CVE-2026-3184

Util-linux: util-linux: access control bypass due to improper hostname canonicalization

A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Kernel Linux Redhat

Products

Util-linux Util-linux Enterprise Linux and 4 more

CVE-2026-28295

Gvfs: gvfs ftp backend: information disclosure via untrusted pasv responses

A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the malicious server to probe for open ports accessible from the client's network.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-2340

Samba: vfs_worm does not block directory modification

A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Enterprise Linux Eus Openshift and 8 more

CVE-2026-2708

Libsoup: libsoup: http request smuggling via duplicate content-length headers

A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Gnome Libsoup Redhat

Products

Libsoup Libsoup Enterprise Linux and 1 more

CVE-2026-9797

Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator

A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak

CVE-2026-97367

Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover

A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Red Hat Single Sign On

CVE-2026-96447

Keycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebinding

A flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution. The issue occurs during the validation of stateless access tokens when the original user ID no longer exists. Keycloak incorrectly falls back to using the username to identify the user without verifying if the identity matches the original token subject. This could allow an attacker with an old token to gain access to a newly created service account if it shares the same client ID as a previously deleted one.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Red Hat Single Sign On

CVE-2026-19688

Keycloak-services: keycloak-services: admin api missing audience check

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Red Hat Single Sign On

CVE-2026-19608

Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Build Of Keycloak Red Hat Single Sign On and 1 more

CVE-2026-15713

Libsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leak

A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Libsoup Redhat

Products

Libsoup Enterprise Linux Rhel Els

CVE-2026-114232

Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access

A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more

CVE-2026-110932

Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache

A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more

CVE-2025-4476

Libsoup: null pointer dereference in libsoup may lead to denial of service

A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-2443

Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure

A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome Red Hat Redhat

Products

Libsoup Enterprise Linux Enterprise Linux and 1 more

CVE-2026-19411

Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-18839

Popt-devel: popt-static: size_t underflow in singleoptionhelp

An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of service of the affected application.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Popt-devel Redhat

Products

Popt-static Enterprise Linux Hardened Images and 5 more

CVE-2026-18743

Popt-devel: popt-static: short realloc in poptconfigfiletostring

A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the `poptConfigFileToString` function reallocates memory for buffers. Successful exploitation could result in heap metadata corruption, potentially causing the affected process to become unavailable (denial of service).

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Redhat Rpm-software-management

Products

Enterprise Linux Hardened Images Hummingbird and 5 more

CVE-2026-18739

Popt-devel: popt-static: off-by-one in poptstuffargs

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Popt-devel Redhat

Products

Popt-static Enterprise Linux Hummingbird and 3 more

CVE-2026-17591

Libarchive: libarchive: use-after-free via aliased mac metadata copy

A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Libarchive Red Hat Redhat

Products

Libarchive Enterprise Linux Enterprise Linux and 4 more

CVE-2026-17072

Gstreamer1-plugins-good: gst-plugins-good: 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing flac codec data in matroska containers

A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Gstreamer Redhat

Products

Good Plug-ins Enterprise Linux Rhel Els