with read, write, and execute permissions) on the system. After the insights-client is registered by root, an attacker could then control the directory content that insights are using by putting malicious scripts into it and executing arbitrary code as root (trivially bypassing SELinux protections because insights processes are allowed to disable SELinux system-wide).

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Aus Enterprise Linux Desktop and 21 more

CVE-2025-62231

Xorg: xmayland: value overflow in xkbsetcompatmap()

A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Debian Ibm Redhat and 1 more

Products

Debian Linux Aix Vios and 14 more

CVE-2025-62230

Xorg: xwayland: use-after-free in xkb client resource removal

A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Debian Ibm Redhat and 1 more

Products

Debian Linux Aix Vios and 14 more

CVE-2026-5201

Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of service (DoS) conditions.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Gnome Redhat

Products

Gdk-pixbuf Ai Inference Server Enterprise Linux and 21 more

CVE-2024-3183

Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force

A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the target principal key directly. For user principals, this key is a hash of a public per-principal randomly-generated salt and the user’s password. If a principal is compromised it means the attacker would be able to retrieve tickets encrypted to any principal, all of them being encrypted by their own key directly. By taking these tickets and salts offline, the attacker could run brute force attacks to find character strings able to decrypt tickets when combined to a principal salt (i.e. find the principal’s password).

CVSS 3.1 · 8.1 High EPSS 2.1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Aus Enterprise Linux Eus and 6 more

CVE-2024-0229

Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access

An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed

Vendors

Fedoraproject Redhat X.org

Products

Fedora Enterprise Linux Enterprise Linux Aus and 10 more

CVE-2015-5477

bind: TKEY query handling flaw leading to denial of service

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

CVSS 3.1 · 7.5 High EPSS 99.6% KEV · Listed

Vendors

Apple Canonical Debian and 10 more

Products

Os X Server Ubuntu Linux Debian Linux and 76 more

CVE-2026-46300

net: skbuff: preserve shared-frag marker during coalescing

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

CVSS 3.1 · 7.8 High EPSS 16.1% KEV · Listed

Vendors

Linux Redhat Siemens

Products

Kernel Linux Kernel Enterprise Linux and 7 more

CVE-2026-39979

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Jqlang Redhat

Products

Jq Ai Inference Server Ansible Automation Platform and 11 more

CVE-2026-31431

crypto: algif_aead - Revert to operating out-of-place

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

CVSS 3.1 · 7.8 High EPSS 98.1% KEV · Listed

Vendors

Amazon Arista Canonical and 7 more

Products

Amazon Linux Cloudvision Agni Cloudvision Portal and 57 more

CVE-2016-5195

kernel: mm: privilege escalation via MAP_PRIVATE COW breakage

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

CVSS 3.1 · 7.0 High EPSS 83.5% KEV · Listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 21 more

CVE-2025-31277

webkitgtk: Processing maliciously crafted web content may lead to memory corruption

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Listed

Vendors

Apple Redhat Webkitgtk and 1 more

Products

Ios Ipados Iphone Os and 20 more

CVE-2020-1045

Microsoft ASP.NET Core Security Feature Bypass Vulnerability

<p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.</p> <p>The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names.</p>

CVSS 3.1 · 7.5 High EPSS 5.9% KEV · Not listed

Vendors

Fedoraproject Microsoft Redhat

Products

Fedora Asp.net Core Enterprise Linux and 4 more

CVE-2023-47038

Perl: write past buffer end via illegal user-defined unicode property

A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Perl Redhat

Products

Fedora Perl Enterprise Linux and 2 more

CVE-2016-9901

Mozilla: Data from Pocket server improperly sanitized before execution (MFSA 2016-94, MFSA 2016-95)

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

CVSS 3.0 · 9.8 Critical EPSS 2.8% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Enterprise Linux Enterprise Linux Aus and 4 more

CVE-2017-7824

Mozilla: Buffer overflow when drawing and validating elements with ANGLE (MFSA 2017-22)

A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.

CVSS 3.0 · 9.8 Critical EPSS 3.5% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Thunderbird and 6 more

CVE-2021-3669

kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts

A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Ibm and 2 more

Products

Debian Linux Fedora Spectrum Copy Data Management and 21 more

CVE-2017-10661

kernel: Handling of might_cancel queueing is not properly pretected against race

Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing.

CVSS 3.1 · 7.0 High EPSS 13.5% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 9 more

CVE-2014-9585

kernel: ASLR bruteforce possible for vdso library

The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 19 more