Total
342 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-104031 | 2 Fedoraproject, Redhat | 3 Sssd, Enterprise Linux, Openshift Container Platform | 2026-10-28 | N/A | 5.5 MEDIUM |
| A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS). | |||||
| CVE-2026-104032 | 2 Fedoraproject, Redhat | 3 Sssd, Enterprise Linux, Openshift Container Platform | 2026-10-28 | N/A | 5.5 MEDIUM |
| A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption. | |||||
| CVE-2026-6245 | 2 Fedoraproject, Redhat | 3 Sssd, Enterprise Linux, Openshift Container Platform | 2026-10-26 | N/A | 5.5 MEDIUM |
| A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an out-of-bounds read when processed by functions like snprintf(). A local attacker could potentially trigger this vulnerability by initiating a crafted passkey authentication request, causing the SSSD PAM responder to crash, resulting in a local Denial of Service (DoS). | |||||
| CVE-2026-39979 | 2 Jqlang, Redhat | 14 Jq, Ai Inference Server, Ansible Automation Platform and 11 more | 2026-10-26 | N/A | 6.5 MEDIUM |
| jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f. | |||||
| CVE-2026-33845 | 2 Gnu, Redhat | 3 Gnutls, Enterprise Linux, Openshift Container Platform | 2026-10-26 | N/A | 7.5 HIGH |
| A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service. | |||||
| CVE-2026-4878 | 2 Libcap Project, Redhat | 3 Libcap, Enterprise Linux, Openshift Container Platform | 2026-10-26 | N/A | 6.7 MEDIUM |
| A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation. | |||||
| CVE-2026-6845 | 2 Gnu, Redhat | 4 Binutils, Enterprise Linux, Hardened Images and 1 more | 2026-10-26 | N/A | 5.0 MEDIUM |
| A flaw was found in binutils, specifically within the `readelf` utility. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by tricking a user into processing a specially crafted Executable and Linkable Format (ELF) file. The exploitation of this flaw can lead to the system becoming unresponsive due to excessive resource consumption or a program crash. | |||||
| CVE-2026-6732 | 3 Ibm, Redhat, Xmlsoft | 7 Aix, Vios, Enterprise Linux and 4 more | 2026-10-26 | N/A | 6.5 MEDIUM |
| A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable. | |||||
| CVE-2026-3832 | 2 Gnu, Redhat | 4 Gnutls, Enterprise Linux, Hardened Images and 1 more | 2026-10-26 | N/A | 3.7 LOW |
| A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust. | |||||
| CVE-2026-7309 | 1 Redhat | 1 Openshift Container Platform | 2026-10-26 | N/A | 4.3 MEDIUM |
| A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfigs/instantiate` API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic. | |||||
| CVE-2026-6846 | 2 Gnu, Redhat | 4 Binutils, Enterprise Linux, Hardened Images and 1 more | 2026-10-26 | N/A | 7.8 HIGH |
| A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file during linking. A local attacker could trick a user into processing this malicious file, which could lead to arbitrary code execution, allowing the attacker to run unauthorized commands, or cause a denial of service, making the system unavailable. | |||||
| CVE-2026-6844 | 2 Gnu, Redhat | 4 Binutils, Enterprise Linux, Hardened Images and 1 more | 2026-10-26 | N/A | 5.5 MEDIUM |
| A flaw was found in the `readelf` utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a specially crafted Executable and Linkable Format (ELF) file. One vulnerability, a resource exhaustion (CWE-400), can lead to an out-of-memory condition. The other, a null pointer dereference (CWE-476), can cause a segmentation fault. Both issues can result in the `readelf` utility becoming unresponsive or crashing, leading to a denial of service. | |||||
| CVE-2026-6843 | 2 Gnu, Redhat | 3 Nano, Enterprise Linux, Openshift Container Platform | 2026-10-26 | N/A | 5.5 MEDIUM |
| A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application. | |||||
| CVE-2026-3833 | 2 Gnu, Redhat | 4 Gnutls, Enterprise Linux, Hardened Images and 1 more | 2026-10-26 | N/A | 6.5 MEDIUM |
| A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure. | |||||
| CVE-2026-5745 | 2 Libarchive, Redhat | 4 Libarchive, Enterprise Linux, Hardened Images and 1 more | 2026-10-26 | N/A | 5.5 MEDIUM |
| A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS). | |||||
| CVE-2026-4408 | 2 Redhat, Samba | 3 Enterprise Linux, Openshift Container Platform, Samba | 2026-10-26 | N/A | 9.0 CRITICAL |
| A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service. | |||||
| CVE-2026-3012 | 2 Redhat, Samba | 3 Enterprise Linux, Openshift Container Platform, Samba | 2026-10-26 | N/A | 8.0 HIGH |
| A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications. | |||||
| CVE-2026-71227 | 2 Redhat, Smuellerdd | 4 Enterprise Linux, Hardened Images, Openshift Container Platform and 1 more | 2026-10-22 | N/A | 5.1 MEDIUM |
| A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive. | |||||
| CVE-2026-71225 | 2 Redhat, Smuellerdd | 4 Enterprise Linux, Hardened Images, Openshift Container Platform and 1 more | 2026-10-22 | N/A | 6.5 MEDIUM |
| A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vector (IV) for each internal data chunk. A remote attacker could potentially exploit this by making an application that uses libkcapi process specially crafted large inputs. This can lead to a significant weakening of data confidentiality, as the repeated IV use can expose relationships in encrypted plaintext, and may also affect data integrity by causing incorrect cryptographic processing. | |||||
| CVE-2025-26465 | 4 Debian, Netapp, Openbsd and 1 more | 6 Debian Linux, Active Iq Unified Manager, Ontap and 3 more | 2026-10-21 | N/A | 6.8 MEDIUM |
| A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high. | |||||