Export limit exceeded: 11408 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420575 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420575 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109854 | 3 M17n-lib, Red Hat, Redhat | 4 M17n-lib, Enterprise Linux, Enterprise Linux and 1 more | 2026-11-06 | 2.5 Low |
| A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure. | ||||
| CVE-2026-100229 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-06 | 6.5 Medium |
| A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could exploit this by providing a specially crafted H.266 bitstream to a third-party application that uses this library API, potentially causing a crash or memory corruption. No standard GStreamer pipeline element currently invokes the affected code path. | ||||
| CVE-2026-10028 | 2 Gnome, Redhat | 3 Glib-networking, Enterprise Linux, Rhel Els | 2026-11-06 | 4.3 Medium |
| A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker. | ||||
| CVE-2026-0992 | 3 Ibm, Redhat, Xmlsoft | 11 Aix, Vios, Enterprise Linux and 8 more | 2026-11-06 | 2.9 Low |
| A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition. | ||||
| CVE-2026-0989 | 3 Ibm, Redhat, Xmlsoft | 11 Aix, Vios, Enterprise Linux and 8 more | 2026-11-06 | 3.7 Low |
| A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk. | ||||
| CVE-2026-0988 | 1 Redhat | 4 Enterprise Linux, Hummingbird, Openshift Ai and 1 more | 2026-11-06 | 3.7 Low |
| A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS). | ||||
| CVE-2026-0967 | 2 Libssh, Redhat | 5 Libssh, Enterprise Linux, Hummingbird and 2 more | 2026-11-06 | 5.5 Medium |
| A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client. | ||||
| CVE-2026-0968 | 2 Libssh, Redhat | 5 Libssh, Enterprise Linux, Hummingbird and 2 more | 2026-11-06 | 3.1 Low |
| A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes. | ||||
| CVE-2026-0965 | 2 Libssh, Redhat | 5 Libssh, Enterprise Linux, Hummingbird and 2 more | 2026-11-06 | N/A |
| A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations. | ||||
| CVE-2025-9820 | 1 Redhat | 10 Ceph Storage, Cert Manager, Discovery and 7 more | 2026-11-06 | 4 Medium |
| A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks. | ||||
| CVE-2025-9640 | 1 Redhat | 3 Enterprise Linux, Openshift, Rhel Els | 2026-11-06 | 4.3 Medium |
| A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability. | ||||
| CVE-2025-9615 | 1 Redhat | 3 Enterprise Linux, Openshift, Rhel Els | 2026-11-06 | N/A |
| A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system's network. The daemon runs with root privileges and can access files owned by users different from the one who added the connection. | ||||
| CVE-2025-8556 | 1 Redhat | 23 Acm, Advanced Cluster Security, Ceph Storage and 20 more | 2026-11-06 | 3.7 Low |
| A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange. | ||||
| CVE-2025-8283 | 1 Redhat | 3 Enterprise Linux, Openshift, Openshift Container Platform | 2026-11-06 | 3.7 Low |
| A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers. | ||||
| CVE-2025-8277 | 1 Redhat | 3 Enterprise Linux, Openshift, Rhel Els | 2026-11-06 | 3.1 Low |
| A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability. | ||||
| CVE-2026-107170 | 2 M17n-lib, Redhat | 3 M17n-lib, Enterprise Linux, Rhel Els | 2026-11-06 | 2.9 Low |
| A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an input method dereferences this null pointer without proper validation. This issue causes the application to crash, resulting in a Denial of Service (DoS). | ||||
| CVE-2026-105326 | 2 Cups, Redhat | 4 Cups, Enterprise Linux, Hardened Images and 1 more | 2026-11-06 | 2.5 Low |
| An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user. | ||||
| CVE-2026-105460 | 2 Bluez, Redhat | 3 Bluez, Enterprise Linux, Rhel Els | 2026-11-06 | 5.5 Medium |
| A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to read beyond the allocated buffer and crash. | ||||
| CVE-2026-104029 | 3 Fedoraproject, Redhat, Sssd | 6 Sssd, Enterprise Linux, Openshift and 3 more | 2026-11-06 | 3.3 Low |
| A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs responder process to crash, resulting in a denial of service (DoS). | ||||
| CVE-2026-123834 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 7.5 High |
| In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account | ||||