Total
398493 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-17209 | 1 Ibm | 1 Db2 Mirror For I | 2026-08-21 | N/A | 6.3 MEDIUM |
| IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. | |||||
| CVE-2026-17227 | 1 Ibm | 1 Db2 Mirror For I | 2026-08-21 | N/A | 5.4 MEDIUM |
| IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements used in an SQL command. | |||||
| CVE-2026-18178 | 1 Ibm | 1 Db2 Mirror For I | 2026-08-21 | N/A | 5.4 MEDIUM |
| IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path traversal. | |||||
| CVE-2026-18554 | 1 Ibm | 1 Db2 Mirror For I | 2026-08-21 | N/A | 7.5 HIGH |
| IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | |||||
| CVE-2026-9064 | 1 Redhat | 3 389 Directory Server, Directory Server, Enterprise Linux | 2026-08-21 | N/A | 7.5 HIGH |
| A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service. | |||||
| CVE-2026-59089 | 2 Gimp, Redhat | 2 Gimp, Enterprise Linux | 2026-08-21 | N/A | 5.5 MEDIUM |
| A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker could exploit this by providing a specially crafted image file, leading to undefined behavior and causing the GIMP plug-in to abort, effectively resulting in a denial of service. | |||||
| CVE-2026-59088 | 2 Gimp, Redhat | 2 Gimp, Enterprise Linux | 2026-08-21 | N/A | 5.5 MEDIUM |
| A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service. | |||||
| CVE-2026-16529 | 2026-08-21 | N/A | 7.5 HIGH | ||
| A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads. | |||||
| CVE-2026-16527 | 2026-08-21 | N/A | 7.3 HIGH | ||
| An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover. | |||||
| CVE-2026-16526 | 2026-08-21 | N/A | 8.8 HIGH | ||
| A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root. | |||||
| CVE-2026-16524 | 2026-08-21 | N/A | 7.8 HIGH | ||
| A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh. | |||||
| CVE-2026-14544 | 2026-08-21 | N/A | 9.8 CRITICAL | ||
| A flaw was found in HPLIP (HP Linux Imaging and Printing Software). This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to escalate privileges or achieve arbitrary code execution. This can occur through an integer overflow in the hpcups processing path when handling specially crafted print data. | |||||
| CVE-2026-10649 | 2026-08-21 | N/A | 8.6 HIGH | ||
| A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing. | |||||
| CVE-2024-5154 | 2 Kubernetes, Redhat | 3 Cri-o, Enterprise Linux, Openshift Container Platform | 2026-08-21 | N/A | 8.1 HIGH |
| A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system. | |||||
| CVE-2024-1394 | 2026-08-21 | N/A | 7.5 HIGH | ||
| A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them. | |||||
| CVE-2026-74965 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-21 | N/A | 8.8 HIGH |
| Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2026-74955 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-21 | N/A | 8.8 HIGH |
| Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2026-74953 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-21 | N/A | 8.8 HIGH |
| Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2026-74950 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-21 | N/A | 8.8 HIGH |
| Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2026-74947 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-21 | N/A | 8.8 HIGH |
| Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||