CVE-2026-78895

A flaw was found in Chromium. A remote attacker could exploit an information leak in the Paint component by crafting a malicious HTML page. This vulnerability allows the attacker to bypass the web origin policy, potentially leading to unauthorized access to sensitive information...

CVE-2026-78892

An incorrect authorization flaw was found in the Chromoting component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=518053893...

CVE-2026-78891

A flaw was found in WebRTC in Google Chrome. A buffer overflow vulnerability allows a remote attacker to execute arbitrary code within the sandbox environment by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized control over the affected system...

CVE-2026-55618

A flaw was found in emlparser, a Python module for parsing email files. The cleanfounduri function incorrectly validates Uniform Resource Locator URL strings by processing them before unescaping HTML entities. This allows a remote attacker to craft malicious URLs using HTML entities that are then...

CVE-2026-55588

A flaw was found in ORAS OCI Registry As Storage CLI. A remote attacker, by operating a malicious OCI Open Container Initiative registry that returns a cyclic referrer graph, could cause unbounded recursion and memory growth in the client. This vulnerability leads to a client-side Denial of Servi...

CVE-2026-76022

A flaw was found in Google Chrome. This buffer overflow vulnerability allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page, leading to a compromise of the affected system...

CVE-2026-76023

An improper resource control flaw was found in the Linux Toolkit Theming component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=545124048...

CVE-2026-76020

A race condition flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=541837151...

CVE-2026-76021

An use after free flaw was found in the DOM component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=541854084...

CVE-2026-76018

A flaw was found in Google Chrome's Import component. A remote attacker, leveraging social engineering tactics, could exploit this vulnerability by tricking a user into processing a specially crafted file. Successful exploitation could lead to privilege elevation, allowing the attacker to...

CVE-2026-76019

A flaw was found in chromium-browser. Incorrect authorization in the Workers component allows a remote attacker, who has compromised the renderer process and leveraged social engineering, to bypass the web origin policy. This bypass is achieved by tricking a user into interacting with a specially...

CVE-2026-76017

A flaw was found in Chromoting, a component of Google Chrome. This vulnerability, a use-after-free error, allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. The exploitation occurs when an attacker sends specially crafted network traffic to a vulnerable...

CVE-2026-55620

A flaw was found in emlparser, a Python module designed for parsing email files. A remote attacker can exploit a vulnerability in how the module processes Received: headers containing deeply nested parentheses. By submitting specially crafted email files, an attacker can cause excessive CPU usage...

CVE-2026-55619

A flaw was found in emlparser, a Python module for parsing email files. A remote attacker can exploit this vulnerability by sending a specially crafted email containing deeply nested comments within its headers. This malicious input can exhaust the parser's call stack, leading to a RecursionError...

CVE-2026-52491

A flaw was found in libtiff. An attacker could exploit this vulnerability by processing a specially crafted file, leading to arbitrary code execution. This issue occurs within the thumbnail.c: main component. Successful exploitation could allow the attacker to take control of the affected system...

CVE-2026-19401

A flaw was found in NSD. A remote attacker can crash an NSD server child by sending a specially crafted message containing a specific number of DNS Cookie options. This continuous crashing can severely hamper or deny DNS service, leading to a denial of service DoS condition. This vulnerability...

CVE-2026-18916

A flaw was found in NSD. A remote attacker can exploit this vulnerability by continuously throttling the TCP receive window after a TCP query, causing an NSD serve child to crash. This repeated crashing can lead to a complete denial of TCP service for the affected NSD instance. Mitigation To...

CVE-2026-19538

A flaw was found in nsd. A remote attacker can bypass BLOCKED access control list ACL items on the proxy protocol port. This bypass occurs when connecting over TCP or TLS and sending the query twice on a persistent connection. This could allow unauthorized access or actions that should have been...

CVE-2026-18794

A flaw was found in OpenRGB. The OpenRGB network protocol allows a remote attacker to cause out-of-bounds memory reads and writes by sending inconsistent data. This could lead to information disclosure, arbitrary code execution, or a Denial of Service DoS. Mitigation To mitigate this issue,...

CVE-2026-18664

A flaw was found in NSD. On systems using little-endian architecture, the software incorrectly compares IP addresses against defined Access Control List ACL ranges. This misinterpretation can lead to a bypass of intended access controls, where IP addresses that should be denied access are instead...

CVE-2026-38754

A flaw was found in Busybox. This vulnerability, a heap overflow, exists within the ifsbreakup function. A remote attacker could exploit this by providing specially crafted input, leading to a Denial of Service DoS condition. This means the affected system or application could become unavailable ...

CVE-2026-80184

A flaw was found in OpenStack Keystone where an application credential token can escape its intended project scope through token-method reauthentication. Keystone rejects an explicit scope change for an application credential token, but an omitted scope falls through to the owner's default projec...

CVE-2026-80182

A flaw was found in OpenStack Keystone where delegation boundary enforcement is incomplete across trust, application credential, and OAuth1 authorization endpoints. Tokens obtained via delegated authentication methods, such as OAuth1 access tokens or custom Keystone authentication plugins, can...

CVE-2026-63125

A flaw was found in Incus, a container and virtual machine manager. A crafted container image can trick the daemon into writing to arbitrary host files via a symlink in backup.yaml, potentially leading to root-level command execution on the host. Mitigation No mitigation is needed as Incus is not...

CVE-2026-62941

A flaw was found in Incus, a container and virtual machine manager. A race condition when copying instances across projects allows dangerous configuration keys to bypass project restrictions, enabling privilege escalation and container escape. Mitigation No mitigation is needed as Incus is not...

CVE-2026-62940

A flaw was found in Incus, a container and virtual machine manager. During instance migration, security-critical configuration overrides bypass project restrictions, allowing a restricted user to escalate privileges and escape the container to the host. Mitigation No mitigation is needed as Incus...

CVE-2026-62867

A flaw was found in Incus, a container and virtual machine manager. Improper validation of storage volume settings allows a project-scoped user to inject arguments into commands executed as root on the host. Mitigation No mitigation is needed as Incus is not shipped in any Red Hat product...

CVE-2026-48769

A flaw was found in Incus, a container and virtual machine manager. A malicious image server can cause the Incus client to write files to arbitrary locations via a crafted response header, potentially leading to command execution as root. Mitigation No mitigation is needed as Incus is not shipped...

CVE-2026-48755

A flaw was found in Incus, a container and virtual machine manager. Improper validation of backup compression settings allows argument injection, leading to arbitrary file write on the host and potential command execution. Mitigation No mitigation is needed as Incus is not shipped in any Red Hat...

CVE-2026-48753

A flaw was found in Incus, a container and virtual machine manager. The S3 upload endpoint is vulnerable to path traversal, allowing creation of arbitrary files on the host, potentially leading to command execution. Mitigation No mitigation is needed as Incus is not shipped in any Red Hat product...

CVE-2026-48752

A flaw was found in Incus, a container and virtual machine manager. A crafted container image or backup can use a symlink in the templates directory to read or write arbitrary files on the host, potentially leading to command execution. Mitigation No mitigation is needed as Incus is not shipped i...

CVE-2026-48751

A flaw was found in Incus, a container and virtual machine manager. Instance snapshots do not enforce container restriction settings, allowing a user to execute arbitrary commands on the server through lowlevel hooks. Mitigation No mitigation is needed as Incus is not shipped in any Red Hat produ...

CVE-2026-48750

A flaw was found in Incus, a container and virtual machine manager. A crafted container image can cause the host to write files to arbitrary locations via a symlink, potentially leading to command execution as root on the host. Mitigation No mitigation is needed as Incus is not shipped in any Red...

CVE-2026-48749

A flaw was found in Incus, a container and virtual machine manager. A crafted container image can use a symlink in the rootfs directory to read or write arbitrary files on the host, potentially leading to command execution. Mitigation No mitigation is needed as Incus is not shipped in any Red Hat...

CVE-2026-14662

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

CVE-2026-79654

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View...

CVE-2026-80186

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response EIR packet that causes a buffer overflow when the target device performs Bluetooth discovery. This...

CVE-2026-80185

BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd...

CVE-2026-80101

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation...

CVE-2026-77680

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in...

CVE-2026-79992

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitra...

CVE-2026-63074

A flaw was found in OpenSSL. The CMP Certificate Management Protocol implementation does not clear cached additional certificates when an invalid message is received, leading to excessive memory consumption. This allows a malicious client to repeatedly send requests containing unique extra...

CVE-2026-63073

A flaw was found in OpenSSL. A malicious CMP Certificate Management Protocol endpoint can send an unexpected distinguished name DN directly as the format string argument to ERRraisedata, causing the application to dereference and write to unrelated stack contents. This can lead to a crash in the...

CVE-2026-54874

A flaw was found in OpenSSL. Receiving a DTLS Datagram Transport Layer Security record for a future epoch while a handshake is in progress causes OpenSSL to buffer an excessive amount of memory. This allows a peer to cause memory exhaustion, eventually resulting in a denial of service, using a...

CVE-2026-14457

A flaw was found in OpenSSL. In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, where only the private key with no certificate is configured, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted...

CVE-2026-63076

A flaw was found in OpenSSL. A crafted CMP Certificate Management Protocol message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client,...

CVE-2026-63072

A flaw was found in OpenSSL. A crafted CMS Cryptographic Message Syntax message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMSdecrypt. This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap...

CVE-2026-18798

A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID destination connection ID can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service. Mitigatio...

CVE-2026-63075

A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory...

CVE-2026-68516

A flaw was found in OpenEXR. A remote attacker could provide a specially crafted HTJ2K-compressed EXR image file. When OpenEXR processes this file with JPEG 2000 SIZ fields that place the first tile outside the visible image, it can lead to invalid tile and codeblock geometry. This results in a...