Export limit exceeded: 17080 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,080

Export CSV
CVE-2026-86566

Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dpdk Red Hat Redhat
Products
Dpdk Enterprise Linux Enterprise Linux and 3 more
CVE-2026-86561

Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dpdk Red Hat Redhat
Products
Dpdk Enterprise Linux Enterprise Linux and 5 more
CVE-2026-100236

Dpdk: dpdk: heap out-of-bounds read/write in gso header copy

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Dpdk Redhat
Products
Dpdk Enterprise Linux Openshift and 1 more
CVE-2026-86848

Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto

A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openstack
CVE-2026-86567

Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap

A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Dpdk Red Hat Redhat
Products
Dpdk Enterprise Linux Enterprise Linux and 5 more
CVE-2026-86565

Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Dpdk Red Hat Redhat
Products
Dpdk Enterprise Linux Enterprise Linux and 5 more
CVE-2026-86562

Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openstack
CVE-2026-97024

Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Flatpak Redhat
Products
Flatpak Enterprise Linux Enterprise Linux Eus and 3 more
CVE-2026-97023

Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Flatpak Redhat
Products
Flatpak Enterprise Linux Enterprise Linux Eus and 3 more
CVE-2026-74860

Libxml2: double-free/uaf in libxml2 python bindings

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cert Manager Cost Management On Premise Enterprise Linux and 13 more
CVE-2026-97185

Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux Rhel E4s and 1 more
CVE-2026-92248

Gimp: integer overflow when generating a thumbnail preview for a psd file

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a heap-based buffer overflow when the image data is decoded. This buffer overflow corrupts adjacent heap objects, allowing for a controlled memory write that can result in an application crash or arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gnome Red Hat Redhat
Products
Gimp Enterprise Linux Enterprise Linux and 2 more
CVE-2026-90948

Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gimp Red Hat Redhat
Products
Gimp Enterprise Linux Enterprise Linux and 2 more
CVE-2026-90947

Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gnome Red Hat Redhat
Products
Gimp Enterprise Linux Enterprise Linux and 2 more
CVE-2026-85234

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Hummingbird Rhel Els
CVE-2026-91205

Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2026-91202

Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2026-94184

Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Els
CVE-2026-87853

Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation

A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix of a target user's identifier can authenticate as the target user.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat Sssd
Products
Enterprise Linux Openshift Openshift Container Platform and 2 more