https://vulnogram.org/ Most recent CVEs assigned by redhat-cnalr (redhat-cnalr). https://vulnogram.org/seaview/icons/redhat-cnalr.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-97875 https://vulnogram.org/CVE-2026-97875 Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opene… High Fri, 25 Sep 2026 10:48:47 GMT https://vulnogram.org/CVE-2026-75895 https://vulnogram.org/CVE-2026-75895 In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34_unpack() function via attacker controlled SMPP PDUs, leading to memory corruption. High Network Exploitable Fri, 18 Sep 2026 19:01:34 GMT https://vulnogram.org/CVE-2026-75894 https://vulnogram.org/CVE-2026-75894 In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service. High Network Exploitable Fri, 18 Sep 2026 18:52:55 GMT https://vulnogram.org/CVE-2026-75893 https://vulnogram.org/CVE-2026-75893 In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccess_proxy_read_msg() function via IPA frame lengths. High Network Exploitable Fri, 18 Sep 2026 18:40:26 GMT https://vulnogram.org/CVE-2026-75892 https://vulnogram.org/CVE-2026-75892 In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memory corruption. Medium Network Exploitable Fri, 18 Sep 2026 18:30:31 GMT https://vulnogram.org/CVE-2026-75031 https://vulnogram.org/CVE-2026-75031 In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin feature. In default installations arbitrary Perl code can be injected and executed server-side by unauthenticated use… Critical Network Exploitable Fri, 18 Sep 2026 15:20:40 GMT https://vulnogram.org/CVE-2026-71568 https://vulnogram.org/CVE-2026-71568 In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity. Medium Thu, 17 Sep 2026 13:46:16 GMT https://vulnogram.org/CVE-2026-71567 https://vulnogram.org/CVE-2026-71567 In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are n… High Mon, 17 Aug 2026 14:39:09 GMT https://vulnogram.org/CVE-2026-71566 https://vulnogram.org/CVE-2026-71566 FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores… Critical Network Exploitable Mon, 17 Aug 2026 14:22:16 GMT https://vulnogram.org/CVE-2026-15720 https://vulnogram.org/CVE-2026-15720 In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service. High Network Exploitable Tue, 14 Jul 2026 18:20:22 GMT https://vulnogram.org/CVE-2026-40472 https://vulnogram.org/CVE-2026-40472 In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting (XSS) attacks. Critical Thu, 23 Apr 2026 15:00:09 GMT https://vulnogram.org/CVE-2026-40471 https://vulnogram.org/CVE-2026-40471 hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative actions… Critical Network Exploitable Thu, 23 Apr 2026 14:56:34 GMT https://vulnogram.org/CVE-2026-40470 https://vulnogram.org/CVE-2026-40470 A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via the documentation upload facility were served as-is on the main hackage.haskell.org domain. As a consequence, w… Critical Thu, 23 Apr 2026 14:53:47 GMT https://vulnogram.org/CVE-2026-1616 https://vulnogram.org/CVE-2026-1616 The $uri$args concatenation in nginx configuration file present in Open Security Issue Management (OSIM) prior v2025.9.0 allows path traversal attacks via query parameters. High Network Exploitable Thu, 29 Jan 2026 13:38:35 GMT https://vulnogram.org/CVE-2025-31162 https://vulnogram.org/CVE-2025-31162 Floating point exception in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via get_slope function. Medium Fri, 28 Mar 2025 18:01:31 GMT https://vulnogram.org/CVE-2025-31163 https://vulnogram.org/CVE-2025-31163 Segmentation fault in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via put_patternarc function. Medium Fri, 28 Mar 2025 18:01:24 GMT https://vulnogram.org/CVE-2025-31164 https://vulnogram.org/CVE-2025-31164 heap-buffer overflow in fig2dev in version 3.2.9a allows an attacker to availability via local input manipulation via create_line_with_spline. Medium Fri, 28 Mar 2025 18:01:16 GMT https://vulnogram.org/CVE-2025-2312 https://vulnogram.org/CVE-2025-2312 A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data fro… Medium Tue, 25 Mar 2025 18:08:02 GMT