CVE-2026-84381

A flaw was found in httpcore2, a component used by HTTPX2. When a remote origin uses WebSocket Secure wss through a SOCKS5 proxy, httpcore2 fails to initiate Transport Layer Security TLS encryption because its upgrade condition only recognizes HTTPS. This vulnerability allows an attacker...

CVE-2026-84377

A flaw was found in LiteLLM, a proxy server for Large Language Model LLM APIs. An authenticated remote attacker could exploit incomplete request validation to redirect outbound provider calls to an attacker-controlled destination. This Server-Side Request Forgery SSRF vulnerability could lead to...

CVE-2026-53600

A flaw was found in async-tar, a library for reading and writing tar archives in Rust. The library incorrectly applies a buffered PAX size extension to an intermediary extension header instead of the intended next file entry. This allows an attacker to craft a malicious tar archive that manipulat...

CVE-2026-75593

A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. A malicious client with valid permissions to access the BuildKit control API can craft a special upload request. This request allows files to escape from the BuildKit-controlled state directory, potentially...

CVE-2026-48050

A flaw was found in Arc. This vulnerability allows a remote unauthenticated attacker to access Go debug pprof endpoints due to improper authentication bypass. Successful exploitation can lead to the disclosure of sensitive runtime state information and enable a CPU-burn Denial of Service DoS...

CVE-2026-47891

A flaw was found in Spring WebFlux applications that utilize the Aalto XML processor to parse XML input. A remote attacker could exploit this vulnerability by sending specially crafted XML, causing the application to bypass the maxInMemorySize limit. This can lead to excessive memory consumption,...

CVE-2026-84309

A flaw was found in pypdf. An attacker can craft a malicious PDF document with a cyclic tree structure. When a writing code path attempts to insert a child object, the TreeObject.insertchild function can follow /Next links indefinitely, leading to an infinite loop. This can result in a denial of...

CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-14663

A flaw was found in PostgreSQL pgcrypto. When using disabled ciphers, a user can recover cleartext data by observing faulty ciphertext. This issue arises because the application may accept encrypted data as input, leading to successful decryption even with an incorrect key. Consequently, the...

CVE-2026-83619

A flaw was found in xmldom, a JavaScript module used for processing XML documents. A remote attacker could exploit a vulnerability in the XML parser by submitting a specially crafted XML input. This could lead to a Denial of Service DoS, causing the affected system to become unresponsive by...

CVE-2026-78410

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount8 to bind another host directory. If the fst...

CVE-2026-78409

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to opentree with ATSYMLINKNOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with...

CVE-2026-78408

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

CVE-2026-76642

When an external mount. helper runs but exits with a nonzero status, libmount still treats the helper invocation as successful and runs privileged post-mount hooks. A local unprivileged user with an /etc/fstab entry that uses the user option together with X-mount.idmap or X-mount.owner/group/mode...

CVE-2026-76595

A flaw was found in advisor-backend. Multiple code paths within the application deserialize YAML YAML Ain't Markup Language with an unsafe full Loader, which can instantiate arbitrary Python objects via YAML tags. An unauthenticated remote attacker can exploit this by submitting specially crafted...

CVE-2026-76594

A flaw was found in advisor-backend. A network-adjacent unauthenticated attacker could exploit a vulnerability in the /private/importcontent/ endpoint, which lacks proper authentication and permission checks. This allows the attacker to overwrite the global Advisor rule, resolution, and playbook...

CVE-2026-59683

A flaw was found in the OpenRGB network SDK protocol. Profile names received over the network are used directly in filesystem path construction without sanitization, allowing unauthenticated remote attackers to write attacker-controlled data to arbitrary filesystem paths via path traversal. By...

CVE-2026-84371

A flaw was found in sanitize-html. Improper validation of the animation value attributes in SVG files allows an attacker to bypass scheme filters and embed a malicious script destination within a list of values. When a user interacts with the rendered SVG animation, the embedded script executes i...

CVE-2026-55856

A flaw was found in MariaDB Connector/J. An active man-in-the-middle MITM attacker or hostile server can exploit a vulnerability during the initial connection handshake. When a Java application connects using specific SSL modes without proper certificate configuration, the connector may accept an...

CVE-2026-59276

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

CVE-2026-6470

A flaw was found in PostgreSQL where missing authorization checks in DDL commands allow an authenticated user to create unauthorized dependencies on a data type such as when assigning a range subtype or referencing the type in an SQL expression. This allows the user to block legitimate owners fro...

CVE-2026-82562

A flaw was found in qs. An unauthenticated attacker can exploit this by sending a specially crafted query string to an application using qs.parse with specific non-default settings comma: true and throwOnLimitExceeded: true. This bypasses a configured array limit, causing the parser to allocate a...

CVE-2026-59277

Spring Security InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. In Spring Security 7.1.0, the internal address classification did...

CVE-2026-14681

A flaw was found in PostgreSQL. Improper enforcement of message integrity in PostgreSQL's GSSAPI Generic Security Service Application Program Interface support allows a user to negotiate GSSAPI contrary to pghba.conf rules by initiating a direct TLS Transport Layer Security connection. This enabl...

CVE-2026-16241

A flaw was found in PostgreSQL ECPG. A highly privileged database server administrator can trigger an integer underflow by sending a specially crafted bytea value to the ECPG client. This vulnerability causes the client to overwrite a large memory region, leading to a temporary denial of service...

CVE-2026-59889

A flaw was found in jackson-databind. The UnwrappedPropertyHandler.processUnwrapped method, responsible for handling @JsonUnwrapped properties, replays buffered JSON without properly checking the active view. This allows an attacker to write data to a property annotated with both @JsonView and...

CVE-2026-18024

A flaw was found in PostgreSQL. A buffer over-read vulnerability in the ascii SQL function allows a user to disclose up to 3 bytes of memory after the end of a specific allocation by providing a specially crafted text value. This could lead to limited information disclosure. Mitigation To mitigat...

CVE-2026-53683

resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...

CVE-2026-16742

A flaw was found in systemd-homed. A local, logged-in user can exploit a missing signature verification in the authentication path when processing home records. This vulnerability allows the user to add arbitrary system groups to their account, which can lead to local privilege escalation and...

CVE-2026-70409

A flaw was found in eldap, a component of Erlang/OTP. A malicious or compromised Lightweight Directory Access Protocol LDAP server could exploit this vulnerability by returning a referral Uniform Resource Locator URL with an excessively long port number. This unbounded port component is then...

CVE-2026-84361

A flaw was found in Composer. A malicious dependency package from a custom Composer repository or an untrusted composer.lock file could exploit a vulnerability in how Composer handles Perforce source URLs. By setting source.type to perforce and source.url to an rsh: or jsh: P4PORT value, an...

CVE-2026-70622

A flaw was found in tar-rs. This vulnerability, a symlink escape, allows a local attacker to read sensitive files outside of the intended directory. By planting specially crafted symbolic links in an untrusted directory, an attacker can trick a privileged process, when archiving that directory,...

CVE-2026-71847

A flaw was found in Ruby JSON. A heap-use-after-free vulnerability exists in the JSON::ResumableParser component. A remote attacker, by supplying a specially crafted JSON stream with truncated duplicate keys, can cause the application to dereference freed memory. This can lead to process...

CVE-2026-6469

A flaw was found in PostgreSQL where the ALTER TABLE ALTER TYPE command incorrectly reassigns ownership of dependent statistics objects to the current user. This grants the table owner unauthorized privileges to execute DROP STATISTICS and ALTER STATISTICS while locking out the legitimate owner...

CVE-2026-82968

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacke...

CVE-2026-84356

An ui misrepresentation flaw was found in the FullScreen component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=503787232 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2026-84335

An incorrect authorization flaw was found in the TabStrip component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522302504 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2026-84358

An improper privilege management flaw was found in the Downloads component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514006886 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2026-84327

An incorrect authorization flaw was found in the Autofill component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=498725213...

CVE-2026-84347

An use after free flaw was found in the WebRTC component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=501679156...

CVE-2026-84334

An incorrect authorization flaw was found in the Chromoting component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517798926 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Produ...

CVE-2026-84326

An uninitialized resource flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=547936520 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Securi...

CVE-2026-84329

A confused deputy flaw was found in the CredentialProvider component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=498850269...

CVE-2026-84359

An information leak flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514078656...

CVE-2026-84330

An ui misrepresentation flaw was found in the FullScreen component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517091927...

CVE-2026-84355

An incorrect authorization flaw was found in the Navigation component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=511774376 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Produ...

CVE-2026-84328

A missing authorization flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=498710886 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2026-84323

A missing authorization flaw was found in the FileSystem component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=502411391 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2026-84357

An improper input validation flaw was found in the Omnibox component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523208474 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Produc...