Export limit exceeded: 26160 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 62

Export CSV
CVE-2026-86561

Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dpdk Red Hat Redhat
Products
Dpdk Enterprise Linux Enterprise Linux and 5 more
CVE-2026-86567

Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap

A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Dpdk Red Hat Redhat
Products
Dpdk Enterprise Linux Enterprise Linux and 5 more
CVE-2026-86565

Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Dpdk Red Hat Redhat
Products
Dpdk Enterprise Linux Enterprise Linux and 5 more
CVE-2026-80179

Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Openshift Ai (rhoai) Ansible Automation Platform Enterprise Linux and 3 more
CVE-2026-93009

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dnsmasq Red Hat Redhat
Products
Dnsmasq Enterprise Linux Ceph Storage and 6 more
CVE-2026-93010

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dnsmasq Red Hat Redhat
Products
Dnsmasq Enterprise Linux Ceph Storage and 6 more
CVE-2026-93011

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dnsmasq Red Hat Redhat
Products
Dnsmasq Enterprise Linux Ceph Storage and 6 more
CVE-2026-93007

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dnsmasq Red Hat Redhat
Products
Dnsmasq Enterprise Linux Ceph Storage and 6 more
CVE-2026-93006

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Dnsmasq Red Hat Redhat
Products
Dnsmasq Enterprise Linux Ceph Storage and 6 more
CVE-2026-84828

Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token

A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read with root privileges by the pcsd daemon and can be exfiltrated by the attacker through subsequent cluster node communication. This allows disclosure of sensitive data such as API keys, tokens, or configuration secrets that would otherwise be inaccessible to the attacker.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openshift Container Platform and 2 more
CVE-2026-84185

Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Openshift Ai (rhoai) Ansible Automation Platform Enterprise Linux and 4 more
CVE-2026-34956

Openvswitch: open vswitch: denial of service via malformed ftp epasv command

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Fast Datapath Openshift and 5 more
CVE-2026-93834

Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Enterprise Linux For Nvidia 26 and 6 more
CVE-2026-93008

Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Dnsmasq Red Hat Redhat
Products
Dnsmasq Enterprise Linux Ceph Storage and 6 more
CVE-2026-92925

Redis: redis: out-of-bounds read via crafted cluster bus packets

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Pen Drive Powered By Red Hat Lightspeed Red Hat Openshift Ai (rhoai) 3scale and 19 more
CVE-2026-81627

Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Enterprise Linux For Nvidia 26 and 6 more
CVE-2026-11837

Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown

A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Eus Openstack and 5 more
CVE-2026-83536

Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header bytes, the attacker can exhaust server resources, specifically file descriptors, leading to a Denial of Service (DoS) that prevents legitimate Prometheus metric scraping and alerting.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openstack Openstack Platform
CVE-2026-83535

Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison

A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openstack Openstack Platform