CVE-2026-95838

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are...

CVE-2026-95838

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are...

CVE-2026-95838

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are...

RHLW-2026-F00B5FBBBB907153 Lightwell Security Advisory: netty-codec-xml 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-xml 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-56817 and CVE-2026-73507. CVE-2026-56817: Netty: XML External Entity XXE injection via unconfigured XML factory when DTD and entity processing are enabled CVE-2026-73507: Netty:...

CVE-2026-109348 Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::frombytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers runnin...

CVE-2026-109348 Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing

Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::frombytes. Attackers can commit a crafted .mailmap with descending-ordered entries forcing repeated front inserts, blocking workers runnin...

CVE-2026-109348

The Gitoxide gix-mailmap component (versions before 0.35.0 ) is vulnerable to a CPU Denial of Service via quadratic-time parsing in Snapshot::from_bytes . An attacker can commit a crafted .mailmap file with descending-ordered entries, triggering repeated front inserts that exhaust CPU resources. ...

Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a cross-site scripting vulnerability. This vulnerability stems from the failure to properly validate and clean up the visual marker data in the imported CSV tracking files. This could allow attackers to induce authorized users with the “Read...

Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a cross-site scripting vulnerability. This vulnerability stems from the improper cleaning of annotation fields in the trace files rendered on the Trace page. As a result, attackers can induce authorized users with the “Read diagnostics” functi...

Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a cross-site scripting vulnerability. This vulnerability stems from the improper cleaning of the calculation signal data in the imported calculation signal files. During rendering on the Trace page, it is possible for attackers to induce users...

Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a cross-site scripting vulnerability. This vulnerability arises from rendering the signal names from the imported CSV tracking files in the Trace page’s menu, without properly cleaning those names. This can lead to cross-site scripting attacks...

Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a cross-site scripting vulnerability. This vulnerability arises from the improper cleaning of the names of calculation signals in the imported CSV tracking files. It may allow attackers to induce authorized users with “read diagnosis”...

Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a cross-site scripting vulnerability. This vulnerability stems from the improper cleaning of signal data calculated from imported CSV trace files. It may allow attackers to induce users with permission for the “Read diagnostics” function to...

Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a cross-site scripting vulnerability. This vulnerability arises from the improper validation and cleanup of the visual properties of signals before they are calculated in the imported CSV tracking files rendered on the Trace page. This allows...

Siemens SIMATIC Drive Controller CPU 1504D TF: Code injection vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a code injection vulnerability. This vulnerability stems from an improper limitation of the executable content contained in the imported trace files. It may allow attackers to induce authorized users with access to the “Read diagnostics”...

CVE-2026-107378

A flaw was found in CairoSVG. A remote attacker can cause a Denial of Service DoS by providing a specially crafted Scalable Vector Graphics SVG file containing paths with numerous segments. Inefficient path processing leads to excessive CPU resource consumption during rendering, causing the...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.5.3 (CPU)

Red Hat AI Base Images 3.5.3 CPU is now available. Red Hat® AI Base Images...

Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.5 (CPU)

Red Hat AI Base Images 3.3.5 CPU is now available. Red Hat® AI Base Images...

Important: Red Hat Security Advisory: jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

An update for multiple packages is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing

A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service DoS by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar fields from JSON strings,...