CVE-2026-84646

A flaw was found in Jenkins. An attacker with Overall/Read permission can exploit a deserialization vulnerability where user objects can appear as nested field values in other deserialized XML objects. By submitting crafted XML, the attacker can create unauthorized user objects. While these creat...

CVE-2026-19475

An authenticated user with permission to query a SQL datasource Microsoft SQL Server, PostgreSQL, or MySQL could bypass the fix for CVE-2026-33375 by injecting the $timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing fails to reject. Evaluating the injected macro...

CVE-2026-54523

A flaw was found in Kyverno, a policy engine for cloud-native platforms. A user with specific permissions to create policy objects in one area namespace can exploit a vulnerability where a namespace argument is not properly checked. This allows them to force the system's admission controller, whi...

CVE-2026-84647

A flaw was found in Stapler, a web framework included in Jenkins. This vulnerability allows an attacker with 'Overall/Read' permission to instantiate objects related to configuration through form data binding. The system does not properly restrict the types of objects that can be created, enablin...

CVE-2026-59272

A flaw was found in the Log4j2 AMQP Appender. When configured to ship logs to RabbitMQ over Transport Layer Security TLS, the appender disables hostname verification by default. This misconfiguration allows a remote attacker to perform a man-in-the-middle MITM attack, intercepting sensitive log...

CVE-2026-83557

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to control object creation by exploiting an incomplete list of restricted types in the DefaultBaseTypeLimitingValidator. By crafting malicious input, an attacker can cause the application to create arbitrary file...

CVE-2026-84649

A flaw was found in Stapler, a web framework used by Jenkins. An HTTP endpoint that serves dynamically generated JavaScript resources inadvertently embeds a user's cross-site request forgery CSRF token, also known as a crumb, as plain text. This allows a remote attacker, who controls a web page o...

CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

CVE-2026-65810

A flaw was found in .NET Framework. This vulnerability, caused by a relative path traversal, allows an unauthorized local attacker to elevate their privileges. By exploiting this flaw, an attacker can gain higher access rights than intended, potentially leading to unauthorized actions on the...

CVE-2026-71224

A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images. Mitigatio...

CVE-2026-71223

An integer overflow vulnerability was found in gfs2-utils. The resource group allocation size computation on 32-bit platforms causes an undersized buffer allocation followed by heap out-of-bounds writes when processing crafted GFS2 filesystem images. This vulnerability does not affect 64-bit...

CVE-2026-71222

A heap out-of-bounds read vulnerability was found in gfs2-utils. The eanumptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem...

CVE-2026-71221

A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images...

CVE-2026-71220

A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2edit, the diheight field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem image...

CVE-2026-71219

A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca with an exponentially-derived size from the untrusted on-disk didepth field without bounds validation. A crafted GFS2 filesystem image with a large didepth value causes stack exhaustion...

CVE-2026-47863

A flaw was found in Reactor Core. Applications using the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service DoS condition. This occurs when upstream components deliver items during an active flush, causing the processing pipeline to permanently hang an...

CVE-2026-47857

A flaw was found in Reactor Core. A remote attacker could exploit this vulnerability by using the Flux.windowTimeout operator with fairBackpressure enabled, leading to a Denial of Service DoS condition. This could cause applications to become unresponsive or crash. Mitigation Mitigation for this...

CVE-2026-62872

A flaw was found in .NET Framework. An authorized attacker could exploit incorrect authorization over a network to elevate their privileges. Mitigation No mitigation is required. Red Hat does not ship the Windows-only .NET Framework runtime...

CVE-2026-58641

A flaw was found in .NET. This vulnerability, caused by an integer overflow or wraparound, allows an unauthorized attacker to locally elevate their privileges. This could lead to an attacker gaining higher access rights than intended on the affected system. Mitigation No mitigation is required. R...

CVE-2026-62897

A flaw was found in .NET Framework. This integer overflow or wraparound vulnerability allows an unauthorized attacker to execute code locally. By exploiting this flaw, an attacker could gain control over the affected system. Mitigation No mitigation is required. Red Hat's .NET packages do not shi...

CVE-2026-81521

A flaw was found in the MongoDB Go Driver. The Client.BulkWrite operation does not properly validate database names, allowing a specially crafted name with reserved characters to redirect write operations. This vulnerability could enable an attacker to modify or corrupt data in unintended databas...

CVE-2026-70354

A flaw was found in .NET. This vulnerability, caused by an out-of-bounds write, could allow an unauthorized attacker to execute code locally. Exploitation requires local access and user interaction, but if successful, it can lead to significant impact on the system's confidentiality, integrity, a...

CVE-2026-62871

A flaw was found in .NET. An out-of-bounds write vulnerability allows an unauthorized attacker to execute arbitrary code locally. This could lead to a complete compromise of the affected system. Mitigation No mitigation is required. Red Hat's .NET packages do not ship the Windows Desktop runtime...

CVE-2026-85150

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length...

CVE-2026-81092

A flaw was found in mcp-go. This component failed to validate the Host header in HTTP requests, specifically within its StreamableHTTPServer and SSEServer transports. A remote attacker could exploit this by using a crafted web page to perform a DNS rebinding attack. This allows the attacker to...

CVE-2026-19032

A flaw was found in jackson-databind. When deserializing java.nio.file.Path from untrusted JSON input, the deserializer resolves an attacker-supplied Uniform Resource Identifier URI without restricting the URI scheme. This allows a remote attacker to select and drive an arbitrary registered...

CVE-2026-14673

An untrusted search path vulnerability in PostgreSQL's amcheck module allows a user with EXECUTE privileges to escalate privileges or execute arbitrary code. By setting a malicious search path before invoking an amcheck function, an attacker can hijack execution to run arbitrary SQL functions wit...

CVE-2026-82417

A flaw was found in qs. The qs.stringify function, responsible for serializing objects, does not properly validate the isBuffer property of an object's constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then...

CVE-2026-84368

A flaw was found in joi. This vulnerability, known as prototype pollution, allows an attacker to inject properties into core JavaScript objects by supplying untrusted input directly into schema-construction configuration. Specifically, by using language keys like proto or constructor in custom...

CVE-2026-14678

A flaw was found in PostgreSQL. A buffer over-read vulnerability exists in the pgtrgm index picksplit function, which reads past the end of a heap buffer. This could allow a table maintainer to infer limited memory values by observing index split choices, leading to information disclosure...

CVE-2026-85090

A flaw was found in FreeRDP. A heap out-of-bounds read vulnerability exists in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A remote attacker, acting as a malicious Remote Desktop Protocol RDP server, can exploit this by sending a specially crafted...

CVE-2026-85089

A flaw was found in FreeRDP. This vulnerability allows a remote attacker with low privileges to disclose sensitive information from the server or proxy process memory to a downstream client. This occurs because certain functions responsible for writing Save Session Info Protocol Data Units PDUs u...

CVE-2026-62886

A flaw was found in .NET. This vulnerability, caused by an integer overflow or wraparound, allows an unauthorized local attacker to elevate their privileges on the system. This could grant the attacker higher access than intended, potentially leading to further system compromise. Mitigation There...

CVE-2026-14666

A flaw in PostgreSQL allows users to bypass row-level security RLS due to incomplete tracking of user role and database ownership changes. Active sessions may continue using cached, outdated security policies, enabling unauthorized read or write access to data. Exploitation requires the attacker ...

CVE-2026-37236

A flaw was found in grpc-gateway up to v2.28.0. A remote attacker could exploit an incorrect access control vulnerability by sending a specially crafted POST request that includes the X-HTTP-Method-Override header. The application processes this header without restricting allowed methods, allowin...

CVE-2026-74994

A flaw was found in the modauth module of OTP's inets httpd server. When configured with multiple directory configuration blocks and using dets or mnesia authentication backends, the module incorrectly collapses all directory blocks into a single shared user/group namespace. This allows a user...

CVE-2026-74835

A flaw was found in the inets application HTTP server httpd. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted chunked request that fails to enforce a configured body-size limit. This can lead to memory exhaustion, causing a Denial of Service DoS on...

CVE-2026-73812

A flaw was found in the inets httpd server, part of Erlang/OTP. The server incorrectly processes HTTP requests that contain both Transfer-Encoding: chunked and Content-Length headers, failing to reject them or close the connection as required by RFC 9112 §6.1. When inets is deployed behind a...

CVE-2026-63385

A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...

CVE-2026-63382

A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successf...

CVE-2026-84394

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

CVE-2026-84292

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...

CVE-2026-69664

A flaw was found in Erlang/OTP inets httpd. An unauthenticated remote attacker can exploit this vulnerability by sending a malformed chunked HTTP request. Specifically, if the chunk-size line is not a hexadecimal number and arrives separately from the headers, the server worker handling the reque...

CVE-2026-59822

A flaw was found in LiteLLM, a proxy server designed for Large Language Model LLM APIs. An unauthenticated attacker could exploit a vulnerability in the MCP Streamable HTTP endpoint. By using a fabricated Authorization header, the attacker could bypass the standard key validation, gaining...

CVE-2026-55858

A flaw was found in MariaDB Connector/J, a component used to connect Java applications to MariaDB and MySQL databases. The connector incorrectly assumes a UTF-8 character set for communication, even if the database server changes its client character set to a non-UTF-8 value during a session. Thi...

CVE-2026-55857

A flaw was found in MariaDB Connector/J. A remote attacker or a man-in-the-middle server can exploit a vulnerability in the PAM dialog authentication mechanism. This flaw allows the attacker to coerce the connector into transmitting account passwords over an insecure connection when default...

CVE-2026-84380

A flaw was found in HTTPX2, a Python HTTP client. The Request.prepare function can incorrectly add a Content-Length header to a request that already includes a Transfer-Encoding header. This conflict in HTTP framing headers can lead to request smuggling or connection desynchronization. This could...

CVE-2026-84379

A flaw was found in HTTPX2, a Python HTTP client. A remote attacker could exploit this vulnerability by sending specially crafted multipart/form-data requests. The FileField.renderheaders function fails to validate Content-Type values and custom headers, allowing the injection of Carriage Return ...

CVE-2026-84378

A flaw was found in httpx2, a Python HTTP client. The Server-Sent Events SSE parser in httpx2 can be exploited by a remote attacker. By sending a specially crafted stream where an unterminated line is split across many response chunks, the parser repeatedly copies and rescans buffered text. This...

CVE-2026-84382

A flaw was found in httpx2, a Python HTTP client. The content decoders in httpx2 fully inflate compressed network chunks such as gzip, deflate, br, or zstd before yielding bounded pieces to the application. This can lead to a small compressed chunk expanding significantly in memory, for example, ...