CVE-2026-98449

A flaw was found in the Linux kernel's SMB Server Message Block client. This issue may allow a remote attacker or malicious server to trigger a Denial of Service DoS by inducing network transmission failures during compound request processing. Because the client releases its connection lock witho...

CVE-2026-19854

A flaw was found in the Grafana ClickHouse plugin. When using the Native protocol with PDC or secure SOCKS, the connection library fails to enforce Transport Layer Security TLS, causing sensitive data such as usernames, passwords, queries, and results to be transmitted in cleartext. This allows a...

CVE-2026-93479

A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...

CVE-2026-98510

A flaw was found in the Linux kernel's Intel Xe graphics driver. When closing a GPU virtual memory space, page tables were destroyed before contested virtual memory areas were properly unlinked from shared buffer objects. A concurrent thread evicting a shared buffer object can attempt to access t...

CVE-2026-98446

A flaw was found in the Linux kernel's XFS file system. When calculating space reservations for file system metadata, the kernel does not prevent an arithmetic underflow if the available reservable blocks drop below the amount already in use. A local user could exploit this condition during file...

CVE-2026-98511

A flaw was found in the Linux kernel's Nouveau GPU driver. When attempting to re-pin a memory buffer into an incompatible memory domain, the driver rejects the request but fails to prevent an increment of the buffer's pin count. Because callers do not unpin after an error, this causes an unbalanc...

CVE-2026-98447

A flaw was found in the Linux kernel's XFS file system. This vulnerability allows a local attacker to cause a Denial of Service DoS or potentially compromise the system through memory corruption. During the formatting of realtime reference count metadata, the kernel incorrectly calculates the...

CVE-2026-98505

A flaw was found in the Linux kernel. A race condition within the Data Access Monitor DAMON subsystem allows hardware-driven page table updates to be lost during the monitoring of huge memory pages. A local user running processes monitored by DAMON can trigger concurrent memory operations,...

CVE-2026-98509

A flaw was found in the Linux kernel's virtio graphics processing unit virtio-gpu driver. A local user can cause a Denial of Service DoS by triggering a kernel memory leak during graphics command buffer processing. When invalid submission parameters are provided, the driver's error-handling path...

CVE-2026-98502

A flaw was found in the Linux kernel's ALPS Human Interface Device HID driver. The driver fails to properly unregister and release a secondary input device when the hardware is removed. A local user could exploit this issue by repeatedly disconnecting the device, causing a memory leak that can le...

CVE-2026-112214

A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a crafted ASF, WMV, or WMA file can cause a very lar...

CVE-2026-98506

A flaw was found in the Linux kernel's HugeTLB Huge Translation Lookaside Buffer subsystem. This flaw allows a local user to cause a Denial of Service DoS by triggering the dissolution of gigantic memory pages that lack runtime support. Because the kernel fails to verify runtime support before...

CVE-2026-98508

A flaw was found in the Linux kernel's VirtIO GPU driver. This flaw allows a local user to cause a denial of service DoS by triggering a kernel crash. Under memory pressure, the driver fails to verify whether fence memory allocation succeeds during graphics command submission, leading to an...

CVE-2026-98507

A flaw was found in the Linux kernel's memory management subsystem. Due to a missing synchronization barrier when preparing anonymous virtual memory areas, concurrent memory operations can be reordered. A local attacker can exploit this race condition by running concurrent threads on adjacent...

CVE-2026-98504

A flaw was found in the Linux kernel's PCI subsystem. When generating dynamic Open Firmware OF device tree properties, the kernel fails to verify that a subordinate bus exists for a PCI bridge before accessing its configuration. A local attacker or physical device configuration can trigger this...

CVE-2026-98503

A flaw was found in the Linux kernel's packet socket implementation. A local user can cause a Denial of Service DoS or system instability by triggering premature reuse of transmit ring buffer slots while packet data is still in flight. Because these shared memory slots may be released and reused...

CVE-2026-98501

A flaw was found in the Linux kernel's Alps Human Interface Device HID driver. If registration of an input device fails during configuration, the driver frees the device memory while communication channels are already active, leaving a dangling reference. An attacker capable of attaching a...

CVE-2026-98445

A flaw was found in the Linux kernel's XFS file system. A local user could cause a Denial of Service DoS by triggering an online file system repair under low-memory conditions. When a memory allocation failure occurs during repair block reservation, the kernel cannot cleanly recover from the erro...

CVE-2026-98443

A flaw was found in the Linux kernel's XFS file system. Improper pointer handling during the recovery of unlinked files can cause a use-after-free condition, where the operating system attempts to access memory after it has already been freed. A local user capable of mounting a specially crafted...

CVE-2026-98444

A flaw was found in the Linux kernel's XFS file system. When flushing disk quota records, the kernel fails to release the quota flush lock if an associated buffer cannot be retrieved. A local user could trigger this condition to cause a system deadlock, resulting in a Denial of Service DoS...

CVE-2026-110522

A flaw was found in oc-mirror's legacy v1 catalog cache rebuild. When the --build-catalog-cache flag is used, oc-mirror extracts an opm binary from the remote operator catalog image and executes it on the host without verifying its signature, digest, or integrity. An attacker who publishes a...

CVE-2026-103314

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and...

CVE-2026-98439

A flaw was found in the Linux kernel's Server Message Block SMB server, ksmbd. When a connection is closed while an asynchronous request is still waiting, the server fails to cancel active requests before waiting for them to complete. A remote client could exploit this flaw to prevent the...

CVE-2026-98440

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM subsystem on ARM64 architectures. In nested virtualization configurations, shadow memory management structures are prematurely freed during shadow page flushes while other parts of the system may still reference them. A local...

CVE-2026-98442

A flaw was found in the Linux kernel's traffic control connection tracking action actct. An attacker capable of sending network traffic handled by the affected system can cause a Denial of Service DoS or kernel memory corruption through a use-after-free vulnerability. This issue occurs because...

CVE-2026-98441

A flaw was found in the Linux kernel's traffic control conntrack action module actct. An attacker capable of sending network traffic through affected packet filters could trigger a Denial of Service DoS or kernel memory corruption. This issue arises when cloned network packets sharing an...

CVE-2026-98438

A flaw was found in the Linux kernel's Multipath TCP MPTCP subsystem. When handling connection termination DATAFIN packets without payload data while checksum negotiation is enabled, the kernel fails to properly initialize memory before computing the packet checksum. A network peer could trigger...

CVE-2026-98437

A flaw was found in the Linux kernel's Qualcomm Iris video driver. A local user could cause a Denial of Service DoS or resource exhaustion through improper error handling during power domain configuration. When enabling or disabling power domains encounters an error, the driver fails to properly...

CVE-2026-112210

A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the...

CVE-2026-98435

A flaw was found in the Linux kernel's Altera EDAC Error Detection and Correction driver. Device-managed interrupt requests and resource groups in the altrportbsetup function were improperly associated with a temporary per-port device structure rather than the parent device. A local privileged us...

CVE-2026-98434

A flaw was found in the Linux kernel. Due to a missing range validation check in the sysctl subsystem, configured minimum and maximum limits were not enforced during specific millisecond-to-jiffies conversions. A local user with permission to modify kernel parameters could provide out-of-bounds...

CVE-2026-98433

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for PowerPC architectures. When handling secure virtual machines, a failure during secure memory paging fails to release allocated device memory and internal metadata. A local user can exploit this vulnerability by...

CVE-2026-102941

A flaw was found in github.com/gomarkdown/markdown. A remote attacker can cause a Denial of Service DoS by submitting specially crafted Markdown content containing empty or very short link destinations. When link sanitization is enabled, the parser attempts to read beyond the boundaries of the...

CVE-2026-111880

A flaw was found in FreeRDP. An out-of-bounds write vulnerability in the server-side NT LAN Manager NTLM authentication path can result in a Denial of Service DoS. When processing authentication messages with hash callbacks enabled, FreeRDP fails to properly validate the Message Integrity Check M...

CVE-2026-16460

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject...

CVE-2026-111881

A flaw was found in FreeRDP. An integer underflow vulnerability exists in its bitmap image processing component due to an incorrect calculation when handling sub-byte images. A remote attacker acting as a malicious peer in a Remote Desktop Protocol RDP session can exploit this by supplying a...

CVE-2026-16487

A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS...

CVE-2026-112007

A flaw was found in Schism Tracker. An attacker could exploit this vulnerability by enticing a user to open a specially crafted UltraTracker .ult audio file. Due to missing boundary checks on sample counts during file parsing, the application performs an out-of-bounds memory write on the heap. Th...

CVE-2026-112075

A flaw was found in unsloth. The sentence transformer module improperly validates user-controlled input when resolving class references. A remote attacker could exploit this vulnerability by enticing a user to process specially crafted input, potentially leading to arbitrary code execution and...

CVE-2026-112027

A flaw was found in the Uploadify component of light0011 cms. A remote attacker can exploit an improper input handling vulnerability by manipulating the filename parameter in the check-exists script. This issue leads to information disclosure, allowing the attacker to verify the existence of...

CVE-2026-112026

A flaw was found in light0011 cms. The application uses an insufficiently computationally intensive algorithm, SHA-1 Secure Hash Algorithm 1, to hash user passwords. A remote attacker could exploit this weakness to recover plaintext passwords using brute-force methods, leading to information...

CVE-2026-112058

A flaw was found in libdvdnav. An attacker could trigger a Denial of Service DoS by convincing a user to load a specially crafted DVD or disc image. Due to missing input validation in the setPTT function, an invalid title number causes the library to read memory beyond allocated boundaries, leadi...

CVE-2026-112052

A flaw was found in libspatialite. An integer overflow in the Well-Known Binary WKB geometry parsing routines can lead to a Denial of Service DoS or memory corruption. By providing a specially crafted database file or geometry object with an excessively large point count, an attacker can trigger...

CVE-2026-112048

A flaw was found in libspatialite. The library fails to validate the polygon ring count when parsing geometry data in the Well-Known Binary WKB format. An attacker can exploit this issue by supplying specially crafted geometry input to trigger uncontrolled memory allocation, leading to a Denial o...

CVE-2026-112057

A flaw was found in libdvdnav. This vulnerability allows an attacker to cause a Denial of Service DoS by tricking a user into opening a specially crafted DVD or disc image. When the library parses chapters from a disc declaring an oversized title index, it performs an out-of-bounds read beyond...

CVE-2026-109311

A flaw was found in vLLM. This vulnerability allows an authenticated remote attacker to cause a Denial of Service DoS by uploading a crafted Immersive Audio Model and Formats IAMF audio file to the transcription endpoint. Because input data is passed to the underlying media processing library...

CVE-2026-112008

A flaw was found in libmng. A heap-based buffer overflow vulnerability exists in the mngreadordr function due to improper buffer allocation sizing when parsing chunk records in Multiple-image Network Graphics MNG files. An attacker could exploit this vulnerability by enticing a user or system to...

CVE-2026-112006

A flaw was found in opentelemetry-exporter-otlp-proto-http. When certificate configuration environment variables are set to empty strings, Transport Layer Security TLS verification is unintentionally disabled. A man-in-the-middle attacker can exploit this improper certificate validation to...

CVE-2026-111997

A flaw was found in ip-address. A remote attacker can cause a Denial of Service DoS by providing specially crafted input containing excessive percent characters to an application parsing IPv6 addresses. When processed by the Address6 constructor, inefficient parsing logic leads to high CPU...

CVE-2026-86227

A flaw was found in Valkey. An out-of-bounds read vulnerability exists in the kvstoreGetHashtable function within src/kvstore.c. This issue can be exploited by a remote attacker in cluster mode by providing a specially crafted dump.rdb file during application startup, for example, through data...