Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,614

CVE-2026-66903

Apache OFBiz: Authenticated Path Traversal in Catalog Image Management

Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Ofbiz Apache Ofbiz
CVE-2026-77014

Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses

A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openshift Container Platform and 1 more
CVE-2026-76925

Flatpak: flatpak: toctou race condition allows symlink redirection

A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Els
CVE-2026-76781

Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Hardened Images Hummingbird and 4 more
CVE-2026-75900

Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch

An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2026-75883

Pppd: pppd: buffer overflow in peap response handling leads to data corruption or denial of service.

A flaw was found in pppd. A remote attacker could exploit a buffer overflow vulnerability in the PEAP response handling. By sending a specially crafted PEAP Request packet, an attacker could cause the pppd process to corrupt global static data, leading to incorrect behavior or a system crash.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ppp Project Redhat
Products
Ppp Enterprise Linux Rhel Els
CVE-2026-74859

Gnome-tweaks: path traversal in theme installer

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside ~/.themes by using ../ path traversal, absolute paths, or symlink entries.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2026-111079

Goose: goose: shell history and environment leak via terminal integration

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux
CVE-2026-94449

Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Quarkus Apicurio Registry Camel Quarkus and 3 more
CVE-2026-117626

jenkins: Jenkins: Information disclosure via path traversal in file browser

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the $JENKINS_HOME, and attackers with Item/Workspace permission to obtain the names of jobs that have a workspace on the same agent.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins Jenkins Project
Products
Jenkins Jenkins
CVE-2026-115942

Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Qpid Proton-c
CVE-2026-15466

GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decremented in non-atomical way allowing other code paths using a freed object to read and/or write kernel heap memory.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2026-19199

GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet

Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocation. This may allow unallocated or previously allocated physical pages to be mapped into an attacker-controlled GPU MMU context, leading to disclosure of sensitive kernel data.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Imaginationtech
Products
Graphics Ddk
CVE-2026-119757

BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Btcpayserver
Products
Btcpay Server