Red Hat Red Hat Enterprise Linux 9
1187 vulnérabilités publiées citent ce produit. Les 200 plus récentes sont listées.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-93009 | | Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder | MEDIUM 4.3 | |||
| CVE-2026-93010 | | Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check | MEDIUM 4.3 | |||
| CVE-2026-93006 | | Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content | MEDIUM 6.8 | |||
| CVE-2026-93007 | | Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation | MEDIUM 5.3 | |||
| CVE-2026-93011 | | Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms | MEDIUM 5.3 | |||
| CVE-2026-93008 | | Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations | MEDIUM 6.8 | |||
| CVE-2026-85498 | | Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow | LOW 3.5 | |||
| CVE-2026-117548 | | 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service | MEDIUM 6.5 | |||
| CVE-2026-109411 | | Samba: access control bypass via vfs_ceph_rgw case-insensitive open | HIGH 8.1 | |||
| CVE-2026-116497 | | Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-115486 | | Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning | HIGH 7.1 | 0.2 % | ||
| CVE-2026-115485 | | Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-115484 | | Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg | HIGH 7.6 | 0.2 % | ||
| CVE-2026-115449 | | Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest | LOW 3.5 | 0.2 % | ||
| CVE-2026-115221 | | Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership | MEDIUM 5.4 | 0.1 % | ||
| CVE-2026-111079 | | Goose: goose: shell history and environment leak via terminal integration | HIGH 7.4 | 0.3 % | ||
| CVE-2026-115207 | | Patch: filename validation bypass in reversal fallback allows file creation outside the working directory | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-114406 | | Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-85518 | | Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-114370 | | Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal | LOW 3.7 | 0.3 % | ||
| CVE-2026-114236 | | Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers | LOW 3.3 | 0.1 % | ||
| CVE-2026-92824 | | Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-92823 | | Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-92822 | | Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-114038 | | Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string | MEDIUM 5.1 | 0.1 % | ||
| CVE-2026-113496 | | Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments | MEDIUM 5.0 | 0.1 % | ||
| CVE-2026-113495 | | Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments | MEDIUM 5.0 | 0.2 % | ||
| CVE-2026-112177 | | Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8 | HIGH 7.3 | 0.4 % | ||
| CVE-2026-112261 | | Gimp: gimp: use-after-free in xcf loader via prop_selected_path | HIGH 7.8 | 0.2 % | ||
| CVE-2026-112258 | | Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels | HIGH 7.8 | 0.2 % | ||
| CVE-2026-112257 | | Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033) | HIGH 7.8 | 0.2 % | ||
| CVE-2026-112260 | | Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing | HIGH 7.1 | 0.2 % | ||
| CVE-2026-112259 | | Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-112214 | | Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-112210 | | Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service | MEDIUM 6.0 | 0.1 % | ||
| CVE-2026-16460 | | Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization | HIGH 7.4 | 0.1 % | ||
| CVE-2026-89096 | | Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-89088 | | Parted: parted: denial of service via heap buffer overflow during fat16 resize | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-89085 | | Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-111802 | | Nautilus: nautilus: arbitrary file deletion via trash symlink | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-17591 | | Libarchive: libarchive: use-after-free via aliased mac metadata copy | LOW 3.6 | 0.2 % | ||
| CVE-2026-62438 | | Gimp: gimp: paa integer overflow out-of-bounds read | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-62439 | | Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability | HIGH 7.0 | 0.2 % | ||
| CVE-2026-85977 | | Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-85231 | | Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-89098 | | Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-111581 | | Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method | LOW 3.3 | 0.1 % | ||
| CVE-2026-111555 | | Luksmeta: missing slot-range validation permits out-of-gap device i/o | MEDIUM 6.0 | 0.1 % | ||
| CVE-2026-104715 | | Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass | HIGH 7.8 | 0.3 % | ||
| CVE-2026-84823 | | Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role | HIGH 7.1 | 0.4 % | ||
| CVE-2026-110777 | | Evolution-data-server: local file disclosure via attach file:// uris | MEDIUM 5.7 | 0.4 % | ||
| CVE-2026-86849 | | Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto | MEDIUM 6.5 | 0.1 % | ||
| CVE-2026-86856 | | Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-86847 | | Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-86846 | | Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-86845 | | Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-86566 | | Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings) | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-86848 | | Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto | HIGH 8.8 | 0.1 % | ||
| CVE-2026-86567 | | Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap | HIGH 8.8 | 0.1 % | ||
| CVE-2026-100236 | | Dpdk: dpdk: heap out-of-bounds read/write in gso header copy | HIGH 8.6 | 0.3 % | ||
| CVE-2026-86565 | | Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write | HIGH 8.2 | 0.2 % | ||
| CVE-2026-86563 | | Dpdk: dpdk: double offset bug in vhost log mapping calculation | HIGH 7.8 | 0.2 % | ||
| CVE-2026-86562 | | Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse) | HIGH 7.8 | 0.2 % | ||
| CVE-2026-86561 | | Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-93683 | | Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou | MEDIUM 6.4 | 0.1 % | ||
| CVE-2026-109968 | | Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-100229 | | Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array boun… | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-109971 | | Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool | MEDIUM 4.7 | 0.2 % | ||
| CVE-2026-109970 | | Clevis: clevis: pkcs#11 token pin written to world-readable file | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-109969 | | Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-100231 | | Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: heap out-of-bounds write in asfmux due to incorrect utf-16 size calculation for… | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-86476 | | Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and … | HIGH 8.4 | 0.2 % | ||
| CVE-2026-110036 | | Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices | LOW 3.3 | 0.2 % | ||
| CVE-2026-105460 | | Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt() | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-109976 | | Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-109833 | | Gnome-remote-desktop: heap buffer overflow in gnome-remote-desktop vnc tls peek buffer handling allows remote denial of service | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-109832 | | Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted) | HIGH 7.5 | 0.4 % | ||
| CVE-2026-109854 | | M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding | LOW 2.5 | 0.1 % | ||
| CVE-2026-108094 | | Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path | HIGH 7.8 | 0.1 % | ||
| CVE-2026-108093 | | Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-108063 | | Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-107935 | | Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose | CRITICAL 9.3 | 0.2 % | ||
| CVE-2026-107655 | | Cups: null pointer dereference via embedded job ticket comments allows remote denial of service | MEDIUM 4.0 | 0.3 % | ||
| CVE-2026-107651 | | Eog: eog: arbitrary code execution via heap buffer overflow in png metadata reader | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-107565 | | Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption | MEDIUM 5.1 | 0.1 % | ||
| CVE-2026-107466 | | Flatpak-builder: local file exfiltration via `file | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-107161 | | Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients | HIGH 7.5 | 0.3 % | ||
| CVE-2026-106067 | | Gimp: gimp: heap buffer overflow in hot color filter on oversized image | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-106066 | | Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-106065 | | Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-107169 | | M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8 | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-107167 | | M17n-lib: heap use-after-free write in re_init_ic() | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-106064 | | Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-107170 | | M17n-lib: null dereference in minput_open_im() after failed m17n_init() | LOW 2.9 | 0.1 % | ||
| CVE-2026-107168 | | M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars() | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-106061 | | Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-80048 | | Sssd: sssd-kcm: local denial of service via excessive memory preallocation | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-104045 | | Sssd: sssd: denial of service via race condition in autofs responder | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-104046 | | Sssd: sssd: denial of service via incomplete identity provider authentication requests | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-106062 | | Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file | HIGH 7.8 | 0.1 % | ||
| CVE-2026-101258 | corrigé en 0:9.54.0-19.el9_8.3 | Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free | HIGH 7.8 | 0.2 % | ||
| CVE-2026-106063 | | Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-104048 | | Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation | HIGH 8.1 | 0.3 % | ||
| CVE-2026-104047 | | Sssd: sssd: information disclosure via query injection in entra id lookups | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-88252 | | Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustion | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104044 | | Sssd: sssd: denial of service via crafted passkey kerberos authentication request | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-104043 | | Sssd: sssd: denial of service via undersized packet parsing in nss responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104042 | | Sssd: sssd: denial of service via out-of-bounds read in pam responder | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-104041 | | Sssd: sssd: denial of service via unbounded negative cache growth | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104040 | | Sssd: sssd: information disclosure via odata injection in entra id lookups | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-104039 | | Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-104038 | | Sssd: sssd: denial of service via missing sid extension in certificate mapping | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-104037 | | Sssd: sssd: denial of service via packet length underflow in autofs responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-92821 | | Sssd: sssd: access control bypass via premature ldap access rule evaluation | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-104036 | | Sssd: sssd: denial of service via out-of-bounds write in nfs idmap plugin | MEDIUM 5.8 | 0.1 % | ||
| CVE-2026-104035 | | Sssd: sssd: denial of service via memory exhaustion in kcm responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104034 | | Sssd: sssd: denial of service via use-after-free in kcm ticket renewal | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-104033 | | Sssd: sssd: access control bypass via improper ldap shadow expiration check | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-104032 | | Sssd: sssd: denial of service via unprivileged autofs cache invalidation | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104031 | | Sssd: sssd: denial of service via memory exhaustion in autofs responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104029 | | Sssd: sssd: denial of service via out-of-bounds read in autofs responder | LOW 3.3 | 0.1 % | ||
| CVE-2026-104030 | | Sssd: sssd: denial of service via out-of-bounds read during passkey parsing | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-105326 | | Cups: cups: argument injection in mailto notifier via notify-recipient-uri | LOW 2.5 | 0.2 % | ||
| CVE-2026-104988 | | Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject | HIGH 8.1 | 0.2 % | ||
| CVE-2026-94422 | | xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape | HIGH 8.7 | 0.5 % | ||
| CVE-2026-95512 | | Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-86345 | | 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result | CRITICAL 9.0 | 0.4 % | ||
| CVE-2026-86344 | | 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue | HIGH 7.5 | 0.3 % | ||
| CVE-2026-103641 | | Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-103399 | | Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-103242 | | Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag | HIGH 7.1 | 0.1 % | ||
| CVE-2026-102560 | corrigé en 0:2.72.0-16.el9_8.8 | Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-102559 | corrigé en 0:2.72.0-16.el9_8.8 | Libsoup: libsoup: heap buffer overflow during websocket client-frame masking | HIGH 8.6 | 0.4 % | ||
| CVE-2026-102558 | corrigé en 0:2.72.0-16.el9_8.8 | Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth | HIGH 8.6 | 0.4 % | ||
| CVE-2026-102555 | | Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding | HIGH 8.2 | 0.4 % | ||
| CVE-2026-102557 | corrigé en 0:2.72.0-16.el9_8.8 | Libsoup: libsoup: heap buffer overflow during websocket message reassembly | HIGH 8.6 | 0.3 % | ||
| CVE-2026-102556 | corrigé en 0:2.72.0-16.el9_8.8 | Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion | HIGH 8.6 | 0.3 % | ||
| CVE-2026-95520 | | Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages | HIGH 7.1 | 0.1 % | ||
| CVE-2026-97029 | | Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group | MEDIUM 5.7 | 0.2 % | ||
| CVE-2026-97024 | corrigé en 0:1.12.9-4.el9_8.6 | Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc | HIGH 7.1 | 0.4 % | ||
| CVE-2026-97027 | | Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files | LOW 3.6 | 0.1 % | ||
| CVE-2026-97026 | | Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path | LOW 3.9 | 0.1 % | ||
| CVE-2026-97025 | | Flatpak: flatpak: world-readable oci authentication token in system-helper cache path | LOW 3.2 | 0.1 % | ||
| CVE-2026-102010 | | Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if | HIGH 7.0 | 0.3 % | ||
| CVE-2026-97023 | corrigé en 0:1.12.9-4.el9_8.6 | Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin | HIGH 7.1 | 0.4 % | ||
| CVE-2026-96284 | | Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following | LOW 2.5 | 0.1 % | ||
| CVE-2026-96282 | | Flatpak: flatpak: extension metadata path traversal file existence oracle | LOW 3.1 | 0.2 % | ||
| CVE-2026-96283 | | Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull | LOW 3.3 | 0.1 % | ||
| CVE-2026-96281 | | Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-96280 | corrigé en 0:1.12.9-4.el9_8.4 | Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems | HIGH 7.5 | 0.5 % | ||
| CVE-2026-96279 | | Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-93834 | | Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape | HIGH 8.8 | 0.4 % | ||
| CVE-2026-95521 | | Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm | HIGH 7.8 | 0.6 % | ||
| CVE-2026-95519 | | Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows) | HIGH 7.8 | 0.1 % | ||
| CVE-2026-97185 | corrigé en 2:3.0.4-4.el9_8.14 | Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file | HIGH 7.8 | 0.1 % | ||
| CVE-2026-96889 | | Librsvg: use-after-free when xml includes have duplicated entities | HIGH 7.8 | 0.5 % | ||
| CVE-2026-96546 | | Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader | LOW 2.5 | 0.2 % | ||
| CVE-2026-96545 | | Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-96541 | | Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline | HIGH 7.5 | 0.9 % | ||
| CVE-2026-96276 | | Flatpak: flatpak: arbitrary write in host context via flatpak build-init | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-96275 | corrigé en 0:1.12.9-4.el9_8.4 | Flatpak: flatpak: arbitrary write access as root via extra-data extraction | HIGH 8.8 | 0.5 % | ||
| CVE-2026-96512 | | Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization | HIGH 7.8 | 0.3 % | ||
| CVE-2026-96442 | corrigé en 1:27.2-18.el9_8.3 | Emacs: emacs: arbitrary code execution in flymake mode | HIGH 7.8 | 0.2 % | ||
| CVE-2026-90462 | | Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-94640 | corrigé en 0:1.2.6-7.el9_8.1 | Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service | HIGH 7.5 | 0.4 % | ||
| CVE-2026-95619 | | Gcc: libstdc++ integer overflow in `new` operator | HIGH 7.7 | 0.4 % | ||
| CVE-2026-95508 | | Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu | HIGH 7.4 | 0.6 % | ||
| CVE-2026-93433 | | Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-92382 | | Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write | MEDIUM 4.1 | 0.1 % | ||
| CVE-2026-94184 | corrigé en 0:6.4.24-1.el9_8.1 | Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01) | HIGH 8.1 | 1.2 % | ||
| CVE-2026-80110 | corrigé en 0:11.7.1-2.el9_8 | Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endp… | HIGH 8.1 | 0.2 % | ||
| CVE-2026-92574 | | Cri-o: cri-o checkpoint restore bypasses destination security context | HIGH 8.8 | 0.7 % | ||
| CVE-2026-91202 | corrigé en 0:36.1-1.el9_8 | Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-91203 | | Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition | MEDIUM 6.0 | 0.1 % | ||
| CVE-2026-91205 | corrigé en 0:36.1-1.el9_8 | Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race | MEDIUM 6.0 | 0.1 % | ||
| CVE-2026-92768 | corrigé en 0:348.1-1.el9_8 | Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-92747 | corrigé en 0:348.1-1.el9_8 | Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list | MEDIUM 5.0 | 0.2 % | ||
| CVE-2026-92745 | corrigé en 0:348.1-1.el9_8 | Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments | MEDIUM 5.0 | 0.1 % | ||
| CVE-2026-91142 | | Cockpit: cockpit: unauthorized modification of login records via integer overflow | LOW 3.6 | 0.1 % | ||
| CVE-2026-91147 | | Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-91149 | | Cockpit: cockpit: denial of service via unbounded connection thread spawning | HIGH 7.5 | 0.3 % | ||
| CVE-2026-93676 | | Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks | LOW 3.2 | 0.1 % | ||
| CVE-2026-93653 | | Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service) | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-81627 | | Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram | HIGH 8.2 | 0.2 % | ||
| CVE-2026-89058 | corrigé en 0:3.0.26-20.el9_8.1 | Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config | HIGH 7.4 | 0.3 % | ||
| CVE-2026-89059 | corrigé en 0:3.0.26-20.el9_8.1 | Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) | HIGH 7.5 | 0.8 % | ||
| CVE-2026-76781 | | Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-92925 | corrigé en 0:8.0.7-1.el9_7 | Redis: redis: out-of-bounds read via crafted cluster bus packets | HIGH 7.1 | 0.7 % | ||
| CVE-2026-86320 | | Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`) | HIGH 7.8 | 0.3 % | ||
| CVE-2026-42784 | corrigé en 0:1.10.2.1-1.el9_8 | Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion | HIGH 7.4 | 0.3 % | ||
| CVE-2026-92091 | | Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array | MEDIUM 5.9 | 0.6 % | ||
| CVE-2025-11395 | corrigé en 2:1.43.3-2.el9_8 | Podman: arbitrary file write when importing oci archive | MEDIUM 5.5 | 0.4 % | ||
| CVE-2026-92248 | corrigé en 2:3.0.4-4.el9_8.14 | Gimp: integer overflow when generating a thumbnail preview for a psd file | HIGH 7.8 | 0.2 % | ||
| CVE-2026-85234 | corrigé en 0:5.2-40.el9_8.1 | Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine | HIGH 7.5 | 0.5 % | ||
| CVE-2026-79699 | | Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-79705 | | Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers | MEDIUM 4.5 | 0.4 % | ||
| CVE-2026-85013 | corrigé en 0:5.3.0-2.el9_8.1 | Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters | HIGH 7.3 | 0.2 % | ||
| CVE-2026-91786 | | Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-75092 | corrigé en 0:0.24.0-1.el9_8.1 | Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-w… | HIGH 7.3 | 0.2 % | ||
| CVE-2026-19816 | | PackageKit: dnf5 backend ignores SIMULATE on RepoRemove | HIGH 7.1 | 0.1 % |