Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,019

CVE-2026-14164

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Libarchive Red Hat Redhat
Products
Libarchive Enterprise Linux Ai Inference Server and 13 more
CVE-2026-13757

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
P11-kit Project Redhat
Products
P11-kit Cert Manager Cost Management and 10 more
CVE-2026-11850

Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read

An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Hardened Images Hummingbird and 4 more
CVE-2025-25208

Rhcl: authorino denial of service through authpolicy with sharedsecretref severity

A Developer persona can bring down the Authorino service, preventing the evaluation of all AuthPolicies on the cluster

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Connectivity Link Openshift Ai
CVE-2025-25207

Rhcl: authpolicy callbacks result in denial of service in authorino severity

The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with developer persona access can add a large number of those callbacks to be executed by Authorino and as the authentication policy is enforced by a single instance of the service, this leada to a Denial of Service in Authorino while processing the post-authorization callbacks.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Connectivity Link Openshift Ai
CVE-2025-5278

Coreutils: heap buffer under-read in gnu coreutils sort via key specification

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Cert Manager Cost Management Discovery and 7 more
CVE-2026-95521

Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Rpm
Products
Enterprise Linux Hardened Images Hummingbird and 3 more
CVE-2026-95519

Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat Rpm
Products
Enterprise Linux Hardened Images Hummingbird and 3 more
CVE-2026-40802

WordPress Pubjet | پاب‌جت plugin <= 5.4.8 - Settings Change vulnerability

Missing Authorization vulnerability in pubjet Pubjet | پاب‌جت pubjet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pubjet | پاب‌جت: from n/a through 5.4.8.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-7259

Ovirt-engine: potential exposure of cleartext provider passwords via web ui

A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ovirt Redhat
Products
Ovirt-engine Rhev Manager Virtualization
CVE-2026-93432

Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus

A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.

CVSS 3.1 · 6.1 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Quarkus Apicurio Registry Build Keycloak and 9 more
CVE-2026-15562

Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss-remoting Jboss Enterprise Application Platform Jboss Enterprise Application Platform Els and 2 more
CVE-2026-120194

Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Json-glib Red Hat Redhat
Products
Json-glib Enterprise Linux Enterprise Linux and 4 more
CVE-2026-121621

Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configuration

A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository is passed unsanitized into a shell-interpreted SSH command. An attacker able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the context of the Image Updater process.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Redhat
Products
Openshift Gitops
CVE-2026-121997

Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Hardened Images and 2 more
CVE-2026-107129

Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0

Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Balbooa.com
Products
Gridbox Extension For Joomla
CVE-2026-107130

Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0

Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Balbooa.com
Products
Gridbox Extension For Joomla
CVE-2026-107903

Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0

Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Balbooa.com
Products
Gridbox Extension For Joomla
CVE-2026-105607

Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0

Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Balbooa.com
Products
Gridbox Extension For Joomla
CVE-2026-119377

SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Sqlite
Products
Sqlite