Red Hat Red Hat Enterprise Linux 6
841 published vulnerabilities name this product. The 200 most recent are listed.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-85498 | | Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow | LOW 3.5 | |||
| CVE-2026-117548 | | 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service | MEDIUM 6.5 | |||
| CVE-2026-109411 | | Samba: access control bypass via vfs_ceph_rgw case-insensitive open | HIGH 8.1 | |||
| CVE-2026-115486 | | Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning | HIGH 7.1 | 0.2 % | ||
| CVE-2026-115485 | | Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-115484 | | Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg | HIGH 7.6 | 0.2 % | ||
| CVE-2026-115221 | | Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership | MEDIUM 5.4 | 0.1 % | ||
| CVE-2026-115207 | | Patch: filename validation bypass in reversal fallback allows file creation outside the working directory | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-85518 | | Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-114038 | | Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string | MEDIUM 5.1 | 0.1 % | ||
| CVE-2026-112177 | | Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8 | HIGH 7.3 | 0.4 % | ||
| CVE-2026-112261 | | Gimp: gimp: use-after-free in xcf loader via prop_selected_path | HIGH 7.8 | 0.2 % | ||
| CVE-2026-112258 | | Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels | HIGH 7.8 | 0.2 % | ||
| CVE-2026-112257 | | Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033) | HIGH 7.8 | 0.2 % | ||
| CVE-2026-112260 | | Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing | HIGH 7.1 | 0.2 % | ||
| CVE-2026-112259 | | Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-89096 | | Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-89088 | | Parted: parted: denial of service via heap buffer overflow during fat16 resize | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-89085 | | Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-111802 | | Nautilus: nautilus: arbitrary file deletion via trash symlink | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-17591 | | Libarchive: libarchive: use-after-free via aliased mac metadata copy | LOW 3.6 | 0.2 % | ||
| CVE-2026-62438 | | Gimp: gimp: paa integer overflow out-of-bounds read | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-62439 | | Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability | HIGH 7.0 | 0.2 % | ||
| CVE-2026-85977 | | Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-85231 | | Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-89098 | | Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-105958 | | Spice-server: spice: heap oob read/write via unchecked migration data offsets | HIGH 7.5 | 0.2 % | ||
| CVE-2026-105959 | | Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation | HIGH 7.5 | 0.5 % | ||
| CVE-2026-104715 | | Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass | HIGH 7.8 | 0.3 % | ||
| CVE-2026-110777 | | Evolution-data-server: local file disclosure via attach file:// uris | MEDIUM 5.7 | 0.4 % | ||
| CVE-2026-86476 | | Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and … | HIGH 8.4 | 0.2 % | ||
| CVE-2026-110036 | | Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices | LOW 3.3 | 0.2 % | ||
| CVE-2026-105460 | | Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt() | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-109854 | | M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding | LOW 2.5 | 0.1 % | ||
| CVE-2026-108119 | | Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-108093 | | Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-108063 | | Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-107655 | | Cups: null pointer dereference via embedded job ticket comments allows remote denial of service | MEDIUM 4.0 | 0.3 % | ||
| CVE-2026-107651 | | Eog: eog: arbitrary code execution via heap buffer overflow in png metadata reader | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-107161 | | Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients | HIGH 7.5 | 0.3 % | ||
| CVE-2026-106067 | | Gimp: gimp: heap buffer overflow in hot color filter on oversized image | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-106066 | | Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-106065 | | Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-107169 | | M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8 | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-107167 | | M17n-lib: heap use-after-free write in re_init_ic() | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-106064 | | Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-107170 | | M17n-lib: null dereference in minput_open_im() after failed m17n_init() | LOW 2.9 | 0.1 % | ||
| CVE-2026-107168 | | M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars() | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-106061 | | Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-80048 | | Sssd: sssd-kcm: local denial of service via excessive memory preallocation | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-104045 | | Sssd: sssd: denial of service via race condition in autofs responder | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-104046 | | Sssd: sssd: denial of service via incomplete identity provider authentication requests | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-106062 | | Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file | HIGH 7.8 | 0.1 % | ||
| CVE-2026-101258 | | Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free | HIGH 7.8 | 0.2 % | ||
| CVE-2026-106063 | | Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-104048 | | Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation | HIGH 8.1 | 0.3 % | ||
| CVE-2026-104047 | | Sssd: sssd: information disclosure via query injection in entra id lookups | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-88252 | | Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustion | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104044 | | Sssd: sssd: denial of service via crafted passkey kerberos authentication request | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-104043 | | Sssd: sssd: denial of service via undersized packet parsing in nss responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104042 | | Sssd: sssd: denial of service via out-of-bounds read in pam responder | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-104041 | | Sssd: sssd: denial of service via unbounded negative cache growth | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104040 | | Sssd: sssd: information disclosure via odata injection in entra id lookups | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-104039 | | Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-104038 | | Sssd: sssd: denial of service via missing sid extension in certificate mapping | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-104037 | | Sssd: sssd: denial of service via packet length underflow in autofs responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-92821 | | Sssd: sssd: access control bypass via premature ldap access rule evaluation | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-104036 | | Sssd: sssd: denial of service via out-of-bounds write in nfs idmap plugin | MEDIUM 5.8 | 0.1 % | ||
| CVE-2026-104035 | | Sssd: sssd: denial of service via memory exhaustion in kcm responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104034 | | Sssd: sssd: denial of service via use-after-free in kcm ticket renewal | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-104033 | | Sssd: sssd: access control bypass via improper ldap shadow expiration check | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-104032 | | Sssd: sssd: denial of service via unprivileged autofs cache invalidation | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104031 | | Sssd: sssd: denial of service via memory exhaustion in autofs responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104029 | | Sssd: sssd: denial of service via out-of-bounds read in autofs responder | LOW 3.3 | 0.1 % | ||
| CVE-2026-104030 | | Sssd: sssd: denial of service via out-of-bounds read during passkey parsing | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104988 | | Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject | HIGH 8.1 | 0.2 % | ||
| CVE-2026-95512 | | Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-86345 | | 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result | CRITICAL 9.0 | 0.4 % | ||
| CVE-2026-86344 | | 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue | HIGH 7.5 | 0.3 % | ||
| CVE-2026-103641 | | Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-103399 | | Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-103242 | | Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag | HIGH 7.1 | 0.1 % | ||
| CVE-2026-102560 | | Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-102559 | | Libsoup: libsoup: heap buffer overflow during websocket client-frame masking | HIGH 8.6 | 0.4 % | ||
| CVE-2026-102558 | | Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth | HIGH 8.6 | 0.4 % | ||
| CVE-2026-102555 | | Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding | HIGH 8.2 | 0.4 % | ||
| CVE-2026-102557 | | Libsoup: libsoup: heap buffer overflow during websocket message reassembly | HIGH 8.6 | 0.3 % | ||
| CVE-2026-102556 | | Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion | HIGH 8.6 | 0.3 % | ||
| CVE-2026-95520 | | Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages | HIGH 7.1 | 0.1 % | ||
| CVE-2026-102474 | | Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation | MEDIUM 4.0 | 0.1 % | ||
| CVE-2026-102473 | | Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-102010 | | Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if | HIGH 7.0 | 0.3 % | ||
| CVE-2026-93834 | | Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape | HIGH 8.8 | 0.4 % | ||
| CVE-2026-95521 | | Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm | HIGH 7.8 | 0.6 % | ||
| CVE-2026-95519 | | Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows) | HIGH 7.8 | 0.1 % | ||
| CVE-2026-97185 | | Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file | HIGH 7.8 | 0.1 % | ||
| CVE-2026-96889 | | Librsvg: use-after-free when xml includes have duplicated entities | HIGH 7.8 | 0.5 % | ||
| CVE-2026-96546 | | Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader | LOW 2.5 | 0.2 % | ||
| CVE-2026-96545 | | Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-96442 | | Emacs: emacs: arbitrary code execution in flymake mode | HIGH 7.8 | 0.2 % | ||
| CVE-2026-90462 | | Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-94640 | | Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service | HIGH 7.5 | 0.4 % | ||
| CVE-2026-95619 | | Gcc: libstdc++ integer overflow in `new` operator | HIGH 7.7 | 0.4 % | ||
| CVE-2026-92382 | | Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write | MEDIUM 4.1 | 0.1 % | ||
| CVE-2026-94184 | | Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01) | HIGH 8.1 | 1.2 % | ||
| CVE-2026-80110 | | Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endp… | HIGH 8.1 | 0.2 % | ||
| CVE-2026-93653 | | Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service) | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-81627 | | Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram | HIGH 8.2 | 0.2 % | ||
| CVE-2026-76781 | | Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-92248 | | Gimp: integer overflow when generating a thumbnail preview for a psd file | HIGH 7.8 | 0.2 % | ||
| CVE-2026-85234 | | Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine | HIGH 7.5 | 0.5 % | ||
| CVE-2026-85013 | | Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters | HIGH 7.3 | 0.2 % | ||
| CVE-2026-19816 | | PackageKit: dnf5 backend ignores SIMULATE on RepoRemove | HIGH 7.1 | 0.1 % | ||
| CVE-2026-90996 | | Sssd: sssd: denial of service in nss responder via crafted zero-length requests | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-90995 | | Sssd: sssd: local denial of service due to null pointer dereference in pam responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-90994 | | Sssd: sssd: denial of service via malformed pam v1 requests | MEDIUM 4.0 | 0.2 % | ||
| CVE-2026-90463 | | Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`) | MEDIUM 4.0 | 0.1 % | ||
| CVE-2026-90947 | | Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file | HIGH 7.8 | 0.1 % | ||
| CVE-2026-90949 | | Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch | HIGH 7.8 | 0.3 % | ||
| CVE-2026-90948 | | Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions | HIGH 7.8 | 0.2 % | ||
| CVE-2026-89329 | | Device-mapper-multipath: local denial of service via blocking ipc send operations | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-18495 | | Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-77159 | | Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-88914 | | Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-88924 | | Gvfs: gvfs-admin socket ownership race permits local root | HIGH 7.0 | 0.2 % | ||
| CVE-2026-88859 | | Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-18147 | | Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url | HIGH 8.1 | 0.5 % | ||
| CVE-2026-87876 | | Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up) | LOW 3.0 | 0.3 % | ||
| CVE-2026-87875 | | Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-87853 | | Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation | HIGH 7.5 | 0.3 % | ||
| CVE-2026-18090 | | Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-74860 | | Libxml2: double-free/uaf in libxml2 python bindings | HIGH 8.5 | 0.7 % | ||
| CVE-2026-76561 | | Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint) | HIGH 7.2 | 0.7 % | ||
| CVE-2026-86469 | | Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-19843 | | 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor | HIGH 8.4 | 0.5 % | ||
| CVE-2026-18453 | | 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search | HIGH 7.5 | 0.8 % | ||
| CVE-2026-18355 | | 389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet() | HIGH 7.5 | 0.8 % | ||
| CVE-2026-76560 | | 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn | HIGH 7.5 | 0.6 % | ||
| CVE-2026-79678 | | Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service | HIGH 8.1 | 0.9 % | ||
| CVE-2026-76578 | | Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci | CRITICAL 9.8 | 1.2 % | ||
| CVE-2026-85534 | | Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-85197 | | Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload | HIGH 7.6 | 0.3 % | ||
| CVE-2026-84838 | | Rpm: command injection in rpmuncompress via unescaped filenames passed to popen() | HIGH 7.8 | 1.1 % | ||
| CVE-2026-84837 | | Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path | HIGH 7.8 | 0.7 % | ||
| CVE-2026-53683 | | Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-84270 | | Gvfs: mtp: out-of-bounds read in do_read() | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-84269 | | Gvfs: afp: heap-based buffer overflow in dsi read path | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-84267 | | Gvfs: sftp: uninitialized heap disclosure in read_string() | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-84268 | | Gvfs: sftp: heap-based buffer overflow in read_reply() | HIGH 8.8 | 0.6 % | ||
| CVE-2026-84233 | | Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames | HIGH 7.0 | 0.2 % | ||
| CVE-2026-53682 | | Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-11873 | | Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-18743 | | Popt-devel: popt-static: short realloc in poptconfigfiletostring | LOW 2.5 | 0.1 % | ||
| CVE-2026-83596 | | Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature | HIGH 8.8 | 0.3 % | ||
| CVE-2026-13732 | | Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf | HIGH 7.0 | 0.1 % | ||
| CVE-2026-82343 | | Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-82330 | | Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-82328 | | Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-82324 | | Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0 | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-81893 | | Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery | MEDIUM 4.7 | 0.2 % | ||
| CVE-2026-78002 | | Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function | HIGH 7.5 | 1.1 % | ||
| CVE-2026-79902 | | Gimp: stack vla size underflow denial of service in seattle | MEDIUM 5.5 | 0.3 % | ||
| CVE-2026-80186 | | Bluez: stack overflow in name2utf8 causes dos and potential code execution | HIGH 7.6 | 0.5 % | ||
| CVE-2026-80185 | | Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root | MEDIUM 5.7 | 0.3 % | ||
| CVE-2026-80101 | | Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-79992 | | Emacs: emacs: command injection via crafted filenames in tramp | HIGH 7.8 | 0.2 % | ||
| CVE-2026-79655 | | Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write | HIGH 7.8 | 0.2 % | ||
| CVE-2026-78701 | | 389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos | MEDIUM 6.5 | 0.8 % | ||
| CVE-2026-78322 | | File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-78475 | | Gimp: unbounded stack vla and 21-byte stack over-read in pix (esm) loader | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-78465 | | Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit | HIGH 7.0 | 0.3 % | ||
| CVE-2026-19685 | | Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validat… | HIGH 7.1 | 0.2 % | ||
| CVE-2026-78367 | | Rpm: rpmbuild gettarspec() crafted tar member name → macro injection | HIGH 7.0 | 0.2 % | ||
| CVE-2026-78376 | | Webkitgtk: use-after-free of jscvalue function parameters | HIGH 8.8 | 0.4 % | ||
| CVE-2026-78323 | | Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-73199 | | Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-11861 | | Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships | CRITICAL 9.6 | 0.4 % | ||
| CVE-2026-73198 | | Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read | HIGH 7.5 | 0.5 % | ||
| CVE-2026-13097 | | Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore | HIGH 8.7 | 0.7 % | ||
| CVE-2026-73196 | | Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-73197 | | Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read | HIGH 7.5 | 0.5 % | ||
| CVE-2026-18917 | | Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow | HIGH 7.8 | 0.2 % | ||
| CVE-2026-77014 | | Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-43961 | | Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution | HIGH 7.8 | 0.2 % | ||
| CVE-2026-75032 | | Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-13002 | | Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-58224 | | Samba: ctdb fails to do integrity checking of received packets | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-19617 | | Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-73584 | | Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-73583 | | Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr | MEDIUM 6.6 | 0.1 % | ||
| CVE-2026-73585 | | Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-19654 | | Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsys… | HIGH 7.5 | 0.6 % | ||
| CVE-2026-19548 | | Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-18663 | | 389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control | MEDIUM 5.9 | 0.5 % | ||
| CVE-2026-19550 | | Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes | HIGH 8.2 | 0.5 % | ||
| CVE-2026-19546 | | Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute | HIGH 8.8 | 0.4 % | ||
| CVE-2026-72693 | | Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login | HIGH 7.8 | 0.1 % | ||
| CVE-2026-72694 | | Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation | HIGH 7.1 | 0.1 % | ||
| CVE-2026-6426 | | Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access | MEDIUM 4.4 | 0.4 % | ||
| CVE-2026-63622 | | Libvirt: swtpm privilege escalation via symlink following | HIGH 7.8 | 0.1 % |