CVE-2018-19361

CVE-2018-19361 is listed in the IBM Cloudera Observability bulletin as affecting Cloudera Observability on Premises 3.5.3, with remediation in 3.6.2. Description from the bulletin notes that FasterXML jackson-databind 2.x before 2.9.8 allows polymorphic deserialization via the openjpa class, yiel...

CVE-2018-14720

CVE-2018-14720 affects jackson-databind 2.x prior to 2.9.7, via unsafe polymorphic deserialization that could enable external XML entity (XXE) attacks when failure to block unspecified JDK classes occurs. The connected documents corroborate a fix in 2.9.7 (and related update notes), with multiple...

CVE-2018-19360

CVE-2018-19360 affects FasterXML jackson-databind 2.x before 2.9.8, where failure to block the axis2-transport-jms class enables polymorphic deserialization with unspecified impact. IBM/Cloudera docs corroborate related deserialization flaws across jackson-databind versions and list remediation a...

CVE-2022-1227

CVE-2022-1227 describes a privilege-escalation flaw in Podman where an attacker could publish a malicious image to a public registry; when a victim downloads it, running the user command ‘podman top’ could grant access to the host filesystem, enabling information disclosure or DoS. The issue is t...

CVE-2022-2990

CVE-2022-2990 (Buildah): The issue stems from incorrect handling of supplementary groups inside a container, which, if an attacker has direct container access and can execute code, may enable information disclosure or data modification. Affected: Buildah/container tools relying on supplementary g...

CVE-2025-5914

CVE-2025-5914 affects libarchive. The vuln is in archive_read_format_rar_seek_data() and stems from an integer overflow that can lead to a double-free, causing memory corruption with potential arbitrary code execution or denial of service. Public docs in Debian/Red Hat/AlmaLinux advisories confir...

CVE-2018-12023

The CVE-2018-12023 issue affects FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (globally or per-property) and the Oracle JDBC jar is in the classpath with an LDAP service accessible to an attacker, the service could be coerced into executing a ma...

CVE-2019-1010238

CVE-2019-1010238 affects Gnome Pango 1.42 and later. The vulnerability is a heap-based buffer overflow in pango_log2vis_get_embedding_levels (involving nchars assignment and the loop condition), exploitable when applications pass invalid UTF-8 strings to functions like pango_itemize. Impact state...

CVE-2020-27786

CVE-2020-27786 affects the Linux kernel MIDI subsystem (rawmidi) with a use-after-free in the MIDI ioctl handling path. A local attacker with access to issue ioctl commands to MIDI devices could trigger memory corruption, potentially enabling privilege escalation. Public documentation in connecte...

CVE-2024-12085

CVE-2024-12085 affects rsync; a flaw in checksum comparison allows an attacker to manipulate s2length, causing comparisons against uninitialized memory and leaking one byte of uninitialized stack data per interaction. The issue is rated HIGH (CVSS 3.1: 7.5) with network attack vector and no user ...

CVE-2024-9675

CVE-2024-9675 affects Buildah (and related container-tools) where cache mount path validation is faulty: a RUN --mount instruction can mount an arbitrary host directory into the container (read/write) if accessible by the Buildah user. This implies potential host-file disclosure or modification f...

CVE-2020-14370

CVE-2020-14370 is a Podman information-disclosure vulnerability where environment variables from the first container leak into subsequent containers when using Varlink or Docker-compatible REST API if multiple containers are created quickly. Connected docs indicate a later CVE-2022-2739 reference...

CVE-2021-3609

CVE-2021-3609 is a local privilege-escalation flaw in the Linux kernel CAN BCM subsystem. A race in net/can/bcm.c between bcm_rx_handler() and bcm_release() can free bcm_op/bcm_sock structures while the handler runs, enabling use-after-free and root access. Public advisories consistently describe...

CVE-2019-16884

Summary of CVE-2019-16884 (runc) : The vulnerability affects runc (as used in Docker and similar), where a flaw in libcontainer/rootfs_linux.go allows an AppArmor/SELinux restriction bypass by a malicious image that can mount over a container’s /proc directory. This arises from an incorrect check...

CVE-2017-7481

CVE-2017-7481 affects Ansible before versions 2.3.1.0 and 2.4.0.0, where lookup-plugin results could be marked unsafe, allowing code execution via jinja2 if an attacker controls lookup() results. The description and connected advisories confirm the vulnerability originates from unsafe lookup resu...

CVE-2024-8883

CVE-2024-8883 : In Keycloak, a misconfiguration of the Valid Redirect URI allows open redirects when set to http://localhost or http://127.0.0.1. This can expose authorization codes and potentially enable session hijacking. The connected document (Keycloak open redirect) confirms the affected com...

CVE-2024-9341

CVE-2024-9341 is a vulnerability in the containers/common Go library that can occur when FIPS mode is enabled, enabling symbolic-link-based mounting to trick the host into mounting sensitive host directories inside a container and potentially accessing host files. Related advisories indicate affe...

CVE-2020-10743

The CVE-2020-10743 issue concerns OpenShift Container Platform’s Kibana distribution allowing clickjacking via iframe embedding due to missing X-Frame-Options handling. Connected docs confirm this CVE was addressed in Kibana updates (e.g., SUSE’s bulletin notes CVE-2020-10743 fixed by a patch to ...

CVE-2023-0264

CVE-2023-0264 concerns an improper authentication flaw in Keycloak’s OpenID Connect user authentication, potentially allowing impersonation and new session token generation. The connected documents include a GitHub PoC (Exploit for Improper Authentication in Redhat Keycloak) describing a session ...

CVE-2020-15707

CVE-2020-15707 is a GRUB2 bootloader vulnerability (initrd size handling) causing a heap-based buffer overflow via integer overflow in initrd processing. The flaw affects GRUB2 2.04 and earlier as deployed in multiple distros (Debian, Red Hat, Ubuntu) and can enable arbitrary code execution durin...

CVE-2021-20270

CVE-2021-20270 describes an infinite loop in Pygments’ SMLLexer, affecting Pygments 1.5–2.7.3, which can cause DoS during syntax highlighting of StandardML sources (e.g., input containing only the keyword “exception”). Connected advisories confirm affected distributions (e.g., Debian, AlmaLinux, ...

CVE-2022-3916

CVE-2022-3916 affects Keycloak via the offline_access scope. The flaw arises from missing root-session validation and reuse of session IDs between root and user authentication sessions, enabling an attacker to resolve a user session attached to a previously authenticated user; using the refresh t...

CVE-2021-20291

CVE-2021-20291 corresponds to a deadlock DoS in github.com/containers/storage when unpacking container image layers. If a layer is not a valid tar archive, the tar unpack stream may hang indefinitely, causing a deadlock and denial of service. The issue affects versions prior to 1.28.1 and has bee...

CVE-2019-10214

CVE-2019-10214 affects the containers/image library used by Podman, Buildah and Skopeo on Red Hat Enterprise Linux 8 and OpenShift Container Platform (CRI-O). The root cause is that TLS connections to the container registry authorization service are not enforced, enabling a potential MiTM attack ...

CVE-2022-2989

CVE-2022-2989 affects Podman and is caused by incorrect handling of supplementary groups inside a container, enabling potential information disclosure or data modification when an attacker has direct container access and can execute code. Connected documents confirm affected Podman versions older...

CVE-2020-15706

CVE-2020-15706 affects GRUB2 (2.04 and earlier) and is a race-condition/use-after-free in grub_script_function_create() triggered by redefining a function during execution, leading to arbitrary code execution and Secure Boot restriction bypass. Remediation is to upgrade to patched GRUB2 packages ...

CVE-2026-4480

CVE-2026-4480 affects the Samba printing subsystem. The flaw allows a remote attacker to execute arbitrary code by sending a print job whose description uses the client-controlled %J substitution without escaping shell metacharacters, enabling remote code execution on affected systems. Public adv...

CVE-2020-27846

CVE-2020-27846 is a signature verification vulnerability in crewjam/saml that can allow bypass of SAML authentication. The issue affects Grafana deployments including affected Grafana versions referenced in multiple advisories (e.g., Red Hat RHSA-2021:1859) and is scored with a high/critical impa...

CVE-2021-20188

CVE-2021-20188 affects podman before 1.7.0. The flaw: file permissions for non-root users in privileged containers are not correctly checked, enabling a low-privilege container user to access other files within the same container (even if root-owned). It does not enable direct container escape; h...

CVE-2019-11255

Technical details for CVE-2019-11255 are not publicly available in the provided documents. Monitor for updates in the official sources to obtain affected components, root cause, impact, and remediation.

CVE-2019-14379

CVE-2019-14379 affects FasterXML jackson-databind prior to 2.9.9.2, where default typing mishandling when ehcache is present (via net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup) leads to remote code execution. Affected component is jackson-databind’s data-binding implementatio...

CVE-2022-27649

CVE-2022-27649 affects Podman (and related container tooling) where containers could be started with non-empty default/inheritable Linux capabilities. The underlying issue is that default inheritable capabilities for Linux containers were not empty, allowing an attacker with access to programs po...

CVE-2019-3815

CVE-2019-3815 is a memory‑leak issue in the journald component introduced via backport of fixes for CVE-2018-16864. The flaw is in dispatch_message_real() in journald-server.c, which does not free memory allocated for the _CMDLINE= entry (set_iovec_field_free). A local attacker could crash system...

CVE-2019-3826

Technical details about CVE-2019-3826 are not further provided in the connected documents. The available information originates from the Initial Description (Prometheus 2.7.1 and earlier XSS) with no additional public details in the linked sources. Monitor for updates.

CVE-2020-15705

GRUB2 ≤ 2.04 fails to validate kernel signatures when booting directly without shim, allowing Secure Boot bypass if the kernel signing certificate is in the Secure Boot DB. The issue affects GRUB2 2.04 and earlier; upgrades to patched grub2/shim combinations are advised (e.g., 2.06+ and related s...

CVE-2018-12910

CVE-2018-12910 affects libsoup’s soup-cookie-jar.c get_cookies with an empty hostname, allowing unspecified impact per multiple advisories. The issue is described as a denial of service risk (and related out-of-bounds read concerns in some entries) in libsoup 2.63.2 and earlier. Public disclosure...

CVE-2017-17485

CVE-2017-17485 affects FasterXML jackson-databind: a deserialization flaw that enables unauthenticated remote code execution via readValue when the blacklist is bypassed if Spring libraries are on the classpath. The initial description specifies impact for jackson-databind up to 2.8.10 and 2.9.x ...

CVE-2017-15095

Summary of CVE-2017-15095 and related sightings : The material consistently reports a deserialization flaw in jackson-databind, affecting versions prior to 2.8.10 and 2.9.1. An unauthenticated user could trigger code execution via ObjectMapper.readValue with malicious input. The issue is describe...

CVE-2018-18559

CVE-2018-18559 affects the Linux kernel up to 4.19, caused by a use-after-free in a race between fanout_add from setsockopt and bind on AF_PACKET sockets. The issue stems from an incomplete fix (15fe076...) and a multithreaded sequence where a packet_do_bind unregister action followed by a packet...

CVE-2020-25660

The CVE-2020-25660 issue affects Cephx authentication in Ceph versions before 15.2.6 and before 14.2.14, where client verification can be bypassed, enabling replay attacks over the msgr2 protocol (affecting most Ceph communications; msgr1 is unaffected). An attacker with cluster-network access co...

CVE-2019-11250

CVE-2019-11250 concerns the Kubernetes client-go library which logs request headers when verbosity is 7 or higher. The practical effect is potential exposure of credentials to unauthorized users via logs or command output. Affected are Kubernetes components that use basic or bearer token authenti...

CVE-2022-0711

HAProxy is affected by CVE-2022-0711 due to a flaw in processing HTTP responses with the Set-Cookie2 header, which can cause an infinite loop and a denial-of-service condition (availability impact). The vulnerability is observable across multiple advisories and vendor pages, including Debian secu...

CVE-2020-11100

HAProxy CVE-2020-11100 involves an out-of-bounds write in the HPACK decoder ({Hpack_dht_insert} in {hpack-tbl.c}) that could allow a remote attacker to execute code via a crafted HTTP/2 request. Amazon Linux 2 advisory ALAS2HAPROXY2-2023-006 confirms the fix in haproxy2 2.1.4-1 (haproxy2 package)...

CVE-2021-20194

CVE-2021-20194 affects Linux kernels 5.2+ when compiled with CONFIG_BPF_SYSCALL=y, CONFIG_BPF=y, CONFIG_CGROUPS=y, CONFIG_CGROUP_BPF=y, and without hardened_usercopy; a BPF execution bug in __cgroup_bpf_run_filter_getsockopt() can cause a heap overflow. Local attackers can potentially cause DoS o...

CVE-2024-1635

Undertow vulnerability CVE-2024-1635 affects servers supporting the wildfly-http-client protocol. The issue arises during HTTP upgrade to remoting: WriteTimeoutStreamSinkConduit is not notified when a RemotingConnection is closed, causing timeout tasks to leak and accumulate, which leaks connecti...

CVE-2023-6291

Technical details about CVE-2023-6291 are not publicly available in the provided documents. Monitor for updates from Red Hat/Keycloak advisories for affected products, versions, and patches.

CVE-2026-33845

The CVE-2026-33845 issue is a GnuTLS DTLS handshake parsing flaw that can trigger an integer underflow during reassembly of malformed DTLS fragments (zero length, non-zero offset), causing an out-of-bounds read. Connected OSV entries indicate affected packages such as rootio-gnutls28 in Root:Debi...

CVE-2020-25639

CVE-2020-25639: A NULL pointer dereference in the Linux kernel’s GPU Nouveau driver (prior to 5.12-rc1) via DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC allows local users to crash the system. Affected: Linux kernel/Nouveau driver; Root cause: NULL pointer dereference in channel allocation path; Impact: local...

CVE-2022-1274

CVE-2022-1274 is referenced in Red Hat advisories RHSA-2023-1043/1044 as a fix for Red Hat Single Sign-On 7.6.2 on RHEL 7/8/9. The vulnerability is linked to Keycloak’s execute-actions-email flow, with the cited issue being a missing email notification template allowlist that can enable an XSS-li...

CVE-2019-16276

CVE-2019-16276 affects the Go programming language’s net/http handling, allowing HTTP Request Smuggling when an HTTP header contains spaces before the colon. The issue is publicly documented across multiple advisories; Go versions prior to fixes described in the connected documents are affected. ...