Red Hat Red Hat Enterprise Linux 7
910 vulnérabilités publiées citent ce produit. Les 200 plus récentes sont listées.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-93009 | | Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder | MEDIUM 4.3 | |||
| CVE-2026-93010 | | Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check | MEDIUM 4.3 | |||
| CVE-2026-93006 | | Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content | MEDIUM 6.8 | |||
| CVE-2026-93007 | | Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation | MEDIUM 5.3 | |||
| CVE-2026-93011 | | Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms | MEDIUM 5.3 | |||
| CVE-2026-93008 | | Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations | MEDIUM 6.8 | |||
| CVE-2026-85498 | | Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow | LOW 3.5 | |||
| CVE-2026-117548 | | 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service | MEDIUM 6.5 | |||
| CVE-2026-109411 | | Samba: access control bypass via vfs_ceph_rgw case-insensitive open | HIGH 8.1 | |||
| CVE-2026-116497 | | Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-115486 | | Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning | HIGH 7.1 | 0.2 % | ||
| CVE-2026-115485 | | Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-115484 | | Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg | HIGH 7.6 | 0.2 % | ||
| CVE-2026-115221 | | Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership | MEDIUM 5.4 | 0.1 % | ||
| CVE-2026-115207 | | Patch: filename validation bypass in reversal fallback allows file creation outside the working directory | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-85518 | | Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-114038 | | Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string | MEDIUM 5.1 | 0.1 % | ||
| CVE-2026-112177 | | Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8 | HIGH 7.3 | 0.4 % | ||
| CVE-2026-112261 | | Gimp: gimp: use-after-free in xcf loader via prop_selected_path | HIGH 7.8 | 0.2 % | ||
| CVE-2026-112258 | | Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels | HIGH 7.8 | 0.2 % | ||
| CVE-2026-112257 | | Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033) | HIGH 7.8 | 0.2 % | ||
| CVE-2026-112260 | | Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing | HIGH 7.1 | 0.2 % | ||
| CVE-2026-112259 | | Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-112214 | | Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-112210 | | Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service | MEDIUM 6.0 | 0.1 % | ||
| CVE-2026-89096 | | Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-89088 | | Parted: parted: denial of service via heap buffer overflow during fat16 resize | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-89085 | | Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-111802 | | Nautilus: nautilus: arbitrary file deletion via trash symlink | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-17591 | | Libarchive: libarchive: use-after-free via aliased mac metadata copy | LOW 3.6 | 0.2 % | ||
| CVE-2026-62438 | | Gimp: gimp: paa integer overflow out-of-bounds read | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-62439 | | Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability | HIGH 7.0 | 0.2 % | ||
| CVE-2026-85977 | | Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-85231 | | Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-89098 | | Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-111581 | | Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method | LOW 3.3 | 0.1 % | ||
| CVE-2026-111555 | | Luksmeta: missing slot-range validation permits out-of-gap device i/o | MEDIUM 6.0 | 0.1 % | ||
| CVE-2026-105958 | | Spice-server: spice: heap oob read/write via unchecked migration data offsets | HIGH 7.5 | 0.2 % | ||
| CVE-2026-105959 | | Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation | HIGH 7.5 | 0.5 % | ||
| CVE-2026-104715 | | Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass | HIGH 7.8 | 0.3 % | ||
| CVE-2026-110777 | | Evolution-data-server: local file disclosure via attach file:// uris | MEDIUM 5.7 | 0.4 % | ||
| CVE-2026-109968 | | Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-100229 | | Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array boun… | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-109971 | | Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool | MEDIUM 4.7 | 0.2 % | ||
| CVE-2026-109970 | | Clevis: clevis: pkcs#11 token pin written to world-readable file | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-109969 | | Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-100231 | | Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: heap out-of-bounds write in asfmux due to incorrect utf-16 size calculation for… | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-86476 | | Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and … | HIGH 8.4 | 0.2 % | ||
| CVE-2026-110036 | | Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices | LOW 3.3 | 0.2 % | ||
| CVE-2026-105460 | | Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt() | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-109976 | | Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-109854 | | M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding | LOW 2.5 | 0.1 % | ||
| CVE-2026-108094 | | Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path | HIGH 7.8 | 0.1 % | ||
| CVE-2026-108093 | | Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-108063 | | Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-107655 | | Cups: null pointer dereference via embedded job ticket comments allows remote denial of service | MEDIUM 4.0 | 0.3 % | ||
| CVE-2026-107651 | | Eog: eog: arbitrary code execution via heap buffer overflow in png metadata reader | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-107565 | | Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption | MEDIUM 5.1 | 0.1 % | ||
| CVE-2026-107161 | | Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients | HIGH 7.5 | 0.3 % | ||
| CVE-2026-106067 | | Gimp: gimp: heap buffer overflow in hot color filter on oversized image | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-106066 | | Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-106065 | | Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-107169 | | M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8 | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-107167 | | M17n-lib: heap use-after-free write in re_init_ic() | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-106064 | | Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-107170 | | M17n-lib: null dereference in minput_open_im() after failed m17n_init() | LOW 2.9 | 0.1 % | ||
| CVE-2026-107168 | | M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars() | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-106061 | | Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-80048 | | Sssd: sssd-kcm: local denial of service via excessive memory preallocation | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-104045 | | Sssd: sssd: denial of service via race condition in autofs responder | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-104046 | | Sssd: sssd: denial of service via incomplete identity provider authentication requests | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-106062 | | Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file | HIGH 7.8 | 0.1 % | ||
| CVE-2026-101258 | | Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free | HIGH 7.8 | 0.2 % | ||
| CVE-2026-106063 | | Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-104048 | | Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation | HIGH 8.1 | 0.3 % | ||
| CVE-2026-104047 | | Sssd: sssd: information disclosure via query injection in entra id lookups | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-88252 | | Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustion | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104044 | | Sssd: sssd: denial of service via crafted passkey kerberos authentication request | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-104043 | | Sssd: sssd: denial of service via undersized packet parsing in nss responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104042 | | Sssd: sssd: denial of service via out-of-bounds read in pam responder | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-104041 | | Sssd: sssd: denial of service via unbounded negative cache growth | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104040 | | Sssd: sssd: information disclosure via odata injection in entra id lookups | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-104039 | | Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-104038 | | Sssd: sssd: denial of service via missing sid extension in certificate mapping | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-104037 | | Sssd: sssd: denial of service via packet length underflow in autofs responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-92821 | | Sssd: sssd: access control bypass via premature ldap access rule evaluation | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-104036 | | Sssd: sssd: denial of service via out-of-bounds write in nfs idmap plugin | MEDIUM 5.8 | 0.1 % | ||
| CVE-2026-104035 | | Sssd: sssd: denial of service via memory exhaustion in kcm responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104034 | | Sssd: sssd: denial of service via use-after-free in kcm ticket renewal | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-104033 | | Sssd: sssd: access control bypass via improper ldap shadow expiration check | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-104032 | | Sssd: sssd: denial of service via unprivileged autofs cache invalidation | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104031 | | Sssd: sssd: denial of service via memory exhaustion in autofs responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104029 | | Sssd: sssd: denial of service via out-of-bounds read in autofs responder | LOW 3.3 | 0.1 % | ||
| CVE-2026-104030 | | Sssd: sssd: denial of service via out-of-bounds read during passkey parsing | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104988 | | Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject | HIGH 8.1 | 0.2 % | ||
| CVE-2026-95512 | | Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-86345 | | 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result | CRITICAL 9.0 | 0.4 % | ||
| CVE-2026-86344 | | 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue | HIGH 7.5 | 0.3 % | ||
| CVE-2026-103641 | | Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-103399 | | Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-103242 | | Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag | HIGH 7.1 | 0.1 % | ||
| CVE-2026-102560 | | Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-102559 | | Libsoup: libsoup: heap buffer overflow during websocket client-frame masking | HIGH 8.6 | 0.4 % | ||
| CVE-2026-102558 | | Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth | HIGH 8.6 | 0.4 % | ||
| CVE-2026-102555 | | Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding | HIGH 8.2 | 0.4 % | ||
| CVE-2026-102557 | | Libsoup: libsoup: heap buffer overflow during websocket message reassembly | HIGH 8.6 | 0.3 % | ||
| CVE-2026-102556 | | Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion | HIGH 8.6 | 0.3 % | ||
| CVE-2026-95520 | | Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages | HIGH 7.1 | 0.1 % | ||
| CVE-2026-97029 | | Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group | MEDIUM 5.7 | 0.2 % | ||
| CVE-2026-97024 | | Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc | HIGH 7.1 | 0.4 % | ||
| CVE-2026-97027 | | Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files | LOW 3.6 | 0.1 % | ||
| CVE-2026-97026 | | Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path | LOW 3.9 | 0.1 % | ||
| CVE-2026-97025 | | Flatpak: flatpak: world-readable oci authentication token in system-helper cache path | LOW 3.2 | 0.1 % | ||
| CVE-2026-102010 | | Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if | HIGH 7.0 | 0.3 % | ||
| CVE-2026-97023 | | Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin | HIGH 7.1 | 0.4 % | ||
| CVE-2026-96284 | | Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following | LOW 2.5 | 0.1 % | ||
| CVE-2026-96282 | | Flatpak: flatpak: extension metadata path traversal file existence oracle | LOW 3.1 | 0.2 % | ||
| CVE-2026-96283 | | Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull | LOW 3.3 | 0.1 % | ||
| CVE-2026-96281 | | Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-96280 | | Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems | HIGH 7.5 | 0.5 % | ||
| CVE-2026-96279 | | Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-93834 | | Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape | HIGH 8.8 | 0.4 % | ||
| CVE-2026-95521 | | Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm | HIGH 7.8 | 0.6 % | ||
| CVE-2026-95519 | | Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows) | HIGH 7.8 | 0.1 % | ||
| CVE-2026-97185 | | Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file | HIGH 7.8 | 0.1 % | ||
| CVE-2026-96546 | | Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader | LOW 2.5 | 0.2 % | ||
| CVE-2026-96545 | | Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-96276 | | Flatpak: flatpak: arbitrary write in host context via flatpak build-init | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-96275 | | Flatpak: flatpak: arbitrary write access as root via extra-data extraction | HIGH 8.8 | 0.5 % | ||
| CVE-2026-96442 | | Emacs: emacs: arbitrary code execution in flymake mode | HIGH 7.8 | 0.2 % | ||
| CVE-2026-90462 | | Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-94640 | | Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service | HIGH 7.5 | 0.4 % | ||
| CVE-2026-95619 | | Gcc: libstdc++ integer overflow in `new` operator | HIGH 7.7 | 0.4 % | ||
| CVE-2026-93433 | | Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-92382 | | Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write | MEDIUM 4.1 | 0.1 % | ||
| CVE-2026-94184 | | Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01) | HIGH 8.1 | 1.2 % | ||
| CVE-2026-80110 | | Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endp… | HIGH 8.1 | 0.2 % | ||
| CVE-2026-91142 | | Cockpit: cockpit: unauthorized modification of login records via integer overflow | LOW 3.6 | 0.1 % | ||
| CVE-2026-91147 | | Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-91149 | | Cockpit: cockpit: denial of service via unbounded connection thread spawning | HIGH 7.5 | 0.3 % | ||
| CVE-2026-93653 | | Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service) | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-81627 | | Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram | HIGH 8.2 | 0.2 % | ||
| CVE-2026-76781 | | Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-92091 | | Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array | MEDIUM 5.9 | 0.6 % | ||
| CVE-2026-92248 | | Gimp: integer overflow when generating a thumbnail preview for a psd file | HIGH 7.8 | 0.2 % | ||
| CVE-2026-85234 | | Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine | HIGH 7.5 | 0.5 % | ||
| CVE-2026-85013 | | Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters | HIGH 7.3 | 0.2 % | ||
| CVE-2026-91786 | | Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-19816 | | PackageKit: dnf5 backend ignores SIMULATE on RepoRemove | HIGH 7.1 | 0.1 % | ||
| CVE-2026-90996 | | Sssd: sssd: denial of service in nss responder via crafted zero-length requests | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-90995 | | Sssd: sssd: local denial of service due to null pointer dereference in pam responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-90994 | | Sssd: sssd: denial of service via malformed pam v1 requests | MEDIUM 4.0 | 0.2 % | ||
| CVE-2026-90463 | | Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`) | MEDIUM 4.0 | 0.1 % | ||
| CVE-2026-90947 | | Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file | HIGH 7.8 | 0.1 % | ||
| CVE-2026-90949 | | Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch | HIGH 7.8 | 0.3 % | ||
| CVE-2026-90948 | | Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions | HIGH 7.8 | 0.2 % | ||
| CVE-2026-89329 | | Device-mapper-multipath: local denial of service via blocking ipc send operations | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-18495 | | Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-77159 | | Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-88914 | | Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-88924 | | Gvfs: gvfs-admin socket ownership race permits local root | HIGH 7.0 | 0.2 % | ||
| CVE-2026-88859 | | Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-18147 | | Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url | HIGH 8.1 | 0.5 % | ||
| CVE-2026-87876 | | Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up) | LOW 3.0 | 0.3 % | ||
| CVE-2026-87875 | | Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-87853 | | Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation | HIGH 7.5 | 0.3 % | ||
| CVE-2026-18090 | | Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-74860 | | Libxml2: double-free/uaf in libxml2 python bindings | HIGH 8.5 | 0.7 % | ||
| CVE-2026-76561 | | Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint) | HIGH 7.2 | 0.7 % | ||
| CVE-2026-86469 | | Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-19843 | | 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor | HIGH 8.4 | 0.5 % | ||
| CVE-2026-79678 | | Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service | HIGH 8.1 | 0.9 % | ||
| CVE-2026-76578 | | Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci | CRITICAL 9.8 | 1.2 % | ||
| CVE-2026-76925 | | Flatpak: flatpak: toctou race condition allows symlink redirection | MEDIUM 5.8 | 0.1 % | ||
| CVE-2026-85534 | | Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-81666 | | Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-85197 | | Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload | HIGH 7.6 | 0.3 % | ||
| CVE-2026-84185 | | Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification | MEDIUM 5.9 | 0.1 % | ||
| CVE-2026-71224 | | Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-71222 | | Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-71221 | | Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta | HIGH 7.0 | 0.1 % | ||
| CVE-2026-71220 | | Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit | HIGH 7.0 | 0.1 % | ||
| CVE-2026-71219 | | Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-85150 | | Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted … | HIGH 7.5 | 0.5 % | ||
| CVE-2026-84838 | | Rpm: command injection in rpmuncompress via unescaped filenames passed to popen() | HIGH 7.8 | 1.1 % | ||
| CVE-2026-84837 | | Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path | HIGH 7.8 | 0.7 % | ||
| CVE-2026-78409 | | Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks | HIGH 7.0 | 0.2 % | ||
| CVE-2026-78410 | | Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection | HIGH 7.8 | 0.2 % | ||
| CVE-2026-78408 | | Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority | HIGH 7.9 | 0.2 % | ||
| CVE-2026-53683 | | Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-84270 | | Gvfs: mtp: out-of-bounds read in do_read() | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-84269 | | Gvfs: afp: heap-based buffer overflow in dsi read path | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-84267 | | Gvfs: sftp: uninitialized heap disclosure in read_string() | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-84233 | | Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames | HIGH 7.0 | 0.2 % | ||
| CVE-2026-53682 | | Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-11873 | | Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-18743 | | Popt-devel: popt-static: short realloc in poptconfigfiletostring | LOW 2.5 | 0.1 % | ||
| CVE-2026-83596 | | Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature | HIGH 8.8 | 0.3 % | ||
| CVE-2026-13732 | | Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf | HIGH 7.0 | 0.1 % | ||
| CVE-2026-82343 | | Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling | MEDIUM 6.1 | 0.2 % |