https://vulnogram.org/ Most recent CVEs assigned by Red Hat, Inc. (redhat). https://vulnogram.org/seaview/icons/redhat.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-92824 https://vulnogram.org/CVE-2026-92824 A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata wi… Medium Wed, 21 Oct 2026 03:18:41 GMT https://vulnogram.org/CVE-2026-92822 https://vulnogram.org/CVE-2026-92822 A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafte… Medium Wed, 21 Oct 2026 03:18:37 GMT https://vulnogram.org/CVE-2026-92823 https://vulnogram.org/CVE-2026-92823 A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a high… Medium Wed, 21 Oct 2026 03:18:37 GMT https://vulnogram.org/CVE-2026-114038 https://vulnogram.org/CVE-2026-114038 A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended d… Medium Wed, 21 Oct 2026 00:26:49 GMT https://vulnogram.org/CVE-2026-105941 https://vulnogram.org/CVE-2026-105941 The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay ag… High Tue, 20 Oct 2026 12:59:00 GMT https://vulnogram.org/CVE-2026-105949 https://vulnogram.org/CVE-2026-105949 Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).get… High Tue, 20 Oct 2026 11:30:29 GMT https://vulnogram.org/CVE-2026-105312 https://vulnogram.org/CVE-2026-105312 A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a Cluste… Critical Tue, 20 Oct 2026 11:30:20 GMT https://vulnogram.org/CVE-2026-105311 https://vulnogram.org/CVE-2026-105311 The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide… High Tue, 20 Oct 2026 11:30:09 GMT https://vulnogram.org/CVE-2026-113496 https://vulnogram.org/CVE-2026-113496 A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that al… Medium Tue, 20 Oct 2026 11:09:12 GMT https://vulnogram.org/CVE-2026-113495 https://vulnogram.org/CVE-2026-113495 A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permi… Medium Tue, 20 Oct 2026 11:09:07 GMT https://vulnogram.org/CVE-2026-112177 https://vulnogram.org/CVE-2026-112177 A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently p… High Network Exploitable Tue, 20 Oct 2026 07:25:16 GMT https://vulnogram.org/CVE-2026-112261 https://vulnogram.org/CVE-2026-112261 A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution. High Mon, 19 Oct 2026 21:37:25 GMT https://vulnogram.org/CVE-2026-112258 https://vulnogram.org/CVE-2026-112258 A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leadi… High Mon, 19 Oct 2026 21:37:20 GMT https://vulnogram.org/CVE-2026-112257 https://vulnogram.org/CVE-2026-112257 A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and wr… High Mon, 19 Oct 2026 21:37:19 GMT https://vulnogram.org/CVE-2026-112260 https://vulnogram.org/CVE-2026-112260 A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service. High Mon, 19 Oct 2026 19:24:49 GMT https://vulnogram.org/CVE-2026-112259 https://vulnogram.org/CVE-2026-112259 A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application. Medium Mon, 19 Oct 2026 18:42:52 GMT https://vulnogram.org/CVE-2026-112214 https://vulnogram.org/CVE-2026-112214 A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Processing a cra… Medium Network Exploitable Mon, 19 Oct 2026 12:15:06 GMT https://vulnogram.org/CVE-2026-103314 https://vulnogram.org/CVE-2026-103314 A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signe… High Network Exploitable Mon, 19 Oct 2026 12:14:27 GMT https://vulnogram.org/CVE-2026-112210 https://vulnogram.org/CVE-2026-112210 A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local… Medium Mon, 19 Oct 2026 11:39:13 GMT https://vulnogram.org/CVE-2026-16460 https://vulnogram.org/CVE-2026-16460 A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remai… High Mon, 19 Oct 2026 06:40:50 GMT https://vulnogram.org/CVE-2026-89096 https://vulnogram.org/CVE-2026-89096 A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during cal… Medium Network Exploitable Fri, 16 Oct 2026 23:06:19 GMT https://vulnogram.org/CVE-2026-89088 https://vulnogram.org/CVE-2026-89088 A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed director… Medium Fri, 16 Oct 2026 23:06:18 GMT https://vulnogram.org/CVE-2026-89085 https://vulnogram.org/CVE-2026-89085 A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated… Medium Fri, 16 Oct 2026 23:04:28 GMT https://vulnogram.org/CVE-2026-111802 https://vulnogram.org/CVE-2026-111802 A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tric… Medium Fri, 16 Oct 2026 22:03:50 GMT https://vulnogram.org/CVE-2026-17591 https://vulnogram.org/CVE-2026-17591 A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when… Low Fri, 16 Oct 2026 22:03:40 GMT https://vulnogram.org/CVE-2026-62438 https://vulnogram.org/CVE-2026-62438 A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow… Medium Fri, 16 Oct 2026 21:56:18 GMT https://vulnogram.org/CVE-2026-62439 https://vulnogram.org/CVE-2026-62439 A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a h… High Fri, 16 Oct 2026 21:54:49 GMT https://vulnogram.org/CVE-2026-85977 https://vulnogram.org/CVE-2026-85977 A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decodi… Medium Network Exploitable Fri, 16 Oct 2026 18:20:43 GMT https://vulnogram.org/CVE-2026-85231 https://vulnogram.org/CVE-2026-85231 A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Se… Medium Fri, 16 Oct 2026 18:20:40 GMT https://vulnogram.org/CVE-2026-89098 https://vulnogram.org/CVE-2026-89098 A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request la… Medium Fri, 16 Oct 2026 17:43:21 GMT https://vulnogram.org/CVE-2026-111581 https://vulnogram.org/CVE-2026-111581 A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validat… Low Fri, 16 Oct 2026 15:42:04 GMT https://vulnogram.org/CVE-2026-111555 https://vulnogram.org/CVE-2026-111555 A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vul… Medium Fri, 16 Oct 2026 12:19:44 GMT https://vulnogram.org/CVE-2026-105958 https://vulnogram.org/CVE-2026-105958 A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary… High Fri, 16 Oct 2026 12:18:26 GMT https://vulnogram.org/CVE-2026-105959 https://vulnogram.org/CVE-2026-105959 A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap b… High Fri, 16 Oct 2026 11:53:00 GMT https://vulnogram.org/CVE-2026-104715 https://vulnogram.org/CVE-2026-104715 A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not pr… High Fri, 16 Oct 2026 06:47:10 GMT https://vulnogram.org/CVE-2026-84823 https://vulnogram.org/CVE-2026-84823 A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this u… High Thu, 15 Oct 2026 23:47:13 GMT https://vulnogram.org/CVE-2026-109131 https://vulnogram.org/CVE-2026-109131 The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub) renders a documentation URL part (formatPartURL in DocumentationParsers.tsx) as a link without restricting t… Medium Thu, 15 Oct 2026 18:46:00 GMT https://vulnogram.org/CVE-2026-108334 https://vulnogram.org/CVE-2026-108334 A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values fro… High Thu, 15 Oct 2026 18:44:42 GMT https://vulnogram.org/CVE-2026-85634 https://vulnogram.org/CVE-2026-85634 A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. D… High Thu, 15 Oct 2026 16:08:26 GMT https://vulnogram.org/CVE-2026-92982 https://vulnogram.org/CVE-2026-92982 A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper… High Thu, 15 Oct 2026 15:36:57 GMT https://vulnogram.org/CVE-2026-110927 https://vulnogram.org/CVE-2026-110927 A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection. Medium Thu, 15 Oct 2026 13:07:57 GMT https://vulnogram.org/CVE-2026-110924 https://vulnogram.org/CVE-2026-110924 A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not auth… Medium Network Exploitable Thu, 15 Oct 2026 13:07:45 GMT https://vulnogram.org/CVE-2026-110926 https://vulnogram.org/CVE-2026-110926 A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths. Medium Thu, 15 Oct 2026 05:25:07 GMT https://vulnogram.org/CVE-2026-110925 https://vulnogram.org/CVE-2026-110925 A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell. Medium Network Exploitable Thu, 15 Oct 2026 05:25:00 GMT https://vulnogram.org/CVE-2026-110923 https://vulnogram.org/CVE-2026-110923 A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected. Medium Network Exploitable Thu, 15 Oct 2026 05:24:59 GMT https://vulnogram.org/CVE-2026-110777 https://vulnogram.org/CVE-2026-110777 A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no… Medium Wed, 14 Oct 2026 18:08:36 GMT https://vulnogram.org/CVE-2026-86849 https://vulnogram.org/CVE-2026-86849 A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend. Medium Wed, 14 Oct 2026 17:52:15 GMT https://vulnogram.org/CVE-2026-86856 https://vulnogram.org/CVE-2026-86856 A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption. Medium Wed, 14 Oct 2026 17:52:14 GMT https://vulnogram.org/CVE-2026-86847 https://vulnogram.org/CVE-2026-86847 A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash. Medium Wed, 14 Oct 2026 17:52:12 GMT https://vulnogram.org/CVE-2026-86846 https://vulnogram.org/CVE-2026-86846 A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend. Medium Wed, 14 Oct 2026 17:52:07 GMT