CVE-2023-39417

Postgresql: extension script @substitutions@ within quoting allow sql injection

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed

Vendors

Debian Postgresql Redhat

Products

Debian Linux Postgresql Advanced Cluster Security and 8 more

CVE-2023-34968

Samba: spotlight server-side share path disclosure

A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path.

CVSS 3.1 · 5.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 5 more

CVE-2023-34967

Samba: type confusion in mdssvc rpc service for spotlight

A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves.

CVSS 3.1 · 5.3 Medium EPSS 61.2% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 5 more

CVE-2023-33952

Kernel: vmwgfx: double free within the handling of vmw_buffer_object objects

A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which may allow a local privileged user to escalate privileges and execute code in the context of the kernel.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Linux For Real Time and 3 more

CVE-2023-33951

Kernel: vmwgfx: race condition leading to information disclosure vulnerability

A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Linux For Real Time and 3 more

CVE-2023-32256

Kernel: ksmbd race issue from smb2 close and logoff with multichannel

A flaw was found in the Linux kernel's ksmbd component. A race condition between smb2 close operation and logoff in multichannel connections could result in a use-after-free issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2024-6387

Openssh: regresshion - race condition in ssh allows rce/dos

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

CVSS 3.1 · 8.1 High EPSS 99.5% KEV · Not listed

Vendors

Almalinux Amazon Apple and 10 more

Products

Almalinux Amazon Linux Macos and 83 more

CVE-2026-97027

Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files

Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Rhel Els

CVE-2026-97026

Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path

Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Rhel Els

CVE-2026-97025

Flatpak: flatpak: world-readable oci authentication token in system-helper cache path

Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources (e.g. as used by Fedora) are affected; libostree-based sources such as Flathub are not.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Rhel Els

CVE-2026-96546

Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader

A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately following the pixel buffer is inaccessible; no information disclosure or code execution has been demonstrated.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Gimp Redhat

Products

Gimp Enterprise Linux Rhel Els

CVE-2026-96284

Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Rhel Els

CVE-2026-96283

Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Rhel Els

CVE-2026-96282

Flatpak: flatpak: extension metadata path traversal file existence oracle

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Rhel Els

CVE-2026-93009

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dnsmasq Red Hat Redhat

Products

Dnsmasq Enterprise Linux Ceph Storage and 6 more

CVE-2026-93010

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dnsmasq Red Hat Redhat

Products

Dnsmasq Enterprise Linux Ceph Storage and 6 more

CVE-2026-91142

Cockpit: cockpit: unauthorized modification of login records via integer overflow

A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process to read or overwrite the legacy log entries of other accounts.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Dev Spaces Openshift Devspaces and 1 more

CVE-2026-90463

Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Els

CVE-2026-87876

Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed

Vendors

Openprinting Redhat

Products

Cups Enterprise Linux Hardened Images and 4 more

CVE-2026-85498

Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Polkit Project Redhat

Products

Polkit Enterprise Linux Hummingbird and 2 more