Export limit exceeded: 55523 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 55,523

Export CSV
CVE-2026-106066

Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions

A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, g_malloc() sizing based on overflowing width * height * bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux Rhel Els
CVE-2026-106065

Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions

A heap-based buffer overflow was found in GIMP’s PCX export plug-in. For images with extremely large width and height, buffer allocation uses overflowing 32-bit width * height arithmetic while subsequent GEGL operations use the full extent, after integer overflow in size calculation

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux Rhel Els
CVE-2026-106064

Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions

A heap-based buffer overflow was found in GIMP’s GIF export plug-in. Exporting an image with very large width and height can cause 32-bit overflow when computing the pixel buffer size. The plug-in allocates a buffer based on the wrapped value while GEGL writes using the true image extent, rooted in integer overflow

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gimp Red Hat Redhat
Products
Gimp Enterprise Linux Enterprise Linux and 1 more
CVE-2026-106063

Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux Rhel Els
CVE-2026-106061

Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file

A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gimp Red Hat Redhat
Products
Gimp Enterprise Linux Enterprise Linux and 1 more
CVE-2026-104048

Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Sssd
Products
Sssd Enterprise Linux Openshift and 3 more
CVE-2026-104047

Sssd: sssd: information disclosure via query injection in entra id lookups

A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Sssd
Products
Sssd Enterprise Linux Openshift and 3 more
CVE-2026-104043

Sssd: sssd: denial of service via undersized packet parsing in nss responder

A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the responder process and resulting in a Denial of Service (DoS).

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Sssd
Products
Enterprise Linux Openshift Openshift Container Platform and 2 more
CVE-2026-104042

Sssd: sssd: denial of service via out-of-bounds read in pam responder

A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token to the responder socket. Due to missing input validation, the service attempts to read beyond buffer boundaries when processing the token, causing the PAM responder to crash.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Sssd
Products
Enterprise Linux Openshift Openshift Container Platform and 2 more
CVE-2026-104037

Sssd: sssd: denial of service via packet length underflow in autofs responder

A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS).

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Sssd
Products
Enterprise Linux Openshift Openshift Container Platform and 2 more
CVE-2026-104033

Sssd: sssd: access control bypass via improper ldap shadow expiration check

A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system. This allows unauthorized access to persist after the account was intended to be deactivated.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Sssd
Products
Enterprise Linux Openshift Openshift Container Platform and 2 more
CVE-2026-104030

Sssd: sssd: denial of service via out-of-bounds read during passkey parsing

A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash and disrupting authentication services.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Sssd
Products
Sssd Enterprise Linux Openshift and 3 more
CVE-2026-103641

Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder

A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application that uses the loader.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gegl Redhat
Products
Gegl Enterprise Linux Rhel Els
CVE-2025-47712

Nbd: nbdkit: integer overflow triggers an assertion resulting in denial of service

A flaw exists in the nbdkit "blocksize" filter that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in the nbdkit, leading to a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Nbdkit Project Redhat
Products
Nbdkit Advanced Virtualization Enterprise Linux and 2 more
CVE-2025-47711

Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service

There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error, leading to a denial-of-service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Nbdkit Project Redhat
Products
Nbdkit Advanced Virtualization Enterprise Linux and 2 more
CVE-2025-46397

Xfig: xfig: stack-overflow allows possible code execution via local input manipulation

A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fig2dev Project Redhat
Products
Fig2dev Enterprise Linux Rhel Els and 1 more
CVE-2025-4877

Libssh: write beyond bounds in binary to base64 conversion functions

There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when that happens it's possible that the program perform out of bounds write leading to a heap corruption. This issue affects only 32-bits builds of libssh.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Rhel Els
CVE-2025-4373

Glib: buffer underflow on glib through glib/gstring.c via function g_string_insert_unichar

A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Insights Proxy Openshift Distributed Tracing and 6 more
CVE-2025-5449

Libssh: integer overflow in libssh sftp server packet length validation leading to denial of service

A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Libssh Redhat
Products
Libssh Enterprise Linux Openshift and 1 more