CVE-2026-92388

A flaw was found in curl. A remote malicious server can cause a Denial of Service DoS or memory corruption in applications that enable File Transfer Protocol FTP wildcard matching. When a wildcard listing operation fails, curl does not properly reset its internal callback handlers before the...

CVE-2026-110777

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify...

CVE-2026-71886

A flaw was found in Bouncy Castle. The OpenPGP certificate application programming interface API fails to verify whether a subkey possesses certification authority before validating third-party certifications or trust delegations. An attacker in possession of a restricted signing or encryption...

CVE-2026-66822

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of us...

CVE-2026-69651

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network...

CVE-2026-58280

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network...

CVE-2026-102870

The Blazor WebAssembly debug proxy embeds attacker-controlled ToString, description, and class-name values into generated C without consistently escaping them. When a developer evaluates an expression while debugging, the value can escape the generated string literal and execute code on the...

CVE-2026-92392

A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the...

CVE-2026-68081

A flaw was found in the KVM Kernel-based Virtual Machine component of the Linux kernel, specifically within its nested virtualization nVMX feature. When a nested virtual machine VM attempts to enter an invalid guest state during VMLAUNCH or VMRESUME operations, the system fails to properly releas...

CVE-2026-100236

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. ...

CVE-2026-87545

An information leak flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/523243507...

CVE-2026-86847

A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash. Mitigation Do not attach a virtio-crypto vhost-user backend to untrusted guests...

CVE-2026-86856

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption. Mitigation Avoid using the nfp vDPA driver in production until patched. Do not attach untrusted...

CVE-2026-86849

A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend. Mitigation Do not attach a virtio-crypto vhost-user backend to untrusted guests...

CVE-2026-86845

A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend. Mitigation Do not attach a virtio-crypto...

CVE-2026-86846

A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend. Mitigation Do not attach a virtio-crypto vhost-user backend to untrusted guests...

CVE-2026-86561

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption. Mitigation No mitigation is currently available...

CVE-2026-93683

A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an...

CVE-2026-86566

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK. Mitigation Mitigation for this issue is either not available or the currently available options do not meet...

CVE-2026-86567

A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap. Mitigation No mitigation is currently available...

CVE-2026-86848

A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend. Mitigation Do not attach a virtio-crypto vhost-user backend to untrusted guests...

CVE-2026-86562

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler. Mitigation No mitigation is currently available...

CVE-2026-86563

A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access. Mitigation No mitigation is currently available...

CVE-2026-86565

A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process. Mitigation No mitigation is currently available...

CVE-2024-58392

A flaw was found in PhysicsFS. An attacker could cause a Denial of Service DoS by supplying a specially crafted archive file. Due to an out-of-bounds read flaw when decoding multi-byte UTF-8 character sequences in entry names, the library advances past the end of the input buffer during string...

CVE-2026-110602

A flaw was found in libmspack. An attacker could exploit this vulnerability by enticing a user or application to process a specially crafted KWAJ compressed file containing invalid or truncated headers. When handling these errors, the library attempts to release uninitialized memory pointers,...

CVE-2026-110642

A flaw was found in xhtml2pdf. This vulnerability allows an attacker to execute arbitrary commands by convincing a user to process a file with a specially crafted name while using the viewer option. Because the software fails to properly sanitize the file name before passing it to the operating...

CVE-2026-71889

A flaw was found in Bouncy Castle. The certificate path reviewer PKIXCertPathReviewer fails to enforce name constraints on the end-entity certificate during validation. A remote attacker can exploit this issue by presenting a certificate that violates domain restrictions imposed by an issuing...

CVE-2026-87518

An observable discrepancy flaw was found in the Safebrowsing component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517917560...

CVE-2026-85047

An improper input validation flaw was found in the Transactions Platform component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513790581...

CVE-2026-92395

A flaw was found in @fastify/proxy-addr. This flaw allows a remote, unauthenticated attacker to bypass access controls and security policies by spoofing client IP Internet Protocol addresses. When configured with certain IPv4-mapped IPv6 network ranges, the plugin improperly treats all incoming...

CVE-2026-92892

A flaw was found in JFrog CLI. Under specific configurations, a remote attacker can achieve arbitrary code execution on the host running the utility by exploiting improper command argument handling. Successful exploitation allows the attacker to run unauthorized commands within the context of the...

CVE-2026-86414

A flaw was found in curl. A malicious or compromised HTTP proxy server can trick curl into sending authentication credentials intended for the target destination server directly to the proxy itself. When establishing a connection tunnel, if the proxy replies with an HTTP 401 Unauthorized status...

CVE-2026-109968

A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read t...

CVE-2026-82617

A flaw was found in Apache OpenNLP. The built-in regular expression patterns used for identifying email and URL strings contain inefficient nested repetitions. A remote attacker can exploit this flaw by submitting crafted text to an affected application, triggering excessive CPU consumption or...

CVE-2026-101339

A flaw was found in NSD. When parsing directly supplied zone files, a specially crafted Host Identity Protocol HIP resource record can cause a stack-based buffer overflow. An attacker capable of provisioning or feeding zone files into the server can exploit this vulnerability to execute arbitrary...

CVE-2026-101337

A flaw was found in NSD Name Server Daemon. When parsing DNS zone files containing base64-encoded data formatted in segments of three characters or fewer, NSD incorrectly calculates token sizes, resulting in a stack-based buffer overflow. An attacker who can supply or manipulate a zone file loade...

CVE-2026-101341

A flaw was found in NSD. When parsing directly supplied Domain Name System DNS zone files, NSD fails to properly validate the length of text tokens within resource record data. An attacker able to provide a specially crafted zone file can trigger a stack-based buffer overflow, potentially leading...

CVE-2026-101338

A flaw was found in NSD. When processing zone files containing specially formatted Service Binding SVCB or HTTPS resource records, the base64 decoding routine can exceed memory limits and cause a stack-based buffer overflow. An attacker capable of provisioning or supplying crafted zone files...

CVE-2026-55601

A flaw was found in MultiTail. When using the execute-on-match feature, MultiTail fails to properly sanitize matched log data before passing it to the system shell for command execution. An attacker capable of influencing the contents of monitored input can exploit this issue by injecting shell...

CVE-2026-104795

The insights-runtime-extractor runs as a privileged DaemonSet hostPID: true that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. forks a child process 2. setns into the target container's PID and mount namespaces 3. fchdir back to an orphaned...

CVE-2026-88842

A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited...

CVE-2026-100229

A flaw was found in GStreamer's H.266 codec parser library libgstcodecparsers. An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could...

CVE-2026-109971

A flaw was found in the clevis PKCS11 pin. The clevis-decrypt-pkcs11 script passes the PKCS11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem. Mitigation No end-user mitigation is available for this issue. Th...

CVE-2026-109970

A flaw was found in the clevis PKCS11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the...

CVE-2026-109969

A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AFUNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary...

CVE-2026-100231

A flaw was found in the GStreamer multimedia framework's ASF muxer plugin asfmux. When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane such as emoji to an ASF container, the plugin incorrectly calculates the buffer size needed for the UTF-16LE...

CVE-2026-89044

A flaw was found in Netty. A remote attacker could exploit improper validation of the Transfer-Encoding header by sending specially crafted HTTP requests. This vulnerability allows for HTTP request smuggling, enabling attackers to bypass security controls and potentially gain unauthorized access ...

CVE-2026-88829

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim t...

CVE-2026-110220

A flaw was found in Kubeflow Model Registry. This Server-Side Request Forgery SSRF vulnerability allows an authenticated namespace user to provide an attacker-controlled address within an InferenceService resource annotation. When the controller processes the resource, it makes an outgoing reques...