Red Hat Red Hat Hardened Images
194 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-85498 | fixed in 127-5.1.hum1 | Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow | LOW 3.5 | |||
| CVE-2026-115207 | | Patch: filename validation bypass in reversal fallback allows file creation outside the working directory | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-114406 | | Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-85518 | fixed in 1.4.5-2.1.hum1 | Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-114236 | | Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers | LOW 3.3 | 0.1 % | ||
| CVE-2026-92824 | | Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-92823 | | Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-92822 | | Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-16460 | | Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization | HIGH 7.4 | 0.1 % | ||
| CVE-2026-17591 | fixed in 3.8.9-2.1.hum1 | Libarchive: libarchive: use-after-free via aliased mac metadata copy | LOW 3.6 | 0.2 % | ||
| CVE-2026-85977 | fixed in 1.3.8-0.1.hum1 | Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-85231 | | Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-88842 | fixed in 1.37.0-9.4.hum1 | Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption | LOW 3.3 | 0.2 % | ||
| CVE-2026-88829 | | Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy | HIGH 7.2 | 0.3 % | ||
| CVE-2026-90954 | | Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush | HIGH 7.8 | 0.2 % | ||
| CVE-2026-88834 | | Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds | LOW 3.7 | 0.2 % | ||
| CVE-2026-88838 | | Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-88833 | | Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-108119 | fixed in 1.37.0-9.4.hum1 | Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-107935 | | Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose | CRITICAL 9.3 | 0.2 % | ||
| CVE-2026-107655 | fixed in 2.4.19-4.4.hum1 | Cups: null pointer dereference via embedded job ticket comments allows remote denial of service | MEDIUM 4.0 | 0.3 % | ||
| CVE-2026-107445 | | Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-107444 | | Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-107161 | | Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients | HIGH 7.5 | 0.3 % | ||
| CVE-2026-106033 | | Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-105326 | fixed in 2.4.19-4.3.hum1 | Cups: cups: argument injection in mailto notifier via notify-recipient-uri | LOW 2.5 | 0.2 % | ||
| CVE-2026-95512 | fixed in 2.14.3-2.1.hum1 | Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-103242 | | Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag | HIGH 7.1 | 0.1 % | ||
| CVE-2026-95520 | | Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages | HIGH 7.1 | 0.1 % | ||
| CVE-2026-102010 | fixed in 13.5.0-0.2.hum1 | Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if | HIGH 7.0 | 0.3 % | ||
| CVE-2026-95521 | | Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm | HIGH 7.8 | 0.6 % | ||
| CVE-2026-95519 | | Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows) | HIGH 7.8 | 0.1 % | ||
| CVE-2026-88840 | | Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-88839 | fixed in 1.37.0-9.1.hum1 | Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-88837 | fixed in 1.37.0-9.1.hum1 | Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-88835 | fixed in 1.37.0-9.1.hum1 | Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-88831 | fixed in 1.37.0-9.1.hum1 | Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-88832 | fixed in 1.37.0-9.1.hum1 | Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow | HIGH 7.3 | 0.1 % | ||
| CVE-2026-88830 | | Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow | HIGH 7.5 | 0.4 % | ||
| CVE-2026-96512 | | Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization | HIGH 7.8 | 0.3 % | ||
| CVE-2026-95619 | fixed in 16.2.1-2.hum1 | Gcc: libstdc++ integer overflow in `new` operator | HIGH 7.7 | 0.4 % | ||
| CVE-2026-93653 | | Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service) | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-76781 | fixed in 2.15.3-0.1.3.hum1 | Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-92925 | | Redis: redis: out-of-bounds read via crafted cluster bus packets | HIGH 7.1 | 0.7 % | ||
| CVE-2026-42784 | | Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion | HIGH 7.4 | 0.3 % | ||
| CVE-2025-11395 | | Podman: arbitrary file write when importing oci archive | MEDIUM 5.5 | 0.4 % | ||
| CVE-2026-85234 | | Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine | HIGH 7.5 | 0.5 % | ||
| CVE-2026-79699 | | Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-79705 | fixed in 6.1.3-1.hum1 | Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers | MEDIUM 4.5 | 0.4 % | ||
| CVE-2026-85013 | fixed in 5.6.2-1.hum1 | Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters | HIGH 7.3 | 0.2 % | ||
| CVE-2026-18495 | fixed in 4.7.2-2.hum1 | Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-88265 | fixed in 1.30-1.hum1 | Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown | MEDIUM 5.6 | 0.1 % | ||
| CVE-2026-88264 | fixed in 1.30-1.hum1 | Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs | MEDIUM 5.6 | 0.1 % | ||
| CVE-2026-84042 | | Crun: crun: rootful krun with passt executes container payload as host root | HIGH 7.8 | 0.1 % | ||
| CVE-2026-87876 | fixed in 2.4.19-4.2.hum1 | Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up) | LOW 3.0 | 0.3 % | ||
| CVE-2026-87875 | fixed in 2.4.19-4.1.hum1 | Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-87766 | | Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup | HIGH 8.8 | 0.2 % | ||
| CVE-2026-74860 | | Libxml2: double-free/uaf in libxml2 python bindings | HIGH 8.5 | 0.7 % | ||
| CVE-2026-86469 | | Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-84838 | fixed in 6.1.0-1.3.hum1 | Rpm: command injection in rpmuncompress via unescaped filenames passed to popen() | HIGH 7.8 | 1.1 % | ||
| CVE-2026-84837 | fixed in 6.1.0-1.3.hum1 | Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path | HIGH 7.8 | 0.7 % | ||
| CVE-2026-78409 | fixed in 2.42.2-3.4.hum1 | Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks | HIGH 7.0 | 0.2 % | ||
| CVE-2026-78410 | fixed in 2.42.2-3.4.hum1 | Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection | HIGH 7.8 | 0.2 % | ||
| CVE-2026-78408 | fixed in 2.42.2-3.4.hum1 | Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority | HIGH 7.9 | 0.2 % | ||
| CVE-2026-84233 | fixed in 6.1.0-1.hum1 | Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames | HIGH 7.0 | 0.2 % | ||
| CVE-2026-18743 | fixed in 1.19-11.1.hum1 | Popt-devel: popt-static: short realloc in poptconfigfiletostring | LOW 2.5 | 0.1 % | ||
| CVE-2026-13732 | fixed in 17.2-6.2.hum1 | Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf | HIGH 7.0 | 0.1 % | ||
| CVE-2026-82327 | | Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-19685 | | Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validat… | HIGH 7.1 | 0.2 % | ||
| CVE-2026-78367 | fixed in 6.1.0-1.3.hum1 | Rpm: rpmbuild gettarspec() crafted tar member name → macro injection | HIGH 7.0 | 0.2 % | ||
| CVE-2026-43961 | fixed in 9.2.967-1.1.hum1 | Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution | HIGH 7.8 | 0.2 % | ||
| CVE-2026-19617 | fixed in 2.03.43-1.hum1 | Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-19730 | | Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives | MEDIUM 4.2 | 0.1 % | ||
| CVE-2026-19548 | fixed in 2.46.1-1.4.hum1 | Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-72693 | | Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login | HIGH 7.8 | 0.1 % | ||
| CVE-2026-15816 | | Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() | HIGH 7.5 | 0.5 % | ||
| CVE-2026-18938 | | P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-19079 | fixed in 3.11-2.2.hum1 | Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-18839 | fixed in 1.19-11.2.hum1 | Popt-devel: popt-static: size_t underflow in singleoptionhelp | LOW 2.2 | 0.1 % | ||
| CVE-2026-44605 | fixed in 6.0.1-6.2.hum1 | Rpm: heap buffer overflow in ndb slot table parsing | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-71227 | | Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-71226 | | Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path | HIGH 7.3 | 0.1 % | ||
| CVE-2026-71225 | | Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-18739 | fixed in 1.19-11.1.hum1 | Popt-devel: popt-static: off-by-one in poptstuffargs | LOW 2.5 | 0.1 % | ||
| CVE-2026-18477 | fixed in 1.35-9.1.hum1 | Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-18508 | fixed in 1.35-9.2.hum1 | Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-18220 | | Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing | HIGH 7.8 | 0.2 % | ||
| CVE-2026-15003 | fixed in 2.46.1-1.1.hum1 | Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service | MEDIUM 5.6 | 0.2 % | ||
| CVE-2026-16730 | | Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-16517 | fixed in 3.8.8-3.1.hum1 | Libarchive: libarchive: signed integer overflow in archive_write_zip_header | LOW 2.9 | 0.1 % | ||
| CVE-2026-59851 | fixed in 0.12.1-4.hum1 | Libssh: libssh: authentication bypass via missing gssapi principal check | HIGH 8.8 | 0.5 % | ||
| CVE-2026-59850 | | Libssh: libssh: use-after-free via data callbacks on closed channels | HIGH 7.5 | 0.3 % | ||
| CVE-2026-59849 | fixed in 0.12.1-4.hum1 | Libssh: libssh: denial of service via automatic certificate authentication loop | HIGH 7.5 | 0.4 % | ||
| CVE-2026-59848 | | Libssh: libssh: denial of service via sftp responses with unknown request ids | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-59847 | | Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification | HIGH 7.5 | 0.3 % | ||
| CVE-2026-59846 | | Libssh: libssh: information disclosure via proxycommand %r username expansion | LOW 3.9 | 0.1 % | ||
| CVE-2026-16445 | | Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module | HIGH 7.5 | 3.2 % | ||
| CVE-2026-59844 | | Libssh: libssh: denial of service via oversized sftp read length | MEDIUM 6.5 | 0.6 % | ||
| CVE-2026-59845 | | Libssh: libssh: denial of service via unchecked proxycommand fork() failure | MEDIUM 5.9 | 0.1 % | ||
| CVE-2026-59843 | | Libssh: libssh: denial of service via zero advertised channel packet size | MEDIUM 6.5 | 0.6 % | ||
| CVE-2026-59842 | fixed in 0.12.1-4.hum1 | Libssh: libssh: information disclosure via short gssapi curve25519 public key | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-15370 | fixed in 0.12.2-1.hum1 | Libssh: libssh: stack buffer overflow in sftp server longname construction | HIGH 7.3 | 0.2 % | ||
| CVE-2026-15588 | | Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-48863 | | Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service | HIGH 7.5 | 0.8 % | ||
| CVE-2026-15028 | fixed in 3.8.8-2.1.hum1 | Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header | LOW 3.9 | 0.2 % | ||
| CVE-2026-12610 | | Sssd: use-after-free crash in sssd' 'sssd_pam' process | MEDIUM 6.4 | 0.1 % | ||
| CVE-2026-14164 | | Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack() | HIGH 7.5 | 0.8 % | ||
| CVE-2026-13757 | | P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-12912 | | Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image | HIGH 7.3 | 0.4 % | ||
| CVE-2026-13595 | fixed in 2.42.2-1.hum1 | Util-linux: util-linux: heap use-after-free in libblkid nested partition probing | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-55654 | fixed in 10.3p1-6.hum1 | Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel te… | LOW 3.7 | 0.7 % | ||
| CVE-2026-55655 | | Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-55653 | | Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to clien… | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-56211 | | Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames | HIGH 7.1 | 0.9 % | ||
| CVE-2026-56210 | | Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id | HIGH 7.1 | 0.6 % | ||
| CVE-2026-56209 | | Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack | HIGH 7.1 | 0.6 % | ||
| CVE-2026-56208 | | Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode | HIGH 7.6 | 0.6 % | ||
| CVE-2026-12515 | | Katello: missing repository authorization in content_uploads exposes cross-product content existence | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-4367 | fixed in 3.5.17-7.2.hum1 | Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-42014 | | Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin | MEDIUM 6.6 | 0.1 % | ||
| CVE-2026-11850 | fixed in 1.22.2-8.hum1 | Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read | MEDIUM 5.0 | 0.3 % | ||
| CVE-2026-6893 | | Dracut: dracut: root code execution via dhcp options command injection | HIGH 7.5 | 1.3 % | ||
| CVE-2026-10805 | | Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend | MEDIUM 6.7 | 0.2 % | ||
| CVE-2026-5419 | | Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal | LOW 3.7 | 0.5 % | ||
| CVE-2026-10118 | | Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication | HIGH 7.8 | 0.3 % | ||
| CVE-2026-44604 | fixed in 6.0.1-6.1.hum1 | Rpm: command injection in rpmuncompress dountar() via unescaped archive top-level directory name in popen() shell command | HIGH 7.0 | 0.6 % | ||
| CVE-2026-42015 | | Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling | MEDIUM 5.3 | 0.7 % | ||
| CVE-2026-42013 | | Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name | HIGH 8.2 | 0.4 % | ||
| CVE-2026-42012 | | Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans | HIGH 7.1 | 0.4 % | ||
| CVE-2026-5260 | | Gnutls: gnutls: information disclosure via heap overread in rsa key exchange | HIGH 8.2 | 0.8 % | ||
| CVE-2026-48864 | | Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data | HIGH 7.8 | 0.2 % | ||
| CVE-2026-9149 | fixed in 0.7.38-2.hum1 | Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-9150 | fixed in 0.7.38-2.hum1 | Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-42009 | | Gnutls: gnutls: denial of service via dtls packet reordering vulnerability | HIGH 7.5 | 1.3 % | ||
| CVE-2026-42011 | | Gnutls: gnutls: security bypass due to incorrect name constraint handling | HIGH 7.4 | 0.5 % | ||
| CVE-2026-42010 | | Gnutls: gnutls: authentication bypass via nul character in username | CRITICAL 9.8 | 1.1 % | ||
| CVE-2026-33846 | | Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly | HIGH 7.5 | 1.3 % | ||
| CVE-2026-33845 | | Gnutls: gnutls: denial of service via dtls zero-length fragment | CRITICAL 9.1 | 2.1 % | ||
| CVE-2026-3832 | | Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response | LOW 3.7 | 0.8 % | ||
| CVE-2026-3833 | | Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison | HIGH 7.4 | 0.6 % | ||
| CVE-2026-6732 | fixed in 2.15.3-0.1.hum1 | Libxml2: libxml2: denial of service via crafted xsd-validated document | HIGH 7.5 | 0.6 % | ||
| CVE-2026-6862 | fixed in 39-13.1.hum1 | Efivar: efivar: denial of service due to stack overflow in device path node parsing | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-6846 | fixed in 2.45.1-5.1.hum1 | Binutils: binutils: arbitrary code execution via malformed xcoff object file processing | HIGH 7.8 | 0.2 % | ||
| CVE-2026-6844 | | Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-6845 | fixed in 2.45.1-5.2.hum1 | Binutils: binutils: denial of service via crafted elf file | MEDIUM 5.0 | 0.1 % | ||
| CVE-2026-1584 | fixed in 3.8.12-1.1.hum1 | Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder | HIGH 7.5 | 1.3 % | ||
| CVE-2026-4878 | | Libcap: libcap: privilege escalation via toctou race condition in cap_set_file() | HIGH 7.0 | 0.2 % | ||
| CVE-2025-14821 | fixed in 0.12.0-1.1.hum1 | Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows | HIGH 7.8 | 0.1 % | ||
| CVE-2026-5745 | fixed in 3.8.7-1.hum1 | Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-5704 | fixed in 1.35-10.hum1 | Tar: tar: hidden file injection via crafted archives | MEDIUM 5.5 | 0.4 % | ||
| CVE-2026-3184 | fixed in 2.42-7.1.hum1 | Util-linux: util-linux: access control bypass due to improper hostname canonicalization | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-2625 | fixed in 1.10.1.1-1.2.hum1 | Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-5121 | | Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing | CRITICAL 9.8 | 1.1 % | ||
| CVE-2026-0965 | | Libssh: libssh: denial of service via improper configuration file handling | LOW 3.3 | 0.2 % | ||
| CVE-2026-0967 | | Libssh: libssh: denial of service via inefficient regular expression processing | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-0968 | | Libssh: libssh: denial of service due to malformed sftp message | LOW 3.1 | 0.5 % | ||
| CVE-2026-0966 | fixed in 0.12.0-1.1.hum1 | Libssh: libssh: denial of service via zero-length input in ssh_get_hexa() | HIGH 8.2 | 0.6 % | ||
| CVE-2026-0964 | | Libssh: improper sanitation of paths received from scp servers | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-2100 | | P11-kit: null dereference via c_derivekey with specific null parameters | HIGH 7.5 | 1.3 % | ||
| CVE-2026-4897 | fixed in 127-5.1.hum1 | Polkit: polkit: denial of service via unbounded input processing through standard input | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-4775 | | Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing | HIGH 7.8 | 0.6 % | ||
| CVE-2026-4647 | fixed in 2.45.1-5.1.hum1 | Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-4426 | fixed in 3.8.7-1.hum1 | Libarchive: libarchive: denial of service via malformed iso file processing | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-3441 | fixed in 2.45.1-5.1.hum1 | Binutils: gnu binutils: information disclosure via specially crafted xcoff object file | HIGH 7.1 | 0.2 % | ||
| CVE-2026-3442 | fixed in 2.45.1-5.1.hum1 | Binutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linker | HIGH 7.1 | 0.3 % | ||
| CVE-2026-4111 | | Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive | HIGH 7.5 | 0.7 % | ||
| CVE-2026-4105 | fixed in 260.1-2.1.hum1 | Systemd: systemd: privilege escalation via improper access control in registermachine d-bus method | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-26158 | fixed in 1.37.0-7.2.hum1 | Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries | HIGH 7.0 | 0.2 % | ||
| CVE-2026-26157 | fixed in 1.37.0-7.2.hum1 | Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization | HIGH 7.0 | 0.7 % | ||
| CVE-2025-14831 | | Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification | MEDIUM 5.3 | 0.7 % | ||
| CVE-2026-1757 | fixed in 2.15.2-0.3.hum1 | Libxml2: memory leak leading to local denial of service in xmllint interactive shell | MEDIUM 6.2 | 0.2 % | ||
| CVE-2025-9820 | | Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function | MEDIUM 4.0 | 0.2 % | ||
| CVE-2026-0988 | fixed in 2.88.0-1.1.hum1 | Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek() | LOW 3.7 | 0.4 % | ||
| CVE-2026-0992 | fixed in 2.15.2-0.3.hum1 | Libxml2: libxml2: denial of service via crafted xml catalogs | LOW 2.9 | 0.5 % | ||
| CVE-2026-0989 | fixed in 2.15.2-0.3.hum1 | Libxml2: unbounded relaxng include recursion leading to stack overflow | LOW 3.7 | 0.5 % | ||
| CVE-2026-0990 | fixed in 2.15.2-0.3.hum1 | Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing | MEDIUM 5.9 | 1.0 % | ||
| CVE-2025-14512 | | Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow | MEDIUM 6.5 | 0.6 % | ||
| CVE-2025-14087 | | Glib: glib: buffer underflow in gvariant parser leads to heap corruption | CRITICAL 9.8 | 0.8 % | ||
| CVE-2025-14104 | | Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-13601 | | Glib: integer overflow in in g_escape_uri_string() | HIGH 7.7 | 0.3 % | ||
| CVE-2025-11731 | fixed in 1.1.45-0.1.hum1 | Libxslt: type confusion in exsltfuncresultcompfunction of libxslt | LOW 3.1 | 0.3 % | ||
| CVE-2025-10911 | | Libxslt: use-after-free with key data stored cross-rvt | MEDIUM 5.5 | 0.2 % | ||
| CVE-2025-9900 | | Libtiff: libtiff write-what-where | HIGH 8.8 | 1.0 % | ||
| CVE-2025-9566 | | Podman: podman kube play command may overwrite host files | HIGH 8.1 | 1.2 % | ||
| CVE-2025-7424 | fixed in 1.1.45-0.1.hum1 | Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes | HIGH 7.5 | 1.3 % | ||
| CVE-2025-7425 | | Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr | HIGH 7.8 | 0.4 % | ||
| CVE-2025-32990 | | Gnutls: vulnerability in gnutls certtool template parsing | HIGH 8.2 | 0.9 % | ||
| CVE-2025-32989 | | Gnutls: vulnerability in gnutls sct extension parsing | MEDIUM 5.3 | 1.5 % | ||
| CVE-2025-32988 | | Gnutls: vulnerability in gnutls othername san export | HIGH 8.2 | 1.5 % | ||
| CVE-2025-49794 | | Libxml: heap use after free (uaf) leads to denial of service (dos) | CRITICAL 9.1 | 0.8 % | ||
| CVE-2025-6170 | | Libxml2: stack buffer overflow in xmllint interactive shell command handling | LOW 2.5 | 0.3 % | ||
| CVE-2025-49795 | fixed in 2.15.2-0.3.hum1 | Libxml: null pointer dereference leads to denial of service (dos) | HIGH 7.5 | 0.6 % | ||
| CVE-2025-49796 | | Libxml: type confusion leads to denial of service (dos) | CRITICAL 9.1 | 1.6 % | ||
| CVE-2025-6021 | | Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2 | HIGH 7.5 | 1.4 % |