CVE-2026-88770

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-88763

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...

CVE-2026-78679

A flaw was found in GitPython. A remote attacker with low privileges can exploit a vulnerability in the TagReference.create function, where a positional reference parameter bypasses a security guard. This allows the attacker to supply a specially crafted reference value, such as --file=, to read...

CVE-2026-64846

A flaw was found in Nix. A malicious derivation, when executed with the recursive-nix experimental feature enabled, can exploit a time-of-check/time-of-use TOCTOU race condition in the final symlink handling of the LocalStore restore path. This allows the Nix process or nix-daemon to create or...

CVE-2026-79516

A flaw was found in nothings stb. An out-of-bounds read vulnerability exists in the stbspvsnprintf function. A local attacker could exploit this by sending a specially crafted input. This could lead to a Denial of Service DoS, making the affected system unavailable. Mitigation Mitigation for this...

CVE-2026-79515

A flaw was found in the stb component. An out-of-bounds read vulnerability in the stbttGetGlyphShape function allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted TrueType Font TTF file. This can lead to the affected application becoming unresponsive or crashin...

CVE-2026-87825

A flaw was found in zstd-jni. This use-after-free vulnerability occurs because streams and contexts only hold a dictionary's shared lock during the load call, allowing the dictionary to be closed while still being referenced. A remote attacker could exploit this by closing a dictionary after...

CVE-2026-38998

A flaw was found in LIVE555 Streaming Media. This use-after-free vulnerability allows a remote attacker to cause a Denial of Service DoS. By sending a series of specially crafted Real-Time Streaming Protocol RTSP and Hypertext Transfer Protocol HTTP requests, an attacker can trigger the flaw,...

CVE-2026-49363

A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBETOPOLOGYV2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore, no credential...

CVE-2026-57822

A flaw was found in Apache ActiveMQ Artemis. The JsonUtil.fromJsonArray method uses ObjectInputStream.readObject to deserialize CompositeData from Base64-encoded serialized objects in management message bodies sent to the activemq.management address. While the deserialization is protected by an...

CVE-2026-49364

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

CVE-2026-49362

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

CVE-2026-57967

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

CVE-2026-67593

An unauthenticated network attacker can delete arbitrary durable queues on any Apache Artemis broker with OpenWire protocol enabled default. The processRemoveSubscription method executes pre-authentication with no authorization check, and uses the internal destroyQueueSimpleString overload that...

CVE-2026-19816

A flaw was found in PackageKit. In the dnf5 backend, the RepoRemove handler ignores the SIMULATE transaction flag and executes a real package removal, allowing an unprivileged local user to uninstall packages without polkit authorization. Mitigation Affects v1.3.4 through v1.3.6. Fixed in commit...

CVE-2026-47837

A flaw was found in Spring Cloud Config Server. This vulnerability allows an unauthenticated remote attacker to send webhook requests to the /monitor endpoint without validation. This lack of authentication for a critical function could lead to a denial of service DoS condition, making the server...

CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2026-87822

A flaw was found in t-digest. A remote attacker can exploit a vulnerability in the MergingDigest.fromBytes deserialization process by injecting specially crafted "Not a Number" NaN values. These malicious values bypass validation checks, degrading sorting performance from efficient to significant...

CVE-2026-70653

A flaw was found in libvips. A heap-based buffer read overflow vulnerability exists in the old-style Radiance RLE decoder. A remote attacker could exploit this by providing a specially crafted Radiance image. This could lead to the disclosure of four bytes of adjacent heap data, potentially...

CVE-2026-87876

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations. Mitigation Fixed on upstream master branch...

CVE-2026-73324

A flaw was found in VLC media player. A remote attacker operating a hostile server can exploit a heap out-of-bounds read vulnerability. This occurs when the media player processes an unterminated Real Time Streaming Protocol RTSP response line, causing it to read beyond the allocated buffer...

CVE-2026-48206

A flaw was found in the Apache Camel JIRA component. Due to improper input validation, non-Camel-prefixed Exchange header constants can bypass the HTTP header filter. This allows a remote attacker, potentially unauthenticated, to supply specific headers and override intended values. Consequently,...

CVE-2026-87872

A flaw was found in the OCAPI modules ocapicommand, ocapiinfo of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an http...

CVE-2026-87875

The cupsUTF32ToUTF8 function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content. Mitigation...

CVE-2026-87853

A flaw was found in SSSD's IdP authentication provider. The evalaccesstokenbuf function compares the OIDC subject identifier using strncmp with the authenticated user's identifier length, performing a prefix comparison instead of an exact match. An attacker whose IdP identifier is a strict prefix...

CVE-2026-87874

A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on...

CVE-2026-56711

A flaw was found in VLC media player. An integer overflow vulnerability exists when computing the size of a picture buffer, specifically in the AllocatePicture function. A remote attacker could exploit this by providing a specially crafted Portable Network Graphics PNG image file with large width...

CVE-2026-77354

A flaw was found in kin-openapi, a Go project for handling OpenAPI files. An unauthenticated client can exploit this vulnerability by sending a specially crafted query with a large index in a deepObject query parameter. This forces the application to allocate multi-gigabyte memory, leading to an...

CVE-2026-57159

A flaw was found in PJSIP. An out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. A remote attacker can trigger this via payload-type numbers taken from a remote SDP offer or answer, which are used as an index to access...

CVE-2026-87817

A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can th...

CVE-2026-67434

A flaw was found in PHPCodeSniffer. This command injection vulnerability allows an attacker to execute arbitrary shell commands. This occurs when PHPCodeSniffer processes untrusted files with specially crafted filenames containing shell metacharacters, specifically when generating Gitblame,...

CVE-2026-57163

A flaw was found in PJSIP. A stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate. A remote attacker can exploit this by presenting a specially crafted certificate during the TLS handshake, before SIP-level authentication...

CVE-2026-57162

A flaw was found in PJSIP. A stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer negotiation. A remote attacker can exploit this by sending an excessive number of a=crypto attributes in a single media description. This can resu...

CVE-2026-73334

A flaw was found in Apache Parquet Hadoop. When processing a Parquet file, if the Key Management Service KMS Uniform Resource Locator URL is controlled by the file and not explicitly set by the application, a vulnerability can arise. An attacker could craft a malicious Parquet file to direct a KM...

CVE-2026-87795

A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the ZstdDictCompress constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of...

CVE-2026-87818

A flaw was found in GitPython. This vulnerability allows an attacker to read arbitrary files on the system by manipulating the --no-index option in the diff API. By combining this with other options, an attacker can repeatedly query local files to extract sensitive information, such as single-lin...

CVE-2026-78678

A flaw was found in GitPython. An incomplete denylist in the unsafegitrevisionoptions guard omits --contents and -S options. This allows an attacker to read arbitrary files by passing these options to the Repo.blame function. This can lead to information disclosure, as attackers can supply revisi...

CVE-2026-73073

A flaw was found in Vim, an open-source command-line text editor. An attacker could craft a malicious tags file that, when processed by Vim's C omni-completion feature, leads to insufficient escaping of input. This vulnerability allows for the execution of arbitrary Ex commands and, subsequently,...

CVE-2026-86776

A flaw was found in KeePass. An attacker can craft a malicious KDBX file that declares excessively large header field lengths. When a user opens this file, the application attempts to allocate gigabytes of memory, leading to resource exhaustion and causing the application to terminate. This...

CVE-2026-59643

A flaw was found in Bouncy Castle for Java and Bouncy Castle for Java FIPS BC-FJA. This vulnerability allows an attacker to bypass OpenPGP inline-signature policy failures, which are silently ignored by the software. This silent disregard of policy failures can lead to a compromise of data...

CVE-2026-58061

A flaw was found in Bouncy Castle for Java. When using CCM-family Counter with CBC-MAC modes, the software writes plaintext data into a buffer before verifying the cryptographic tag. This could allow an attacker to manipulate data that is later assumed to be authentic, leading to a high integrity...

CVE-2026-78662

A flaw was found in golang.org/x/crypto/ssh. A malicious remote attacker could flood a channel's incoming requests before it is established, leading to a deadlock of the entire connection. This could result in a denial of service DoS for legitimate users. Mitigation Red Hat is not aware of a...

CVE-2026-0799

A flaw was found in libpcap. The Berkeley Packet Filter BPF interpreter in libpcap does not properly validate register indexes in BPF instructions. A local attacker could craft a malicious filter program to trigger an out-of-bounds read and write vulnerability. This could allow the attacker to re...

CVE-2026-56855

A flaw was found in golang.org/x/crypto/ssh. After a channel has been established, a remote malicious peer could send specially crafted messages. This could lead to a deadlock of the entire connection, resulting in a Denial of Service DoS for the affected system. Mitigation Red Hat is not aware o...

CVE-2026-31911

A flaw was found in libpcap. A local attacker could provide a crafted filter program containing an invalid Berkeley Packet Filter BPF opcode. This could cause the operating system OS process using libpcap to terminate, leading to a Denial of Service DoS...

CVE-2026-18313

A flaw was found in libpcap, specifically within the rpcapd daemon. This vulnerability allows a remote attacker to cause a denial of service DoS by sending specially crafted RPCAPMSGUPDATEFILTERREQ or RPCAPMSGSTARTCAPREQ messages. The rpcapd daemon allocates memory for these messages but fails to...

CVE-2026-18238

A flaw was found in libpcap. The rpcap client code, which processes RPCAPMSGPACKET messages from a server, incorrectly validates its headers. A malicious server could exploit this vulnerability by sending a specially crafted message, causing the client to read up to 20 bytes of memory beyond its...

CVE-2026-6244

A flaw was found in libpcap. The Berkeley Packet Filter BPF interpreter's 'div k' and 'mod k' instructions do not validate if the immediate value 'k' is zero. A local attacker with low privileges could exploit this by providing a specially crafted filter program, leading to a division-by-zero...

CVE-2026-6554

A flaw was found in libpcap. The Berkeley Packet Filter BPF interpreter incorrectly handles offsets in 'ja L' instructions, allowing backward jumps without limiting loop iterations. A local attacker could provide a specially crafted filter program, leading to an infinite loop and causing a Denial...

CVE-2026-87766

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is...