Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-13757 | 6.2 medium | 0.00% | redhat, p11-kit_project, hardened_images, openshift_container_platform, enterprise_linux | A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services. | 14 Oct |
| CVE-2026-104046 | 6.2 medium | 0.00% | fedoraproject, redhat, sssd, openshift_container_platform, enterprise_linux | A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion can lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services. | 13 Oct |
| CVE-2026-55655 | 6.1 medium | 0.00% | openbsd, redhat, openssh, enterprise_linux | A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack can compromise the confidentiality of forwarded X11 traffic, including sensitive window contents and input, and may allow some manipulation of the forwarded session. | Mon 26 Oct |
| CVE-2026-104040 | 6.1 medium | 0.00% | fedoraproject, redhat, sssd, openshift_container_platform, enterprise_linux | A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population. | 16 Oct |
| CVE-2026-78475 | 6.1 medium | 0.00% | gimp, redhat, enterprise_linux | A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file. | 12 Oct |
| CVE-2023-39193 | 6.0 medium | 0.00% | linux, redhat, linux_kernel, enterprise_linux, fedora | A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. | 15 Oct |
| CVE-2023-39192 | 6.0 medium | 0.00% | linux, redhat, linux_kernel, enterprise_linux, fedora | A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure. | 15 Oct |
| CVE-2023-39189 | 6.0 medium | 0.00% | linux, redhat, linux_kernel, enterprise_linux, fedora | A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. | 15 Oct |
| CVE-2026-109833 | 5.9 medium | 0.00% | no CPE yet | A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reach an enabled VNC TLS listener and trigger a peek/read size mismatch can cause an out-of-bounds write, leading to denial of service. | 15 Oct |
| CVE-2023-38473 | 5.5 medium | 0.00% | avahi, redhat, enterprise_linux | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function. | Wed 28 Oct |
| CVE-2023-38472 | 5.5 medium | 0.00% | avahi, redhat, enterprise_linux | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function. | Wed 28 Oct |
| CVE-2023-38471 | 5.5 medium | 0.00% | avahi, redhat, enterprise_linux | A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function. | Wed 28 Oct |
| CVE-2023-38470 | 5.5 medium | 0.00% | avahi, redhat, enterprise_linux | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function. | Wed 28 Oct |
| CVE-2023-38469 | 5.5 medium | 0.00% | avahi, redhat, enterprise_linux | A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record. | Wed 28 Oct |
| CVE-2026-104029 | 5.5 medium | 0.00% | fedoraproject, redhat, sssd, openshift_container_platform, enterprise_linux | A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs an out-of-bounds memory read. This flaw can cause the autofs responder process to crash, resulting in a denial of service (DoS). | Wed 28 Oct |
| CVE-2026-104030 | 5.5 medium | 0.00% | fedoraproject, redhat, sssd, openshift_container_platform, enterprise_linux | A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash and disrupting authentication services. | Wed 28 Oct |
| CVE-2026-104031 | 5.5 medium | 0.00% | fedoraproject, redhat, sssd, openshift_container_platform, enterprise_linux | A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS). | Wed 28 Oct |
| CVE-2026-104032 | 5.5 medium | 0.00% | fedoraproject, redhat, sssd, openshift_container_platform, enterprise_linux | A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption. | Wed 28 Oct |
| CVE-2026-4948 | 5.5 medium | 0.00% | firewalld, redhat, enterprise_linux | A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicySettings. This mis-authorization allows the user to modify the runtime firewall state without proper authentication, leading to unauthorized changes in network security configurations. | Mon 26 Oct |
| CVE-2026-5704 | 5.5 medium | 0.00% | gnu, redhat, tar, hardened_images, enterprise_linux | A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection. | Mon 26 Oct |
| CVE-2026-6245 | 5.5 medium | 0.00% | fedoraproject, redhat, sssd, openshift_container_platform, enterprise_linux | A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly handle raw bytes received from a pipe. Because the data is treated as a NUL-terminated C string without explicit termination, it results in an out-of-bounds read when processed by functions like snprintf(). A local attacker could potentially trigger this vulnerability by initiating a crafted passkey authentication request, causing the SSSD PAM responder to crash, resulting in a local Denial of Service (DoS). | Mon 26 Oct |
| CVE-2026-5745 | 5.5 medium | 0.00% | libarchive, redhat, hardened_images, openshift_container_platform | A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare "d" or "default" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS). | Mon 26 Oct |
| CVE-2026-40916 | 5.5 medium | 0.00% | gimp, redhat, enterprise_linux | A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (DoS). By opening a specially crafted TIM image file, the application crashes due to an unconditional overflow when writing to a variable-length array. | Mon 26 Oct |
| CVE-2026-40918 | 5.5 medium | 0.00% | gimp, redhat, enterprise_linux | A flaw was found in GIMP. Processing a specially crafted PVR image file with large dimensions can lead to a denial of service (DoS). This occurs due to a stack-based buffer overflow and an out-of-bounds read in the PVR image loader, causing the application to crash. Systems that process untrusted PVR image files are affected. | Mon 26 Oct |
| CVE-2026-40919 | 5.5 medium | 0.00% | gimp, redhat, enterprise_linux | A flaw was found in GIMP. This vulnerability, a buffer overflow in the `file-seattle-filmworks` plugin, can be exploited when a user opens a specially crafted Seattle Filmworks file. A remote attacker could leverage this to cause a denial of service (DoS), leading to the plugin crashing and potentially impacting the stability of the GIMP application. | Mon 26 Oct |
| CVE-2026-6843 | 5.5 medium | 0.00% | gnu, redhat, nano, openshift_container_platform, enterprise_linux | A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application. | Mon 26 Oct |
| CVE-2026-6844 | 5.5 medium | 0.00% | gnu, redhat, binutils, hardened_images, openshift_container_platform | A flaw was found in the `readelf` utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a specially crafted Executable and Linkable Format (ELF) file. One vulnerability, a resource exhaustion (CWE-400), can lead to an out-of-memory condition. The other, a null pointer dereference (CWE-476), can cause a segmentation fault. Both issues can result in the `readelf` utility becoming unresponsive or crashing, leading to a denial of service. | Mon 26 Oct |
| CVE-2024-0443 | 5.5 medium | 0.00% | linux, redhat, linux_kernel, enterprise_linux, fedora | A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error. | Mon 26 Oct |
| CVE-2023-6915 | 5.5 medium | 0.00% | debian, redhat, debian_linux, codeready_linux_builder, codeready_linux_builder_for_arm64 | A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return. | Fri 23 Oct |
| CVE-2024-45778 | 5.5 medium | 0.00% | gnu, redhat, grub2, openshift_container_platform, enterprise_linux | A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash. | 21 Oct |
| CVE-2026-88252 | 5.5 medium | 0.00% | fedoraproject, redhat, sssd, openshift_container_platform, enterprise_linux | A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed. | 20 Oct |
| CVE-2024-0232 | 5.5 medium | 0.00% | sqlite, redhat, enterprise_linux, extra_packages_for_enterprise_linux | A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service. | 15 Oct |
| CVE-2023-42755 | 5.5 medium | 0.00% | linux, redhat, linux_kernel, enterprise_linux, debian_linux | A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service. | 15 Oct |
| CVE-2023-42754 | 5.5 medium | 0.00% | linux, redhat, linux_kernel, enterprise_linux, fedora | A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system. | 15 Oct |
| CVE-2023-1095 | 5.5 medium | 0.00% | linux, redhat, linux_kernel, enterprise_linux | In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference. | 14 Oct |
| CVE-2026-90995 | 5.5 medium | 0.00% | fedoraproject, redhat, sssd, openshift_container_platform, enterprise_linux | A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services. | 14 Oct |
| CVE-2022-3821 | 5.5 medium | 0.00% | systemd_project, redhat, systemd, enterprise_linux, fedora | An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service. | 14 Oct |
| CVE-2022-2905 | 5.5 medium | 0.00% | linux, redhat, linux_kernel, enterprise_linux, debian_linux | An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data. | 14 Oct |
| CVE-2022-2153 | 5.5 medium | 0.00% | linux, fedoraproject, linux_kernel, fedora, enterprise_linux | A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service. | 14 Oct |
| CVE-2022-1852 | 5.5 medium | 0.00% | linux, redhat, linux_kernel, enterprise_linux | A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in guest in the Intel CPU. | 14 Oct |
| CVE-2022-1184 | 5.5 medium | 0.00% | linux, redhat, linux_kernel, enterprise_linux, debian_linux | A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service. | 14 Oct |
| CVE-2022-0171 | 5.5 medium | 0.00% | linux, redhat, linux_kernel, enterprise_linux, debian_linux | A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV). | 14 Oct |
| CVE-2026-19548 | 5.5 medium | 0.00% | redhat, hardened_images, openshift_container_platform, enterprise_linux | Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element: 1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive) 2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_get_filename call 3. Line ~1525: dereferencing the shallow copy orig_input.the_bfd->my_archive in trace/verbose logging The vulnerability is triggered when LTO plugins are active (link_info.lto_plugin_active is true) and the input object has abfd->my_archive == NULL, which is a valid state for standalone object files. Red Hat builds binutils with --enable-plugins and --enable-lto, confirming the vulnerable code path is compiled in and reachable. An attacker who can supply a crafted object or archive file to a build process using LTO-enabled linking could exploit this flaw to cause a denial of service (linker crash via segmentation fault). Arbitrary code execution is theoretically possible through heap manipulation but is substantially mitigated by hardening measures including stack protector, FORTIFY_SOURCE, ASLR, and PIE. The attack surface is limited to build-time environments — the linker is a development tool not exposed in production runtime. The most realistic exploitation scenario is a supply chain attack introducing a crafted object file as a build dependency in CI/CD pipelines or development environments. | 14 Oct |
| CVE-2023-4459 | 5.5 medium | 0.00% | linux, redhat, linux_kernel, enterprise_linux | A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup. | 8 Oct |
| CVE-2021-20320 | 5.5 medium | 0.00% | linux, fedoraproject, linux_kernel, fedora, enterprise_linux | A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem. | 8 Oct |
| CVE-2026-93007 | 5.3 medium | — | red hat, red hat ceph storage 9, red hat enterprise linux 10, red hat enterprise linux 6 | A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime. | 7 h ago |
| CVE-2026-93011 | 5.3 medium | — | red hat, red hat ceph storage 9, red hat enterprise linux 10, red hat enterprise linux 6 | A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime. | 10 h ago |
| CVE-2026-2708 | 5.3 medium | 0.00% | gnome, redhat, libsoup, enterprise_linux | A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values. | Mon 26 Oct |
| CVE-2026-104047 | 5.3 medium | 0.00% | fedoraproject, redhat, sssd, openshift_container_platform, enterprise_linux | A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory. | 9 Oct |
| CVE-2026-71227 | 5.1 medium | 0.00% | redhat, smuellerdd, hardened_images, openshift_container_platform, libkcapi | A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive. | 22 Oct |
Download these 268 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.