Export limit exceeded: 17028 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420453 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420453 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121837 | 1 Redhat | 2 Exploit Intelligence, Quarkus | 2026-11-06 | 4.3 Medium |
| A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response. | ||||
| CVE-2026-123037 | 1 Redhat | 3 Ansible Automation Platform, Ansible Core, Ansible Portal | 2026-11-06 | 6.7 Medium |
| A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902. | ||||
| CVE-2026-121621 | 1 Redhat | 1 Openshift Gitops | 2026-11-06 | 8.8 High |
| A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process. | ||||
| CVE-2026-123158 | 1 Openbsd | 1 Openssh | 2026-11-06 | 8.1 High |
| sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux. | ||||
| CVE-2026-89142 | 2026-11-06 | 6.3 Medium | ||
| In the Wi-Fi NPU FW, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local denial of service with user execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-112447 | 1 Apple | 1 Macos | 2026-11-06 | 5.3 Medium |
| An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to bypass Privacy preferences. | ||||
| CVE-2026-97029 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 5.7 Medium |
| Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell. | ||||
| CVE-2026-96545 | 2 Gimp, Redhat | 3 Gimp, Enterprise Linux, Rhel Els | 2026-11-06 | 4.4 Medium |
| An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in. | ||||
| CVE-2026-96541 | 2 Gnome, Redhat | 2 Gnome-remote-desktop, Enterprise Linux | 2026-11-06 | 7.5 High |
| A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed. | ||||
| CVE-2026-96281 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 6.2 Medium |
| On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities. | ||||
| CVE-2026-96280 | 2 Flatpak, Redhat | 8 Flatpak, Enterprise Linux, Enterprise Linux Eus and 5 more | 2026-11-06 | 7.5 High |
| The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems. | ||||
| CVE-2026-96279 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 6.5 Medium |
| A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as /etc/shadow. | ||||
| CVE-2026-96276 | 2 Flatpak, Redhat | 3 Flatpak, Enterprise Linux, Rhel Els | 2026-11-06 | 6.5 Medium |
| If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal. | ||||
| CVE-2026-95512 | 2 Freetype, Redhat | 7 Freetype, Build Of Openjdk 11 Els, Enterprise Linux and 4 more | 2026-11-06 | 5.5 Medium |
| A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate. | ||||
| CVE-2026-95508 | 1 Redhat | 3 Enterprise Linux, Openshift, Openshift Container Platform | 2026-11-06 | 7.4 High |
| A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected. | ||||
| CVE-2026-94184 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-06 | 5.3 Medium |
| A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening. | ||||
| CVE-2026-93683 | 1 Redhat | 3 Enterprise Linux, Openshift, Openstack | 2026-11-06 | 6.4 Medium |
| A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix. | ||||
| CVE-2026-93653 | 2 Poppler, Redhat | 5 Poppler, Enterprise Linux, Hardened Images and 2 more | 2026-11-06 | 5.5 Medium |
| A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline routine, without a corresponding memory allocation. An attacker could exploit this by supplying a malicious PDF to an application that renders it via Poppler's Splash backend, causing the rendering process to consume 100% CPU for an attacker-controlled, extended duration. | ||||
| CVE-2026-93433 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-06 | 5.5 Medium |
| A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System Interface) Vital Product Data (VPD) page 0x80 data. This malformed data, specifically an untrusted page length field, can lead to a stack buffer overflow in the `_sg_parse_vpd_80()` function during serial number parsing. Successful exploitation could result in a denial of service by crashing or destabilizing the process querying the serial number. | ||||
| CVE-2026-93011 | 3 Dnsmasq, Red Hat, Redhat | 9 Dnsmasq, Enterprise Linux, Ceph Storage and 6 more | 2026-11-06 | 5.3 Medium |
| A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime. | ||||